7e7a371a7f563dc181cbe70a684880cbf036a2540b322ab56916b3671ace7df3

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	GoogleDesktopSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	GoogleDesktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	GoogleDesktop.exe

Executes dropped EXE 10 IoCs

pid	Process
4188	GoogleDesktopSetupHelper.exe
5004	GoogleDesktop.exe
2412	GoogleDesktop.exe
2460	GoogleDesktop.exe
4356	GoogleDesktop.exe
2324	GoogleDesktop64BitLaunch.exe
1036	GoogleDesktop.exe
1700	GoogleDesktop.exe
4572	GoogleDesktop.exe
1396	GoogleDesktop.exe

Loads dropped DLL 64 IoCs

pid	Process
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
4188	GoogleDesktopSetupHelper.exe
4188	GoogleDesktopSetupHelper.exe
4188	GoogleDesktopSetupHelper.exe
5004	GoogleDesktop.exe
5004	GoogleDesktop.exe
5004	GoogleDesktop.exe
2412	GoogleDesktop.exe
2412	GoogleDesktop.exe
2412	GoogleDesktop.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
2460	GoogleDesktop.exe
2460	GoogleDesktop.exe
2460	GoogleDesktop.exe
2460	GoogleDesktop.exe
2460	GoogleDesktop.exe
4356	GoogleDesktop.exe
4356	GoogleDesktop.exe
4356	GoogleDesktop.exe
4356	GoogleDesktop.exe
2324	GoogleDesktop64BitLaunch.exe
3380	Explorer.EXE
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1700	GoogleDesktop.exe
1700	GoogleDesktop.exe
1700	GoogleDesktop.exe
1700	GoogleDesktop.exe
1700	GoogleDesktop.exe
4572	GoogleDesktop.exe
4572	GoogleDesktop.exe
4572	GoogleDesktop.exe
4572	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1752	rundll32.exe
1752	rundll32.exe
1752	rundll32.exe
1752	rundll32.exe
1752	rundll32.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Desktop Search = "\"C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"	GoogleDesktopSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	GoogleDesktop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	GoogleDesktop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png	GoogleDesktop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	GoogleDesktop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	GoogleDesktop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ac ### files - your system	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox28.tlb	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe	GoogleDesktop.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc	GoogleDesktop.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopNetwork3.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak	GoogleDesktop.exe
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	GoogleDesktop.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	GoogleDesktop.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\install.ins	GoogleDesktop.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSetup.exe	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui	GoogleDesktop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	GoogleDesktop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleDesktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	GoogleDesktop.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "no"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.google.com/ie"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\DisplayName = "Google"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D80A6D1-B500-47DA-82B8-EB9875F85B4D}	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\URL = "http://www.google.com/search?q={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\URL = "http://127.0.0.1:4664/search&s=lrxTpYBIXro_Z40vc09m-9uvDNo?q={searchTerms}"	GoogleDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\SearchScopes\	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\URL = "http://www.google.com/search?q={searchTerms}&rlz=1I7GGLD_en&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7"	GoogleDesktop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D80A6D1-B500-47DA-82B8-EB9875F85B4D}\Compatibility Flags = "1024"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\FaviconPath = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\favicon.ico"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\DisplayName = "Google Desktop"	GoogleDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}	GoogleDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\Main	GoogleDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}	GoogleDesktop.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com/"	GoogleDesktop.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7C0BEB7-446B-43BF-83E3-5EC37A9DBCC8}	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BA6059E-03F3-4931-9BC0-375B694CAE3F}\TypeLib	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B41F373F-04FE-4D69-A972-DEB002444278}\ProxyStubClsid32	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECCB4495-7F5B-4B4E-A887-7A66BE948AC1}\InprocServer32	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E467448-EC21-4A24-BFCD-2DF951214F00}\ProxyStubClsid32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A27060E0-6921-4C82-8C15-935620B73ED3}\InprocServer32\ThreadingModel = "Both"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.MICF\	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50EDABE0-140C-406D-A8B9-32652145560A}\Programmable	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{634E2122-6BB7-430F-B452-CF04C8722C47}\InprocServer32\ThreadingModel = "Apartment"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5006908-0C7A-49E2-85DA-C2675E554F91}\TypeLib	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6D8FE80-712E-4F30-9CD2-F7FEF473BA44}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopAPI2.dll"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleGadgetManifest\shell	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5751ACAA-4710-4160-999F-A2AD6FEA3484}	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E72293F-05C2-4C1A-8E4E-3158EC3D8574}\ProxyStubClsid32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75CCC48F-8C8A-4E21-896E-AB408D3592D0}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleServices.DLL"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{163BDD74-7164-4940-84B3-575898032CF9}\InprocServer32\ThreadingModel = "Apartment"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2BF1B7EE-DC5C-4F05-8DFA-273D6C199567}\ = "IGoogleDesktopDisplayContentItemHandler"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4853C4B-43EB-41DE-A0B1-B5B97C31CB0A}\ProxyStubClsid32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.EventPublisher.1\CLSID\ = "{2C6F11D4-CF22-4E1F-A271-2A4A0393ADAC}"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED90C79B-B01D-4A4F-B3D6-CE736B57645C}	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66F9F427-03C9-462F-85AF-88F362620FB0}\ = "IGoogleDesktopStockPanelDetailsView"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CEB927-5FCD-4777-91D1-90031D643382}\Description\	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEF88129-AF9F-4FC3-9B28-772CF06F8C7E}\InprocServer32\ThreadingModel = "Both"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\app/gg\Extension = ".gg"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6D8FE80-712E-4F30-9CD2-F7FEF473BA44}\ProgID\ = "GoogleDesktop.RankableItem.1"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84AB752D-6BBB-490C-8BF8-4D459F775B13}	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEF88129-AF9F-4FC3-9B28-772CF06F8C7E}	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CBE5894-03B1-48C9-922A-CE5C886252F3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3534261-9E76-435C-8AD7-C1406B5E1C83}\ProxyStubClsid32	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AD5597A-2B0F-4479-97B6-C514DEC41EA1}\VersionIndependentProgID	GoogleDesktop.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CEB927-5FCD-4777-91D1-90031D643382}\Programmable	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E37FB82-3FC3-4464-A7AE-D3B9E90E11A7}\TypeLib	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86EB2E81-9323-4F83-A3EC-EF1800F3D9D5}\TypeLib	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81ACBD30-3750-4C4E-BDA1-173FB509D475}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopAPI2.dll"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB93C531-A7EE-4396-A026-17A44D384B65}\ProxyStubClsid32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F549279-DE9A-4250-A985-4D9B7ECD48B6}\ = "IGoogleDesktopDisplaySite3"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC18CC8F-D1D6-485D-BF12-7C705BEAAF51}\ProxyStubClsid32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A734302-566D-4C1C-B805-4643F6A95565}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopAPI2.dll"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2D71E8B-D85F-4B7A-9315-41EF8443D1D5}\InprocServer32\ThreadingModel = "Both"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2BBF60B4-E292-4E69-91C8-2FA3F0D55997}\TypeLib\ = "{ACD1A266-C77B-4691-B96A-AF712B83A364}"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktopSearch.EventFactory.1\CLSID\ = "{579822B3-44CD-4786-83E0-AE32BCB9E6B1}"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2D71E8B-D85F-4B7A-9315-41EF8443D1D5}\Programmable	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleTalk.TalkFriend	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ACD1A266-C77B-4691-B96A-AF712B83A364}\3.0\FLAGS\ = "0"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4052D303-74C5-49EA-BC6B-66099C8D4007}	GoogleDesktop.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA34768-CE6C-425E-B443-3661CE14FF8F}\ProgID	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B60D50-19AB-4A32-A8B1-A09113AB2BA4}\2.1\0\win32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleServices.DLL"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86EB2E81-9323-4F83-A3EC-EF1800F3D9D5}\TypeLib\ = "{777C9CEC-FBBC-4294-8C7C-A231F89382E3}"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{634E2122-6BB7-430F-B452-CF04C8722C47}\Programmable	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECCB4495-7F5B-4B4E-A887-7A66BE948AC1}\ = "@C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopResources_en.dll,-9034;News"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{507102D5-CBEF-43E6-936C-2E6FD3DE8603}	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B62A832-2CA2-4843-86CA-45450D35EADA}\VersionIndependentProgID	GoogleDesktopSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AD5597A-2B0F-4479-97B6-C514DEC41EA1}\ProgID	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4516155C-B94E-4334-8D26-D4BF0932581C}\Description	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F549279-DE9A-4250-A985-4D9B7ECD48B6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C92D45D1-9956-4B69-8B1C-3CF5CD109908}\VersionIndependentProgID	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54648593-C279-476D-82AF-9CFCB45313B4}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleServices.DLL"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55EED705-AEF7-4F13-8030-371A89A1340B}\ = "GoogleDesktopRankingEngine Class"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F11D7457-2381-4337-977F-4090C75EBC23}\Programmable	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82F11EB2-19AF-415D-816E-05FBA034A616}\TypeLib\ = "{ACD1A266-C77B-4691-B96A-AF712B83A364}"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C942271F-CEFF-4CF6-8597-050CE76A65B1}\TypeLib\Version = "2.1"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AD5597A-2B0F-4479-97B6-C514DEC41EA1}\ProgID\ = "GoogleDesktop.TalkPlugin.1"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3173C82-8B78-4F08-B19A-A65B7F48630A}\ = "IGoogleDesktopRegisterCustomAction"	GoogleDesktopSetup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	GoogleDesktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	GoogleDesktop.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
3740	GoogleDesktopSetup.exe
3740	GoogleDesktopSetup.exe
1752	rundll32.exe
1752	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
4300	rundll32.exe
4300	rundll32.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3380	Explorer.EXE
1036	GoogleDesktop.exe
1396	GoogleDesktop.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	GoogleDesktopSetup.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: 33	1396	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1396	GoogleDesktop.exe
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: SeShutdownPrivilege	3380	Explorer.EXE
Token: SeCreatePagefilePrivilege	3380	Explorer.EXE
Token: 33	1036	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1036	GoogleDesktop.exe
Token: 33	1396	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1396	GoogleDesktop.exe
Token: 33	1396	GoogleDesktop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
3380	Explorer.EXE
3380	Explorer.EXE
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1036	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1036	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
3380	Explorer.EXE
3380	Explorer.EXE
1396	GoogleDesktop.exe
3380	Explorer.EXE
3380	Explorer.EXE
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
3380	Explorer.EXE
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1396	GoogleDesktop.exe
1036	GoogleDesktop.exe
3380	Explorer.EXE
3380	Explorer.EXE
3380	Explorer.EXE
3380	Explorer.EXE
3380	Explorer.EXE
3380	Explorer.EXE
3380	Explorer.EXE
3380	Explorer.EXE
3380	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1036	GoogleDesktop.exe
3380	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3380	Explorer.EXE

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4188	3740	GoogleDesktopSetup.exe	93
PID 3740 wrote to memory of 4188	3740	GoogleDesktopSetup.exe	93
PID 3740 wrote to memory of 4188	3740	GoogleDesktopSetup.exe	93
PID 3740 wrote to memory of 5004	3740	GoogleDesktopSetup.exe	96
PID 3740 wrote to memory of 5004	3740	GoogleDesktopSetup.exe	96
PID 3740 wrote to memory of 5004	3740	GoogleDesktopSetup.exe	96
PID 3740 wrote to memory of 2412	3740	GoogleDesktopSetup.exe	98
PID 3740 wrote to memory of 2412	3740	GoogleDesktopSetup.exe	98
PID 3740 wrote to memory of 2412	3740	GoogleDesktopSetup.exe	98
PID 3740 wrote to memory of 2460	3740	GoogleDesktopSetup.exe	102
PID 3740 wrote to memory of 2460	3740	GoogleDesktopSetup.exe	102
PID 3740 wrote to memory of 2460	3740	GoogleDesktopSetup.exe	102
PID 3740 wrote to memory of 4356	3740	GoogleDesktopSetup.exe	108
PID 3740 wrote to memory of 4356	3740	GoogleDesktopSetup.exe	108
PID 3740 wrote to memory of 4356	3740	GoogleDesktopSetup.exe	108
PID 3740 wrote to memory of 2324	3740	GoogleDesktopSetup.exe	109
PID 3740 wrote to memory of 2324	3740	GoogleDesktopSetup.exe	109
PID 2324 wrote to memory of 3380	2324	GoogleDesktop64BitLaunch.exe	52
PID 2324 wrote to memory of 3380	2324	GoogleDesktop64BitLaunch.exe	52
PID 3380 wrote to memory of 1036	3380	Explorer.EXE	110
PID 3380 wrote to memory of 1036	3380	Explorer.EXE	110
PID 3380 wrote to memory of 1036	3380	Explorer.EXE	110
PID 1036 wrote to memory of 1700	1036	GoogleDesktop.exe	112
PID 1036 wrote to memory of 1700	1036	GoogleDesktop.exe	112
PID 1036 wrote to memory of 1700	1036	GoogleDesktop.exe	112
PID 1036 wrote to memory of 1752	1036	GoogleDesktop.exe	122
PID 1036 wrote to memory of 1752	1036	GoogleDesktop.exe	122
PID 1036 wrote to memory of 1752	1036	GoogleDesktop.exe	122
PID 1036 wrote to memory of 1396	1036	GoogleDesktop.exe	123
PID 1036 wrote to memory of 1396	1036	GoogleDesktop.exe	123
PID 1036 wrote to memory of 1396	1036	GoogleDesktop.exe	123
PID 1036 wrote to memory of 2572	1036	GoogleDesktop.exe	128
PID 1036 wrote to memory of 2572	1036	GoogleDesktop.exe	128
PID 1036 wrote to memory of 2572	1036	GoogleDesktop.exe	128
PID 1036 wrote to memory of 3368	1036	GoogleDesktop.exe	129
PID 1036 wrote to memory of 3368	1036	GoogleDesktop.exe	129
PID 1036 wrote to memory of 3368	1036	GoogleDesktop.exe	129
PID 1036 wrote to memory of 4300	1036	GoogleDesktop.exe	131
PID 1036 wrote to memory of 4300	1036	GoogleDesktop.exe	131
PID 1036 wrote to memory of 4300	1036	GoogleDesktop.exe	131
PID 1036 wrote to memory of 1276	1036	GoogleDesktop.exe	133
PID 1036 wrote to memory of 1276	1036	GoogleDesktop.exe	133
PID 1036 wrote to memory of 1276	1036	GoogleDesktop.exe	133

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\GoogleDesktopSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\GoogleDesktopSetup.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe" /mdo
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4188
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /system /regserver /quit
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:5004
- - C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe" /manager /service /path "C:\Program Files (x86)\Google\Google Desktop Search\"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:2412
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /display /regserver /quit
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:2460
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /system /gdupdate /quit /system
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4356
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe" 00430072006500610074006500500072006F0063006500730073 00000D34 0043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0047006F006F0067006C0065005C0047006F006F0067006C00650020004400650073006B0074006F00700020005300650061007200630068005C0047006F006F0067006C0065004400650073006B0074006F0070002E006500780065 002F0069006E007300740061006C006C0020 0000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2324
- C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
  /install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /display /userreg /quit
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1700
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1752
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "GoogleDesktop.exe" /display
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SendNotifyMessage
    PID:1396
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2572
- - C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046}" http://127.0.0.1:4664/status&s=4Dor41fqGE5xS5aJKoWYR9akrIw
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4300
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain
    3⤵
    PID:1276

C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery