neshta | 3ff5b8d4a80c9f631c2220c3f7ff9f1839bbd04d6eda9e57add7360a71774d1d

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	c0e42cf18b138205a171768f3dddf0e0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	GoogleUpdate.exe

Executes dropped EXE 12 IoCs

pid	Process
2044	c0e42cf18b138205a171768f3dddf0e0.exe
228	GoogleUpdate.exe
1636	GoogleUpdate.exe
4464	svchost.com
728	GOOGLE~1.EXE
2520	svchost.com
3736	GOOGLE~1.EXE
4796	GoogleUpdate.exe
2296	109.0.5414.168_chrome_installer.exe
2812	setup.exe
4972	setup.exe
4644	GoogleUpdate.exe

Loads dropped DLL 16 IoCs

pid	Process
228	GoogleUpdate.exe
1636	GoogleUpdate.exe
1636	GoogleUpdate.exe
1636	GoogleUpdate.exe
1636	GoogleUpdate.exe
228	GoogleUpdate.exe
728	GOOGLE~1.EXE
3736	GOOGLE~1.EXE
4796	GoogleUpdate.exe
4796	GoogleUpdate.exe
3736	GOOGLE~1.EXE
228	GoogleUpdate.exe
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c0e42cf18b138205a171768f3dddf0e0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\psuser.dll"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\LocalServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\LocalServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\LocalServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InProcServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\GoogleUpdate.exe\""	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\npGoogleUpdate3.dll"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InProcServer32	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32\ThreadingModel = "Both"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\npGoogleUpdate3.dll"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\LocalServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32\ThreadingModel = "Apartment"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\LocalServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\psuser.dll"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32\ThreadingModel = "Apartment"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InProcServer32\ThreadingModel = "Both"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32	GoogleUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\GoogleUpdate.exe\" /c"	GoogleUpdate.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GOOGLE~1.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GOOGLE~1.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MIA062~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13181~1.5\MICROS~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MI9C33~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~3.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~4.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	c0e42cf18b138205a171768f3dddf0e0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	c0e42cf18b138205a171768f3dddf0e0.exe
File created	C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1497073144-2389943819-3385106915-1000Core.job	GoogleUpdate.exe
File created	C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1497073144-2389943819-3385106915-1000UA.job	GoogleUpdate.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Google\\Update"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppName = "GoogleUpdateOnDemand.exe"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57"	GoogleUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Policy = "3"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\CLSID = "{51F9E8EF-59D7-475B-A106-C7EA6F30C119}"	GoogleUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\Policy = "3"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppName = "GoogleUpdate.exe"	GoogleUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Policy = "3"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}	GoogleUpdate.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133546430273402342"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.Update3WebUser.1.0\ = "GoogleUpdate Update3Web"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\psuser.dll"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.OnDemandCOMClassUser	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.Update3WebUser.1.0	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\ = "GoogleUpdate CredentialDialog"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Google.OneClickProcessLauncherUser.1.0	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Google.Update3WebControl.3	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\ProgID	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\ = "Update3COMClass"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.Update3WebUser\CurVer\ = "GoogleUpdate.Update3WebUser.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.CredentialDialogUser\CurVer	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\ProgID	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_CLASSES\WOW6432NODE\INTERFACE\{C6398F88-69CE-44AC-B6A7-1D3E2AA46679}\NUMMETHODS	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.Update3COMClassUser\CLSID\ = "{022105BD-948A-40C9-AB42-A3300DDF097F}"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{C6398F88-69CE-44AC-B6A7-1D3E2AA46679}	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32\ = "{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{D7B9DE33-A75A-422A-8EF9-E71896654A18}\ProxyStubClsid32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\NumMethods\ = "4"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.Update3WebUser.1.0	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Google.OneClickCtrl.9	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.OnDemandCOMClassUser.1.0	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\ProgID\ = "GoogleUpdate.Update3COMClassUser.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Update\\1.3.21.57\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_CLASSES\WOW6432NODE\INTERFACE\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NUMMETHODS	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_CLASSES\WOW6432NODE\INTERFACE\{909489C2-85A6-4322-AA56-D25278649D67}\NUMMETHODS	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{515C93ED-88BD-4CCB-AE7F-9F2A1E9695A3}\InprocHandler32\ThreadingModel = "Both"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.OnDemandCOMClassUser.1.0	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Google.OneClickProcessLauncherUser.1.0	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.CredentialDialogUser.1.0\CLSID\ = "{E67BE843-BBBE-4484-95FB-05271AE86750}"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2"	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{D999CE21-98B3-4894-BACB-A49A1D50848F}	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{D999CE21-98B3-4894-BACB-A49A1D50848F}\ = "IApp"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ = "IProgressWndEvents"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.OnDemandCOMClassUser\ = "Google Update Legacy On Demand"	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\GoogleUpdate.CredentialDialogUser\CLSID\ = "{E67BE843-BBBE-4484-95FB-05271AE86750}"	GoogleUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}	GoogleUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\ = "{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}"	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
228	GoogleUpdate.exe
228	GoogleUpdate.exe
3876	chrome.exe
3876	chrome.exe
228	GoogleUpdate.exe
228	GoogleUpdate.exe
228	GoogleUpdate.exe
228	GoogleUpdate.exe
228	GoogleUpdate.exe
228	GoogleUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3876	chrome.exe
3876	chrome.exe
3876	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	GoogleUpdate.exe
Token: 33	2296	109.0.5414.168_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	2296	109.0.5414.168_chrome_installer.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeDebugPrivilege	228	GoogleUpdate.exe
Token: SeDebugPrivilege	228	GoogleUpdate.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe
Token: SeCreatePagefilePrivilege	3876	chrome.exe
Token: SeShutdownPrivilege	3876	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3876	chrome.exe
3876	chrome.exe
3876	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2044	2344	c0e42cf18b138205a171768f3dddf0e0.exe	84
PID 2344 wrote to memory of 2044	2344	c0e42cf18b138205a171768f3dddf0e0.exe	84
PID 2344 wrote to memory of 2044	2344	c0e42cf18b138205a171768f3dddf0e0.exe	84
PID 2044 wrote to memory of 228	2044	c0e42cf18b138205a171768f3dddf0e0.exe	85
PID 2044 wrote to memory of 228	2044	c0e42cf18b138205a171768f3dddf0e0.exe	85
PID 2044 wrote to memory of 228	2044	c0e42cf18b138205a171768f3dddf0e0.exe	85
PID 228 wrote to memory of 1636	228	GoogleUpdate.exe	86
PID 228 wrote to memory of 1636	228	GoogleUpdate.exe	86
PID 228 wrote to memory of 1636	228	GoogleUpdate.exe	86
PID 228 wrote to memory of 4464	228	GoogleUpdate.exe	87
PID 228 wrote to memory of 4464	228	GoogleUpdate.exe	87
PID 228 wrote to memory of 4464	228	GoogleUpdate.exe	87
PID 4464 wrote to memory of 728	4464	svchost.com	88
PID 4464 wrote to memory of 728	4464	svchost.com	88
PID 4464 wrote to memory of 728	4464	svchost.com	88
PID 228 wrote to memory of 2520	228	GoogleUpdate.exe	89
PID 228 wrote to memory of 2520	228	GoogleUpdate.exe	89
PID 228 wrote to memory of 2520	228	GoogleUpdate.exe	89
PID 2520 wrote to memory of 3736	2520	svchost.com	90
PID 2520 wrote to memory of 3736	2520	svchost.com	90
PID 2520 wrote to memory of 3736	2520	svchost.com	90
PID 4796 wrote to memory of 2296	4796	GoogleUpdate.exe	95
PID 4796 wrote to memory of 2296	4796	GoogleUpdate.exe	95
PID 4796 wrote to memory of 2296	4796	GoogleUpdate.exe	95
PID 2296 wrote to memory of 2812	2296	109.0.5414.168_chrome_installer.exe	98
PID 2296 wrote to memory of 2812	2296	109.0.5414.168_chrome_installer.exe	98
PID 2296 wrote to memory of 2812	2296	109.0.5414.168_chrome_installer.exe	98
PID 2812 wrote to memory of 4972	2812	setup.exe	99
PID 2812 wrote to memory of 4972	2812	setup.exe	99
PID 2812 wrote to memory of 4972	2812	setup.exe	99
PID 2812 wrote to memory of 3876	2812	setup.exe	101
PID 2812 wrote to memory of 3876	2812	setup.exe	101
PID 3876 wrote to memory of 4872	3876	chrome.exe	102
PID 3876 wrote to memory of 4872	3876	chrome.exe	102
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104
PID 3876 wrote to memory of 3164	3876	chrome.exe	104

C:\Users\Admin\AppData\Local\Temp\c0e42cf18b138205a171768f3dddf0e0.exe
"C:\Users\Admin\AppData\Local\Temp\c0e42cf18b138205a171768f3dddf0e0.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\3582-490\c0e42cf18b138205a171768f3dddf0e0.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\c0e42cf18b138205a171768f3dddf0e0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\GUM4D07.tmp\GoogleUpdate.exe
    C:\Users\Admin\AppData\Local\Temp\GUM4D07.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9ECA04EB-30F6-2EE5-C42E-459A39CD77E9}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=false"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe
      "C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Checks whether UAC is enabled
      Modifies Internet Explorer settings
      Modifies registry class
      PID:1636
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Google\Update\GOOGLE~1.EXE" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjEuNTciIGlzbWFjaGluZT0iMCIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0Y3N0Q4NEFCLUQzREItNDA0My05RTU1LTRBNDI5NDUwMDcwQ30iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMjEuNTciIGxhbmc9InJ1IiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUVDQTA0RUItMzBGNi0yRUU1LUM0MkUtNDU5QTM5Q0Q3N0U5fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Users\Admin\AppData\Local\Google\Update\GOOGLE~1.EXE
        
        C:\Users\Admin\AppData\Local\Google\Update\GOOGLE~1.EXE /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjEuNTciIGlzbWFjaGluZT0iMCIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0Y3N0Q4NEFCLUQzREItNDA0My05RTU1LTRBNDI5NDUwMDcwQ30iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMjEuNTciIGxhbmc9InJ1IiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUVDQTA0RUItMzBGNi0yRUU1LUM0MkUtNDU5QTM5Q0Q3N0U5fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        
        PID:728
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Google\Update\GOOGLE~1.EXE" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9ECA04EB-30F6-2EE5-C42E-459A39CD77E9}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=false" /installsource taggedmi
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Users\Admin\AppData\Local\Google\Update\GOOGLE~1.EXE
        
        C:\Users\Admin\AppData\Local\Google\Update\GOOGLE~1.EXE /handoff appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9ECA04EB-30F6-2EE5-C42E-459A39CD77E9}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=false /installsource taggedmi
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        
        PID:3736
  - - C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe
      "C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe" /unregserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Checks whether UAC is enabled
      Modifies Internet Explorer settings
      Modifies registry class
      PID:4644

C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe
"C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Google\Update\Install\{7ABAB6AF-6DFF-4309-AA07-909D7A6DE7BB}\109.0.5414.168_chrome_installer.exe
  "C:\Users\Admin\AppData\Local\Google\Update\Install\{7ABAB6AF-6DFF-4309-AA07-909D7A6DE7BB}\109.0.5414.168_chrome_installer.exe" --verbose-logging --do-not-launch-chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Google\Update\Install\{7ABAB6AF-6DFF-4309-AA07-909D7A6DE7BB}\CR_9D3BB.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Google\Update\Install\{7ABAB6AF-6DFF-4309-AA07-909D7A6DE7BB}\CR_9D3BB.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Google\Update\Install\{7ABAB6AF-6DFF-4309-AA07-909D7A6DE7BB}\CR_9D3BB.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Google\Update\Install\{7ABAB6AF-6DFF-4309-AA07-909D7A6DE7BB}\CR_9D3BB.tmp\setup.exe
      C:\Users\Admin\AppData\Local\Google\Update\Install\{7ABAB6AF-6DFF-4309-AA07-909D7A6DE7BB}\CR_9D3BB.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.168 --initial-client-data=0x32c,0x330,0x334,0x328,0x338,0xb18ba8,0xb18bb8,0xb18bc4
      4⤵
      Executes dropped EXE
      PID:4972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd39609758,0x7ffd39609768,0x7ffd39609778
        5⤵
        
        PID:4872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:2
        5⤵
        
        PID:3164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:8
        5⤵
        
        PID:3928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:8
        5⤵
        
        PID:3276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:1
        5⤵
        
        PID:1684
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:1
        5⤵
        
        PID:4328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4576 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:1
        5⤵
        
        PID:3020
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5056 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:8
        5⤵
        
        PID:3732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:8
        5⤵
        
        PID:1184
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        5⤵
        
        PID:1492
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x8c,0x244,0x7ff7af527688,0x7ff7af527698,0x7ff7af5276a8
        6⤵
        
        PID:2924
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        
        PID:4392
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x208,0x244,0x7ff7af527688,0x7ff7af527698,0x7ff7af5276a8
        7⤵
        
        PID:2876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1880,i,8436623461046798388,18086716182650033511,131072 /prefetch:8
        5⤵
        
        PID:1624

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery