fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000012255-1.dat	acprotect

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 41 IoCs

pid	Process
2456	GoogleUpdate.exe
2980	GoogleUpdate.exe
1680	GoogleUpdate.exe
1540	GoogleUpdateComRegisterShell64.exe
376	GoogleUpdateComRegisterShell64.exe
1892	GoogleUpdateComRegisterShell64.exe
1640	GoogleUpdate.exe
1224	GoogleUpdate.exe
1860	GoogleUpdate.exe
2392	109.0.5414.120_chrome_installer.exe
2468	setup.exe
2944	setup.exe
2632	setup.exe
1548	setup.exe
528	GoogleCrashHandler64.exe
324	GoogleCrashHandler.exe
2004	GoogleUpdate.exe
1612	GoogleUpdateOnDemand.exe
2836	GoogleUpdate.exe
1948	chrome.exe
920	chrome.exe
804	chrome.exe
3060	chrome.exe
1892	chrome.exe
2716	chrome.exe
3000	chrome.exe
484	Process not Found
988	elevation_service.exe
2400	chrome.exe
1304	chrome.exe
2888	chrome.exe
1096	chrome.exe
276	chrome.exe
2516	chrome.exe
1816	chrome.exe
1912	chrome.exe
2784	chrome.exe
1276	chrome.exe
2556	chrome.exe
1872	chrome.exe
1476	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
2980	GoogleUpdate.exe
2980	GoogleUpdate.exe
2980	GoogleUpdate.exe
2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
2456	GoogleUpdate.exe
1680	GoogleUpdate.exe
1680	GoogleUpdate.exe
1680	GoogleUpdate.exe
1540	GoogleUpdateComRegisterShell64.exe
1680	GoogleUpdate.exe
1680	GoogleUpdate.exe
1680	GoogleUpdate.exe
376	GoogleUpdateComRegisterShell64.exe
1680	GoogleUpdate.exe
1680	GoogleUpdate.exe
1680	GoogleUpdate.exe
1892	GoogleUpdateComRegisterShell64.exe
1680	GoogleUpdate.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
1640	GoogleUpdate.exe
2456	GoogleUpdate.exe
1224	GoogleUpdate.exe
1224	GoogleUpdate.exe
1224	GoogleUpdate.exe
1860	GoogleUpdate.exe
1860	GoogleUpdate.exe
1860	GoogleUpdate.exe
1860	GoogleUpdate.exe
1224	GoogleUpdate.exe
1860	GoogleUpdate.exe
2392	109.0.5414.120_chrome_installer.exe
2468	setup.exe
2468	setup.exe
2632	setup.exe
2468	setup.exe
2468	setup.exe
1116	Process not Found
1116	Process not Found
1116	Process not Found
1116	Process not Found
1860	GoogleUpdate.exe
1860	GoogleUpdate.exe
1860	GoogleUpdate.exe
1860	GoogleUpdate.exe
1860	GoogleUpdate.exe
2004	GoogleUpdate.exe
1612	GoogleUpdateOnDemand.exe
2836	GoogleUpdate.exe
2836	GoogleUpdate.exe
2836	GoogleUpdate.exe
2836	GoogleUpdate.exe
1948	chrome.exe
920	chrome.exe
1948	chrome.exe
804	chrome.exe
804	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 37 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000012255-1.dat	upx
behavioral1/memory/2476-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2476-301-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2476-306-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2476-309-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2476-353-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2476-359-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2476-377-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_lv.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\am.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\GoogleCrashHandler64.exe	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_fil.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\lv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_ur.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_da.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ro.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\psmachine_64.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\default_apps\external_extensions.json	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_et.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_en-GB.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\chrome.7z	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\de.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_es.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\109.0.5414.120_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\fi.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_ja.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ms.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdate.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_el.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_sr.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_nl.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\ms.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\VisualElements\Logo.png	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\psuser.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\bn.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\psmachine.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_fi.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_ca.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_hi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\ko.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\GoogleCrashHandler.exe	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_ar.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_en.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\chrome_100_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_el.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_vi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\sl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_cs.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1593.tmp\goopdateres_ta.dll	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1948_1783969100\Filtering Rules	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\libGLESv2.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2468_222834080\Chrome-bin\109.0.5414.120\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_sv.dll	GoogleUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback\CurVer\ = "GoogleUpdate.Update3WebMachineFallback.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine.1.0\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\LocalServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\CLSID\ = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{B3D28DBD-0DFA-40E4-8071-520767BADC7E}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\ = "GoogleUpdate.Update3COMClassService.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\NumMethods\ = "12"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc\CLSID\ = "{1C4CDEFF-756A-4804-9E77-3E8EB9361016}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A50E9E56-BA18-4FCD-8DDF-B91F12D0B6B9}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods\ = "11"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LOCALSERVER32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback\CurVer\ = "GoogleUpdate.PolicyStatusMachineFallback.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
1224	GoogleUpdate.exe
1224	GoogleUpdate.exe
2004	GoogleUpdate.exe
2004	GoogleUpdate.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
2456	GoogleUpdate.exe
1948	chrome.exe
1948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
Token: SeDebugPrivilege	2456	GoogleUpdate.exe
Token: SeDebugPrivilege	2456	GoogleUpdate.exe
Token: SeDebugPrivilege	2456	GoogleUpdate.exe
Token: 33	2392	109.0.5414.120_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	2392	109.0.5414.120_chrome_installer.exe
Token: 33	528	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	528	GoogleCrashHandler64.exe
Token: 33	324	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	324	GoogleCrashHandler.exe
Token: SeDebugPrivilege	1224	GoogleUpdate.exe
Token: SeDebugPrivilege	2004	GoogleUpdate.exe
Token: SeDebugPrivilege	2456	GoogleUpdate.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2456	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe	28
PID 2476 wrote to memory of 2456	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe	28
PID 2476 wrote to memory of 2456	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe	28
PID 2476 wrote to memory of 2456	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe	28
PID 2476 wrote to memory of 2456	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe	28
PID 2476 wrote to memory of 2456	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe	28
PID 2476 wrote to memory of 2456	2476	fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe	28
PID 2456 wrote to memory of 2980	2456	GoogleUpdate.exe	29
PID 2456 wrote to memory of 2980	2456	GoogleUpdate.exe	29
PID 2456 wrote to memory of 2980	2456	GoogleUpdate.exe	29
PID 2456 wrote to memory of 2980	2456	GoogleUpdate.exe	29
PID 2456 wrote to memory of 2980	2456	GoogleUpdate.exe	29
PID 2456 wrote to memory of 2980	2456	GoogleUpdate.exe	29
PID 2456 wrote to memory of 2980	2456	GoogleUpdate.exe	29
PID 2456 wrote to memory of 1680	2456	GoogleUpdate.exe	30
PID 2456 wrote to memory of 1680	2456	GoogleUpdate.exe	30
PID 2456 wrote to memory of 1680	2456	GoogleUpdate.exe	30
PID 2456 wrote to memory of 1680	2456	GoogleUpdate.exe	30
PID 2456 wrote to memory of 1680	2456	GoogleUpdate.exe	30
PID 2456 wrote to memory of 1680	2456	GoogleUpdate.exe	30
PID 2456 wrote to memory of 1680	2456	GoogleUpdate.exe	30
PID 1680 wrote to memory of 1540	1680	GoogleUpdate.exe	31
PID 1680 wrote to memory of 1540	1680	GoogleUpdate.exe	31
PID 1680 wrote to memory of 1540	1680	GoogleUpdate.exe	31
PID 1680 wrote to memory of 1540	1680	GoogleUpdate.exe	31
PID 1680 wrote to memory of 376	1680	GoogleUpdate.exe	32
PID 1680 wrote to memory of 376	1680	GoogleUpdate.exe	32
PID 1680 wrote to memory of 376	1680	GoogleUpdate.exe	32
PID 1680 wrote to memory of 376	1680	GoogleUpdate.exe	32
PID 1680 wrote to memory of 1892	1680	GoogleUpdate.exe	33
PID 1680 wrote to memory of 1892	1680	GoogleUpdate.exe	33
PID 1680 wrote to memory of 1892	1680	GoogleUpdate.exe	33
PID 1680 wrote to memory of 1892	1680	GoogleUpdate.exe	33
PID 2456 wrote to memory of 1640	2456	GoogleUpdate.exe	34
PID 2456 wrote to memory of 1640	2456	GoogleUpdate.exe	34
PID 2456 wrote to memory of 1640	2456	GoogleUpdate.exe	34
PID 2456 wrote to memory of 1640	2456	GoogleUpdate.exe	34
PID 2456 wrote to memory of 1640	2456	GoogleUpdate.exe	34
PID 2456 wrote to memory of 1640	2456	GoogleUpdate.exe	34
PID 2456 wrote to memory of 1640	2456	GoogleUpdate.exe	34
PID 2456 wrote to memory of 1224	2456	GoogleUpdate.exe	35
PID 2456 wrote to memory of 1224	2456	GoogleUpdate.exe	35
PID 2456 wrote to memory of 1224	2456	GoogleUpdate.exe	35
PID 2456 wrote to memory of 1224	2456	GoogleUpdate.exe	35
PID 2456 wrote to memory of 1224	2456	GoogleUpdate.exe	35
PID 2456 wrote to memory of 1224	2456	GoogleUpdate.exe	35
PID 2456 wrote to memory of 1224	2456	GoogleUpdate.exe	35
PID 1860 wrote to memory of 2392	1860	GoogleUpdate.exe	39
PID 1860 wrote to memory of 2392	1860	GoogleUpdate.exe	39
PID 1860 wrote to memory of 2392	1860	GoogleUpdate.exe	39
PID 1860 wrote to memory of 2392	1860	GoogleUpdate.exe	39
PID 2392 wrote to memory of 2468	2392	109.0.5414.120_chrome_installer.exe	40
PID 2392 wrote to memory of 2468	2392	109.0.5414.120_chrome_installer.exe	40
PID 2392 wrote to memory of 2468	2392	109.0.5414.120_chrome_installer.exe	40
PID 2468 wrote to memory of 2944	2468	setup.exe	41
PID 2468 wrote to memory of 2944	2468	setup.exe	41
PID 2468 wrote to memory of 2944	2468	setup.exe	41
PID 2468 wrote to memory of 2632	2468	setup.exe	42
PID 2468 wrote to memory of 2632	2468	setup.exe	42
PID 2468 wrote to memory of 2632	2468	setup.exe	42
PID 2632 wrote to memory of 1548	2632	setup.exe	43
PID 2632 wrote to memory of 1548	2632	setup.exe	43
PID 2632 wrote to memory of 1548	2632	setup.exe	43
PID 1860 wrote to memory of 324	1860	GoogleUpdate.exe	47

C:\Users\Admin\AppData\Local\Temp\fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe
"C:\Users\Admin\AppData\Local\Temp\fe3ebb119e7bd9e91658002fbfd24536e396b820bda0b32a38201c5a479185b6.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Google\Temp\GUM1593.tmp\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Temp\GUM1593.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={447CFD79-60DA-9EF5-B3E5-137254EEC2F9}&lang=ko&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:2980
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:1540
  - - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:376
  - - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:1892
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTg2RjRCRjgtOEU2MC00OERGLTk5NTAtMEFDMTQyRkVERjFBfSIgdXNlcmlkPSJ7OTgxRDA4RDctNDgwRS00NkUxLTk2MjQtNUM4RkMwRDM4ODgzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezk0NDdGNTU5LTA5OTUtNDVBQy1CNjJCLUE4QUE1ODUxM0M1OX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMzIiIGxhbmc9ImtvIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7NDQ3Q0ZENzktNjBEQS05RUY1LUIzRTUtMTM3MjU0RUVDMkY5fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI2NzEiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1640
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={447CFD79-60DA-9EF5-B3E5-137254EEC2F9}&lang=ko&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{A86F4BF8-8E60-48DF-9950-0AC142FEDF1A}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1224

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\109.0.5414.120_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\gui71A7.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\gui71A7.tmp"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140261148,0x140261158,0x140261168
      4⤵
      Executes dropped EXE
      PID:2944
  - - C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{77273238-1737-4B57-910D-A8973009DAD3}\CR_F0FFC.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140261148,0x140261158,0x140261168
        5⤵
        Executes dropped EXE
        
        PID:1548
- C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:528
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTg2RjRCRjgtOEU2MC00OERGLTk5NTAtMEFDMTQyRkVERjFBfSIgdXNlcmlkPSJ7OTgxRDA4RDctNDgwRS00NkUxLTk2MjQtNUM4RkMwRDM4ODgzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezcxNEJEM0Q4LUYxRTYtNDNBQy1BMjVBLUY5NENFQTBBQUFBQ30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9ImtvIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMzUiIGlpZD0iezQ0N0NGRDc5LTYwREEtOUVGNS1CM0U1LTEzNzI1NEVFQzJGOX0iIGNvaG9ydD0iMToxZzh4OiIgY29ob3J0bmFtZT0iV2luZG93cyA3Ij48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2N6YW8yaHJ2cGs1d2dxcmt6NGtrczVyNzM0XzEwOS4wLjU0MTQuMTIwLzEwOS4wLjU0MTQuMTIwX2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSI5MzEyMjYwMCIgdG90YWw9IjkzMTIyNjAwIiBkb3dubG9hZF90aW1lX21zPSIxNzAwNCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzE2NyIgZG93bmxvYWRfdGltZV9tcz0iMTc2OTAiIGRvd25sb2FkZWQ9IjkzMTIyNjAwIiB0b3RhbD0iOTMxMjI2MDAiIGluc3RhbGxfdGltZV9tcz0iMjY5NzMiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004

C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6826b58,0x7fef6826b68,0x7fef6826b78
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:3060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1520 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2120 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2128 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3076 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3320 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1328 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:2888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3384 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3764 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3840 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3960 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3972 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4028 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3240 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1096 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1864 --field-trial-handle=1176,i,18358510777571975967,11542134994726817354,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1476

C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery