ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c00000001340b-1.dat	acprotect

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 43 IoCs

pid	Process
2452	GoogleUpdate.exe
2968	GoogleUpdate.exe
2052	GoogleUpdate.exe
1796	GoogleUpdateComRegisterShell64.exe
3044	GoogleUpdateComRegisterShell64.exe
896	GoogleUpdateComRegisterShell64.exe
2860	GoogleUpdate.exe
1932	GoogleUpdate.exe
2944	GoogleUpdate.exe
2660	109.0.5414.120_chrome_installer.exe
2588	setup.exe
2388	setup.exe
1484	setup.exe
2672	setup.exe
2728	GoogleCrashHandler.exe
2892	GoogleCrashHandler64.exe
1952	GoogleUpdate.exe
2212	GoogleUpdateOnDemand.exe
3060	GoogleUpdate.exe
1652	chrome.exe
3056	chrome.exe
1788	chrome.exe
2968	chrome.exe
2908	chrome.exe
2608	chrome.exe
2632	chrome.exe
2380	chrome.exe
480	Process not Found
2384	elevation_service.exe
804	chrome.exe
2612	chrome.exe
3052	chrome.exe
2452	chrome.exe
1612	chrome.exe
1856	chrome.exe
2536	chrome.exe
2544	chrome.exe
1540	chrome.exe
360	chrome.exe
2532	chrome.exe
2536	chrome.exe
592	chrome.exe
2172	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
2968	GoogleUpdate.exe
2968	GoogleUpdate.exe
2968	GoogleUpdate.exe
1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
2452	GoogleUpdate.exe
2052	GoogleUpdate.exe
2052	GoogleUpdate.exe
2052	GoogleUpdate.exe
1796	GoogleUpdateComRegisterShell64.exe
2052	GoogleUpdate.exe
2052	GoogleUpdate.exe
2052	GoogleUpdate.exe
3044	GoogleUpdateComRegisterShell64.exe
2052	GoogleUpdate.exe
2052	GoogleUpdate.exe
2052	GoogleUpdate.exe
896	GoogleUpdateComRegisterShell64.exe
2052	GoogleUpdate.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
2860	GoogleUpdate.exe
2452	GoogleUpdate.exe
1932	GoogleUpdate.exe
1932	GoogleUpdate.exe
1932	GoogleUpdate.exe
2944	GoogleUpdate.exe
2944	GoogleUpdate.exe
2944	GoogleUpdate.exe
2944	GoogleUpdate.exe
1932	GoogleUpdate.exe
2944	GoogleUpdate.exe
2660	109.0.5414.120_chrome_installer.exe
2588	setup.exe
2588	setup.exe
1484	setup.exe
1484	setup.exe
1484	setup.exe
1192	Process not Found
1192	Process not Found
1192	Process not Found
1484	setup.exe
2588	setup.exe
2588	setup.exe
2944	GoogleUpdate.exe
2944	GoogleUpdate.exe
2944	GoogleUpdate.exe
1952	GoogleUpdate.exe
2212	GoogleUpdateOnDemand.exe
3060	GoogleUpdate.exe
3060	GoogleUpdate.exe
3060	GoogleUpdate.exe
3060	GoogleUpdate.exe
1652	chrome.exe
3056	chrome.exe
1652	chrome.exe
2968	chrome.exe
1788	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 37 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c00000001340b-1.dat	upx
behavioral1/memory/1692-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1692-298-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1692-321-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1692-348-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1692-354-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1692-369-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\he.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\nl.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\GoogleUpdateBroker.exe	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_da.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_fil.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_th.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_da.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_ar.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\SETUP.EX_	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\chrome.dll.sig	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_ca.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_hr.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\es.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\GoogleUpdate.exe	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_ar.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_mr.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_zh-CN.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_bg.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_es.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1652_1490219640\crl-set	chrome.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1652_824411410\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_el.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_en-GB.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\fil.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_id.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_sk.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\psuser_64.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\109.0.5414.119.manifest	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\ml.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\chrome_pwa_launcher.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_sl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_pt-BR.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_sk.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_uk.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_cs.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_fr.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\ja.pak	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1652_824411410\manifest.json	chrome.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_vi.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\goopdateres_zh-TW.dll	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_ru.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\chrome_200_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\elevation_service.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_te.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2588_338935803\Chrome-bin\109.0.5414.120\Locales\da.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT2AF8.tmp	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.112\goopdate.dll	GoogleUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync\CLSID\ = "{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LOCALSERVER32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Google Update Legacy On Demand"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\GoogleUpdateBroker.exe\""	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\VersionIndependentProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.112\\goopdate.dll,-1004"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\CLSID\ = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\NumMethods\ = "12"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass.1\CLSID\ = "{9B2340A0-4068-43D6-B404-32E27217859D}"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService = "gupdatem"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LOCALSERVER32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
1932	GoogleUpdate.exe
1932	GoogleUpdate.exe
1952	GoogleUpdate.exe
1952	GoogleUpdate.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
2452	GoogleUpdate.exe
1652	chrome.exe
1652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
Token: SeDebugPrivilege	2452	GoogleUpdate.exe
Token: SeDebugPrivilege	2452	GoogleUpdate.exe
Token: SeDebugPrivilege	2452	GoogleUpdate.exe
Token: 33	2660	109.0.5414.120_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	2660	109.0.5414.120_chrome_installer.exe
Token: 33	2728	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	2728	GoogleCrashHandler.exe
Token: 33	2892	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	2892	GoogleCrashHandler64.exe
Token: SeDebugPrivilege	1932	GoogleUpdate.exe
Token: SeDebugPrivilege	1952	GoogleUpdate.exe
Token: SeDebugPrivilege	2452	GoogleUpdate.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2452	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe	28
PID 1692 wrote to memory of 2452	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe	28
PID 1692 wrote to memory of 2452	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe	28
PID 1692 wrote to memory of 2452	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe	28
PID 1692 wrote to memory of 2452	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe	28
PID 1692 wrote to memory of 2452	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe	28
PID 1692 wrote to memory of 2452	1692	ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe	28
PID 2452 wrote to memory of 2968	2452	GoogleUpdate.exe	29
PID 2452 wrote to memory of 2968	2452	GoogleUpdate.exe	29
PID 2452 wrote to memory of 2968	2452	GoogleUpdate.exe	29
PID 2452 wrote to memory of 2968	2452	GoogleUpdate.exe	29
PID 2452 wrote to memory of 2968	2452	GoogleUpdate.exe	29
PID 2452 wrote to memory of 2968	2452	GoogleUpdate.exe	29
PID 2452 wrote to memory of 2968	2452	GoogleUpdate.exe	29
PID 2452 wrote to memory of 2052	2452	GoogleUpdate.exe	30
PID 2452 wrote to memory of 2052	2452	GoogleUpdate.exe	30
PID 2452 wrote to memory of 2052	2452	GoogleUpdate.exe	30
PID 2452 wrote to memory of 2052	2452	GoogleUpdate.exe	30
PID 2452 wrote to memory of 2052	2452	GoogleUpdate.exe	30
PID 2452 wrote to memory of 2052	2452	GoogleUpdate.exe	30
PID 2452 wrote to memory of 2052	2452	GoogleUpdate.exe	30
PID 2052 wrote to memory of 1796	2052	GoogleUpdate.exe	31
PID 2052 wrote to memory of 1796	2052	GoogleUpdate.exe	31
PID 2052 wrote to memory of 1796	2052	GoogleUpdate.exe	31
PID 2052 wrote to memory of 1796	2052	GoogleUpdate.exe	31
PID 2052 wrote to memory of 3044	2052	GoogleUpdate.exe	32
PID 2052 wrote to memory of 3044	2052	GoogleUpdate.exe	32
PID 2052 wrote to memory of 3044	2052	GoogleUpdate.exe	32
PID 2052 wrote to memory of 3044	2052	GoogleUpdate.exe	32
PID 2052 wrote to memory of 896	2052	GoogleUpdate.exe	33
PID 2052 wrote to memory of 896	2052	GoogleUpdate.exe	33
PID 2052 wrote to memory of 896	2052	GoogleUpdate.exe	33
PID 2052 wrote to memory of 896	2052	GoogleUpdate.exe	33
PID 2452 wrote to memory of 2860	2452	GoogleUpdate.exe	34
PID 2452 wrote to memory of 2860	2452	GoogleUpdate.exe	34
PID 2452 wrote to memory of 2860	2452	GoogleUpdate.exe	34
PID 2452 wrote to memory of 2860	2452	GoogleUpdate.exe	34
PID 2452 wrote to memory of 2860	2452	GoogleUpdate.exe	34
PID 2452 wrote to memory of 2860	2452	GoogleUpdate.exe	34
PID 2452 wrote to memory of 2860	2452	GoogleUpdate.exe	34
PID 2452 wrote to memory of 1932	2452	GoogleUpdate.exe	35
PID 2452 wrote to memory of 1932	2452	GoogleUpdate.exe	35
PID 2452 wrote to memory of 1932	2452	GoogleUpdate.exe	35
PID 2452 wrote to memory of 1932	2452	GoogleUpdate.exe	35
PID 2452 wrote to memory of 1932	2452	GoogleUpdate.exe	35
PID 2452 wrote to memory of 1932	2452	GoogleUpdate.exe	35
PID 2452 wrote to memory of 1932	2452	GoogleUpdate.exe	35
PID 2944 wrote to memory of 2660	2944	GoogleUpdate.exe	39
PID 2944 wrote to memory of 2660	2944	GoogleUpdate.exe	39
PID 2944 wrote to memory of 2660	2944	GoogleUpdate.exe	39
PID 2944 wrote to memory of 2660	2944	GoogleUpdate.exe	39
PID 2660 wrote to memory of 2588	2660	109.0.5414.120_chrome_installer.exe	40
PID 2660 wrote to memory of 2588	2660	109.0.5414.120_chrome_installer.exe	40
PID 2660 wrote to memory of 2588	2660	109.0.5414.120_chrome_installer.exe	40
PID 2588 wrote to memory of 2388	2588	setup.exe	41
PID 2588 wrote to memory of 2388	2588	setup.exe	41
PID 2588 wrote to memory of 2388	2588	setup.exe	41
PID 2588 wrote to memory of 1484	2588	setup.exe	42
PID 2588 wrote to memory of 1484	2588	setup.exe	42
PID 2588 wrote to memory of 1484	2588	setup.exe	42
PID 1484 wrote to memory of 2672	1484	setup.exe	43
PID 1484 wrote to memory of 2672	1484	setup.exe	43
PID 1484 wrote to memory of 2672	1484	setup.exe	43
PID 2944 wrote to memory of 2728	2944	GoogleUpdate.exe	47

C:\Users\Admin\AppData\Local\Temp\ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe
"C:\Users\Admin\AppData\Local\Temp\ef495cceec0371a5e411d40d4c02ce8692d8241a2e53247173f1da1421d448ce.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Temp\GUM2AF7.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={E5096338-A719-4587-9334-7209456E694C}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:2968
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:1796
  - - C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:3044
  - - C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:896
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUIyNThCNzAtRjM2My00M0E5LTk3MkUtN0NERjgzQzQ0RjEzfSIgdXNlcmlkPSJ7MjFEMDJFMDktNDA0NS00RjE2LUJENDEtNjk3QzVGRDI0RjBDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0E0NDlFMDU2LUIzOUUtNDU5NC1CRENFLTA5NTQwNTZGRDIyNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMTIiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7RTUwOTYzMzgtQTcxOS00NTg3LTkzMzQtNzIwOTQ1NkU2OTRDfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI4MjciLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2860
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={E5096338-A719-4587-9334-7209456E694C}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{9B258B70-F363-43A9-972E-7CDF83C44F13}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1932

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\109.0.5414.120_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Windows\TEMP\gui6BED.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Windows\TEMP\gui6BED.tmp"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fa91148,0x13fa91158,0x13fa91168
      4⤵
      Executes dropped EXE
      PID:2388
  - - C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{516EE6FB-540A-4D79-8FD5-1346E477722A}\CR_30C4A.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fa91148,0x13fa91158,0x13fa91168
        5⤵
        Executes dropped EXE
        
        PID:2672
- C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUIyNThCNzAtRjM2My00M0E5LTk3MkUtN0NERjgzQzQ0RjEzfSIgdXNlcmlkPSJ7MjFEMDJFMDktNDA0NS00RjE2LUJENDEtNjk3QzVGRDI0RjBDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezA5RkExNjFDLTUyQzctNDQyOS1BOTE3LUMwQ0VDQzk4NDRBNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNzQiIGlpZD0ie0U1MDk2MzM4LUE3MTktNDU4Ny05MzM0LTcyMDk0NTZFNjk0Q30iIGNvaG9ydD0iMToxZzh4OiIgY29ob3J0bmFtZT0iV2luZG93cyA3Ij48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2N6YW8yaHJ2cGs1d2dxcmt6NGtrczVyNzM0XzEwOS4wLjU0MTQuMTIwLzEwOS4wLjU0MTQuMTIwX2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSI5MzEyMjYwMCIgdG90YWw9IjkzMTIyNjAwIiBkb3dubG9hZF90aW1lX21zPSIxMDAzMSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzIzMCIgZG93bmxvYWRfdGltZV9tcz0iMTA3OTUiIGRvd25sb2FkZWQ9IjkzMTIyNjAwIiB0b3RhbD0iOTMxMjI2MDAiIGluc3RhbGxfdGltZV9tcz0iMjc1NDkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952

C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6046b58,0x7fef6046b68,0x7fef6046b78
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1088 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1604 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2184 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2188 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3104 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2420 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1388 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:2612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1460 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3492 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3716 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3828 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3864 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3868 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3900 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4032 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=712 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1008 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1032 --field-trial-handle=1272,i,300417765854967833,5630374581228736406,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2172

C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery