dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000012120-1.dat	acprotect

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 46 IoCs

pid	Process
2500	GoogleUpdate.exe
1096	GoogleUpdate.exe
1916	GoogleUpdate.exe
760	GoogleUpdateComRegisterShell64.exe
2000	GoogleUpdateComRegisterShell64.exe
1216	GoogleUpdateComRegisterShell64.exe
2112	GoogleUpdate.exe
1640	GoogleUpdate.exe
2232	GoogleUpdate.exe
1300	109.0.5414.120_chrome_installer.exe
1340	setup.exe
2680	setup.exe
2792	setup.exe
2796	setup.exe
1904	GoogleCrashHandler.exe
572	GoogleCrashHandler64.exe
840	GoogleUpdate.exe
2280	GoogleUpdateOnDemand.exe
1780	GoogleUpdate.exe
3000	chrome.exe
2988	chrome.exe
948	chrome.exe
2148	chrome.exe
2208	chrome.exe
2600	chrome.exe
1976	chrome.exe
476	Process not Found
2760	elevation_service.exe
2476	chrome.exe
2400	chrome.exe
2336	chrome.exe
1780	chrome.exe
1676	chrome.exe
2512	chrome.exe
2668	chrome.exe
2504	chrome.exe
2760	chrome.exe
1896	chrome.exe
1616	chrome.exe
2852	chrome.exe
2484	chrome.exe
2276	chrome.exe
2816	chrome.exe
2324	chrome.exe
780	chrome.exe
1108	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
1096	GoogleUpdate.exe
1096	GoogleUpdate.exe
1096	GoogleUpdate.exe
2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
2500	GoogleUpdate.exe
1916	GoogleUpdate.exe
1916	GoogleUpdate.exe
1916	GoogleUpdate.exe
760	GoogleUpdateComRegisterShell64.exe
1916	GoogleUpdate.exe
1916	GoogleUpdate.exe
2000	GoogleUpdateComRegisterShell64.exe
1916	GoogleUpdate.exe
1916	GoogleUpdate.exe
1216	GoogleUpdateComRegisterShell64.exe
1916	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
2112	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
1640	GoogleUpdate.exe
1640	GoogleUpdate.exe
1640	GoogleUpdate.exe
2232	GoogleUpdate.exe
2232	GoogleUpdate.exe
2232	GoogleUpdate.exe
2232	GoogleUpdate.exe
1640	GoogleUpdate.exe
2232	GoogleUpdate.exe
1300	109.0.5414.120_chrome_installer.exe
1340	setup.exe
1340	setup.exe
2792	setup.exe
1340	setup.exe
1340	setup.exe
1144	Process not Found
1144	Process not Found
1144	Process not Found
1144	Process not Found
2232	GoogleUpdate.exe
2232	GoogleUpdate.exe
2232	GoogleUpdate.exe
2232	GoogleUpdate.exe
2232	GoogleUpdate.exe
840	GoogleUpdate.exe
2280	GoogleUpdateOnDemand.exe
1780	GoogleUpdate.exe
1780	GoogleUpdate.exe
1780	GoogleUpdate.exe
1780	GoogleUpdate.exe
3000	chrome.exe
2988	chrome.exe
3000	chrome.exe
948	chrome.exe
948	chrome.exe
2148	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 37 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\notification_helper.exe"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.212\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012120-1.dat	upx
behavioral1/memory/2932-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2932-316-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2932-323-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2932-365-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2932-371-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2932-388-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_ca.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_mr.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\psuser.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_sr.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\fi.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_ta.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\ms.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_ja.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_ko.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_sw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_ml.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\am.pak	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3000_1873382170\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\pl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\ru.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_ro.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\ur.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_et.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_sv.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\109.0.5414.119.manifest	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_id.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\de.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\109.0.5414.120_chrome_installer.exe	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\SETUP.EX_	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\lv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\nacl_irt_x86_64.nexe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\mojo_core.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_es-419.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_gu.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_ml.dll	GoogleUpdate.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3000_980818004\Filtering Rules	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_pt-BR.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_kn.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\sv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\resources.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\elevation_service.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_th.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_tr.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_el.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\109.0.5414.120\109.0.5414.120_chrome_installer.exe	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdate.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\chrome_pwa_launcher.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_fi.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_hu.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateOnDemand.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\goopdateres_es.dll	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\chrome.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_bg.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.212\goopdateres_pt-BR.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1340_667917627\Chrome-bin\109.0.5414.120\Locales\nl.pak	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine.1.0\CLSID\ = "{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LocalServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\ = "Google Update Legacy On Demand"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69333388-6AC7-41F5-97C0-33D3BE59661C}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\ProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "GoogleUpdate.OnDemandCOMClassMachineFallback.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\ProgID\ = "GoogleUpdate.OnDemandCOMClassMachineFallback.1.0"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\ = "GoogleUpdate.Update3COMClassService.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ELEVATION	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine\CLSID\ = "{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\ = "{5CFC7AAA-B618-4CE5-B425-82AF695B1BA3}"	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
1640	GoogleUpdate.exe
1640	GoogleUpdate.exe
840	GoogleUpdate.exe
840	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
2500	GoogleUpdate.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
Token: SeDebugPrivilege	2500	GoogleUpdate.exe
Token: SeDebugPrivilege	2500	GoogleUpdate.exe
Token: SeDebugPrivilege	2500	GoogleUpdate.exe
Token: 33	1300	109.0.5414.120_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	1300	109.0.5414.120_chrome_installer.exe
Token: 33	572	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	572	GoogleCrashHandler64.exe
Token: 33	1904	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	1904	GoogleCrashHandler.exe
Token: SeDebugPrivilege	1640	GoogleUpdate.exe
Token: SeDebugPrivilege	840	GoogleUpdate.exe
Token: SeDebugPrivilege	2500	GoogleUpdate.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2500	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe	28
PID 2932 wrote to memory of 2500	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe	28
PID 2932 wrote to memory of 2500	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe	28
PID 2932 wrote to memory of 2500	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe	28
PID 2932 wrote to memory of 2500	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe	28
PID 2932 wrote to memory of 2500	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe	28
PID 2932 wrote to memory of 2500	2932	dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe	28
PID 2500 wrote to memory of 1096	2500	GoogleUpdate.exe	29
PID 2500 wrote to memory of 1096	2500	GoogleUpdate.exe	29
PID 2500 wrote to memory of 1096	2500	GoogleUpdate.exe	29
PID 2500 wrote to memory of 1096	2500	GoogleUpdate.exe	29
PID 2500 wrote to memory of 1096	2500	GoogleUpdate.exe	29
PID 2500 wrote to memory of 1096	2500	GoogleUpdate.exe	29
PID 2500 wrote to memory of 1096	2500	GoogleUpdate.exe	29
PID 2500 wrote to memory of 1916	2500	GoogleUpdate.exe	30
PID 2500 wrote to memory of 1916	2500	GoogleUpdate.exe	30
PID 2500 wrote to memory of 1916	2500	GoogleUpdate.exe	30
PID 2500 wrote to memory of 1916	2500	GoogleUpdate.exe	30
PID 2500 wrote to memory of 1916	2500	GoogleUpdate.exe	30
PID 2500 wrote to memory of 1916	2500	GoogleUpdate.exe	30
PID 2500 wrote to memory of 1916	2500	GoogleUpdate.exe	30
PID 1916 wrote to memory of 760	1916	GoogleUpdate.exe	31
PID 1916 wrote to memory of 760	1916	GoogleUpdate.exe	31
PID 1916 wrote to memory of 760	1916	GoogleUpdate.exe	31
PID 1916 wrote to memory of 760	1916	GoogleUpdate.exe	31
PID 1916 wrote to memory of 2000	1916	GoogleUpdate.exe	32
PID 1916 wrote to memory of 2000	1916	GoogleUpdate.exe	32
PID 1916 wrote to memory of 2000	1916	GoogleUpdate.exe	32
PID 1916 wrote to memory of 2000	1916	GoogleUpdate.exe	32
PID 1916 wrote to memory of 1216	1916	GoogleUpdate.exe	33
PID 1916 wrote to memory of 1216	1916	GoogleUpdate.exe	33
PID 1916 wrote to memory of 1216	1916	GoogleUpdate.exe	33
PID 1916 wrote to memory of 1216	1916	GoogleUpdate.exe	33
PID 2500 wrote to memory of 2112	2500	GoogleUpdate.exe	34
PID 2500 wrote to memory of 2112	2500	GoogleUpdate.exe	34
PID 2500 wrote to memory of 2112	2500	GoogleUpdate.exe	34
PID 2500 wrote to memory of 2112	2500	GoogleUpdate.exe	34
PID 2500 wrote to memory of 2112	2500	GoogleUpdate.exe	34
PID 2500 wrote to memory of 2112	2500	GoogleUpdate.exe	34
PID 2500 wrote to memory of 2112	2500	GoogleUpdate.exe	34
PID 2500 wrote to memory of 1640	2500	GoogleUpdate.exe	35
PID 2500 wrote to memory of 1640	2500	GoogleUpdate.exe	35
PID 2500 wrote to memory of 1640	2500	GoogleUpdate.exe	35
PID 2500 wrote to memory of 1640	2500	GoogleUpdate.exe	35
PID 2500 wrote to memory of 1640	2500	GoogleUpdate.exe	35
PID 2500 wrote to memory of 1640	2500	GoogleUpdate.exe	35
PID 2500 wrote to memory of 1640	2500	GoogleUpdate.exe	35
PID 2232 wrote to memory of 1300	2232	GoogleUpdate.exe	39
PID 2232 wrote to memory of 1300	2232	GoogleUpdate.exe	39
PID 2232 wrote to memory of 1300	2232	GoogleUpdate.exe	39
PID 2232 wrote to memory of 1300	2232	GoogleUpdate.exe	39
PID 1300 wrote to memory of 1340	1300	109.0.5414.120_chrome_installer.exe	40
PID 1300 wrote to memory of 1340	1300	109.0.5414.120_chrome_installer.exe	40
PID 1300 wrote to memory of 1340	1300	109.0.5414.120_chrome_installer.exe	40
PID 1340 wrote to memory of 2680	1340	setup.exe	41
PID 1340 wrote to memory of 2680	1340	setup.exe	41
PID 1340 wrote to memory of 2680	1340	setup.exe	41
PID 1340 wrote to memory of 2792	1340	setup.exe	42
PID 1340 wrote to memory of 2792	1340	setup.exe	42
PID 1340 wrote to memory of 2792	1340	setup.exe	42
PID 2792 wrote to memory of 2796	2792	setup.exe	43
PID 2792 wrote to memory of 2796	2792	setup.exe	43
PID 2792 wrote to memory of 2796	2792	setup.exe	43
PID 2232 wrote to memory of 1904	2232	GoogleUpdate.exe	47

C:\Users\Admin\AppData\Local\Temp\dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe
"C:\Users\Admin\AppData\Local\Temp\dbbaa06b0b695a5dfcdab2ae6d475857dfba246af3338852ff819fd6c99e537a.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Temp\GUM19E7.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={14B1A275-180B-12E9-AAFA-603E0D723FA2}&lang=ko&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=IBEF&installdataindex=empty"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1096
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:760
  - - C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:2000
  - - C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:1216
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4yMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4yMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzExNTQwN0ItNjEzQy00MTkwLThGMjEtNEM5QjUyQzM1M0JDfSIgdXNlcmlkPSJ7RTg2QTY0MDAtNjFEQi00MjcxLThGMUYtMDBFMDVCNjk1OTcwfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0UzRjc1NDk5LUUyQzUtNDFCRS04MzU2LTI3MDY3NTdGNzhFN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4yMTIiIGxhbmc9ImtvIiBicmFuZD0iSUJFRiIgY2xpZW50PSIiIGlpZD0iezE0QjFBMjc1LTE4MEItMTJFOS1BQUZBLTYwM0UwRDcyM0ZBMn0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNzk1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2112
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={14B1A275-180B-12E9-AAFA-603E0D723FA2}&lang=ko&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=IBEF&installdataindex=empty" /installsource taggedmi /sessionid "{7115407B-613C-4190-8F21-4C9B52C353BC}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\109.0.5414.120_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\gui6FE3.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\gui6FE3.tmp"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f871148,0x13f871158,0x13f871168
      4⤵
      Executes dropped EXE
      PID:2680
  - - C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{72220D4E-BE54-4005-8F83-B08213EB06C0}\CR_6573A.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f871148,0x13f871158,0x13f871168
        5⤵
        Executes dropped EXE
        
        PID:2796
- C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4yMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4yMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzExNTQwN0ItNjEzQy00MTkwLThGMjEtNEM5QjUyQzM1M0JDfSIgdXNlcmlkPSJ7RTg2QTY0MDAtNjFEQi00MjcxLThGMUYtMDBFMDVCNjk1OTcwfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezI5NDkwRUFBLTU1N0ItNDUwMi04NDIzLUUwRDQzNzQzQjFDRX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9ImtvIiBicmFuZD0iSUJFRiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE3IiBpaWQ9InsxNEIxQTI3NS0xODBCLTEyRTktQUFGQS02MDNFMEQ3MjNGQTJ9IiBjb2hvcnQ9IjE6MWc4eDoiIGNvaG9ydG5hbWU9IldpbmRvd3MgNyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9jemFvMmhydnBrNXdncXJrejRra3M1cjczNF8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iOTMxMjI2MDAiIHRvdGFsPSI5MzEyMjYwMCIgZG93bmxvYWRfdGltZV9tcz0iMTUzOTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjI5ODAiIGRvd25sb2FkX3RpbWVfbXM9IjE2MTkzIiBkb3dubG9hZGVkPSI5MzEyMjYwMCIgdG90YWw9IjkzMTIyNjAwIiBpbnN0YWxsX3RpbWVfbXM9IjI3MDIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840

C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.212\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5df6b58,0x7fef5df6b68,0x7fef5df6b78
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=988 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1276 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2156 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2248 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3048 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2764 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:2336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1312 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3712 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3680 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3900 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3896 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4124 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2788 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1176 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1852 --field-trial-handle=1288,i,9203791350617799690,17705036297040046755,131072 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1108

C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery