Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 14:25
Static task
static1
Behavioral task
behavioral1
Sample
GoogleChorme.msi
Resource
win7-20240704-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
GoogleChorme.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
GoogleChorme.msi
-
Size
31.3MB
-
MD5
46c0158715bf937ebbbd3f0f4160df53
-
SHA1
4025bb5c7dab4c20f43e27ef59fb7b0d59f20b5e
-
SHA256
03f9c6613c68094f94d2099b0f5b61afb7e308d70a19b3bc26a2c4d9a65a33f0
-
SHA512
13a7e0d01d3a79fdd309a447ad130fe3597737dc001ed816f6541f60079b4ee6f36b4d7842fa8672eca94b693925baab6ddb8f84839ad5bf7f0eea3e72f18357
-
SSDEEP
786432:NOGXRTW9sglw5UbThI9/tCSRwWpe4jbdQ6nF7z:NRaRw5UbdMFKcjbdQCd
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdata_Service = "C:\\programdata\\Mylnk\\dick.lnk" reg.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 42 4424 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: tracerpt.exe File opened (read-only) \??\R: tracerpt.exe File opened (read-only) \??\W: tracerpt.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: tracerpt.exe File opened (read-only) \??\M: tracerpt.exe File opened (read-only) \??\U: tracerpt.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: tracerpt.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: tracerpt.exe File opened (read-only) \??\S: tracerpt.exe File opened (read-only) \??\V: tracerpt.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: tracerpt.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: tracerpt.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: tracerpt.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: tracerpt.exe File opened (read-only) \??\O: tracerpt.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: tracerpt.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: tracerpt.exe File opened (read-only) \??\Y: tracerpt.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: tracerpt.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: tracerpt.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1940 set thread context of 2748 1940 Agghosts.exe 109 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Chrome Setup\Chrome Setup\MFCLibrary1.dll msiexec.exe File created C:\Program Files (x86)\Chrome Setup\Chrome Setup\新建文件夹 - 副本.zip msiexec.exe File created C:\Program Files (x86)\Chrome Setup\Chrome Setup\新建文件夹.zip msiexec.exe File created C:\Program Files (x86)\Chrome Setup\Chrome Setup\Ensup.log msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIE58F.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57e37a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE3D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE475.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{9CF28957-E6AA-481D-A58E-156D868F5DF6} msiexec.exe File created C:\Windows\Installer\e57e37c.msi msiexec.exe File created C:\Windows\Installer\e57e37a.msi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1940 Agghosts.exe -
Loads dropped DLL 10 IoCs
pid Process 1952 MsiExec.exe 1952 MsiExec.exe 1952 MsiExec.exe 1952 MsiExec.exe 1952 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 1940 Agghosts.exe 1940 Agghosts.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2864 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agghosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tracerpt.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a54fc9f1d525247c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a54fc9f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a54fc9f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da54fc9f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a54fc9f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\35364E2F472F3BB4EB2B21965E12F7B5\75982FC9AA6ED1845AE851D668F8D56F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\ProductName = "Chrome Setup" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\PackageCode = "A4796DC423A423C4DB93C6B5B56D5CE5" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\75982FC9AA6ED1845AE851D668F8D56F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\75982FC9AA6ED1845AE851D668F8D56F\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList\PackageName = "GoogleChorme.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\HELPDIR MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0 MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\Language = "4100" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\Version = "16777216" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75982FC9AA6ED1845AE851D668F8D56F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\35364E2F472F3BB4EB2B21965E12F7B5 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3136 msiexec.exe 3136 msiexec.exe 4424 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 4424 MsiExec.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe 2748 tracerpt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2864 msiexec.exe Token: SeIncreaseQuotaPrivilege 2864 msiexec.exe Token: SeSecurityPrivilege 3136 msiexec.exe Token: SeCreateTokenPrivilege 2864 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2864 msiexec.exe Token: SeLockMemoryPrivilege 2864 msiexec.exe Token: SeIncreaseQuotaPrivilege 2864 msiexec.exe Token: SeMachineAccountPrivilege 2864 msiexec.exe Token: SeTcbPrivilege 2864 msiexec.exe Token: SeSecurityPrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeLoadDriverPrivilege 2864 msiexec.exe Token: SeSystemProfilePrivilege 2864 msiexec.exe Token: SeSystemtimePrivilege 2864 msiexec.exe Token: SeProfSingleProcessPrivilege 2864 msiexec.exe Token: SeIncBasePriorityPrivilege 2864 msiexec.exe Token: SeCreatePagefilePrivilege 2864 msiexec.exe Token: SeCreatePermanentPrivilege 2864 msiexec.exe Token: SeBackupPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeShutdownPrivilege 2864 msiexec.exe Token: SeDebugPrivilege 2864 msiexec.exe Token: SeAuditPrivilege 2864 msiexec.exe Token: SeSystemEnvironmentPrivilege 2864 msiexec.exe Token: SeChangeNotifyPrivilege 2864 msiexec.exe Token: SeRemoteShutdownPrivilege 2864 msiexec.exe Token: SeUndockPrivilege 2864 msiexec.exe Token: SeSyncAgentPrivilege 2864 msiexec.exe Token: SeEnableDelegationPrivilege 2864 msiexec.exe Token: SeManageVolumePrivilege 2864 msiexec.exe Token: SeImpersonatePrivilege 2864 msiexec.exe Token: SeCreateGlobalPrivilege 2864 msiexec.exe Token: SeCreateTokenPrivilege 2864 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2864 msiexec.exe Token: SeLockMemoryPrivilege 2864 msiexec.exe Token: SeIncreaseQuotaPrivilege 2864 msiexec.exe Token: SeMachineAccountPrivilege 2864 msiexec.exe Token: SeTcbPrivilege 2864 msiexec.exe Token: SeSecurityPrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeLoadDriverPrivilege 2864 msiexec.exe Token: SeSystemProfilePrivilege 2864 msiexec.exe Token: SeSystemtimePrivilege 2864 msiexec.exe Token: SeProfSingleProcessPrivilege 2864 msiexec.exe Token: SeIncBasePriorityPrivilege 2864 msiexec.exe Token: SeCreatePagefilePrivilege 2864 msiexec.exe Token: SeCreatePermanentPrivilege 2864 msiexec.exe Token: SeBackupPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeShutdownPrivilege 2864 msiexec.exe Token: SeDebugPrivilege 2864 msiexec.exe Token: SeAuditPrivilege 2864 msiexec.exe Token: SeSystemEnvironmentPrivilege 2864 msiexec.exe Token: SeChangeNotifyPrivilege 2864 msiexec.exe Token: SeRemoteShutdownPrivilege 2864 msiexec.exe Token: SeUndockPrivilege 2864 msiexec.exe Token: SeSyncAgentPrivilege 2864 msiexec.exe Token: SeEnableDelegationPrivilege 2864 msiexec.exe Token: SeManageVolumePrivilege 2864 msiexec.exe Token: SeImpersonatePrivilege 2864 msiexec.exe Token: SeCreateGlobalPrivilege 2864 msiexec.exe Token: SeCreateTokenPrivilege 2864 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2864 msiexec.exe Token: SeLockMemoryPrivilege 2864 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2864 msiexec.exe 2864 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4424 MsiExec.exe 2748 tracerpt.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3136 wrote to memory of 1952 3136 msiexec.exe 86 PID 3136 wrote to memory of 1952 3136 msiexec.exe 86 PID 3136 wrote to memory of 1952 3136 msiexec.exe 86 PID 3136 wrote to memory of 4500 3136 msiexec.exe 101 PID 3136 wrote to memory of 4500 3136 msiexec.exe 101 PID 3136 wrote to memory of 4424 3136 msiexec.exe 103 PID 3136 wrote to memory of 4424 3136 msiexec.exe 103 PID 3136 wrote to memory of 4424 3136 msiexec.exe 103 PID 4424 wrote to memory of 864 4424 MsiExec.exe 107 PID 4424 wrote to memory of 864 4424 MsiExec.exe 107 PID 4424 wrote to memory of 864 4424 MsiExec.exe 107 PID 1940 wrote to memory of 2748 1940 Agghosts.exe 109 PID 1940 wrote to memory of 2748 1940 Agghosts.exe 109 PID 1940 wrote to memory of 2748 1940 Agghosts.exe 109 PID 1940 wrote to memory of 2748 1940 Agghosts.exe 109 PID 2748 wrote to memory of 3648 2748 tracerpt.exe 111 PID 2748 wrote to memory of 3648 2748 tracerpt.exe 111 PID 2748 wrote to memory of 3648 2748 tracerpt.exe 111 PID 2748 wrote to memory of 3648 2748 tracerpt.exe 111 PID 2748 wrote to memory of 3648 2748 tracerpt.exe 111 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\GoogleChorme.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2864
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 234A4F01CAE122EA658449DFC82DB775 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1952
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4500
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 48009BAF5389AB2D1A453AC02F007C842⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v GoogleUpdata_Service /d "C:\programdata\Mylnk\dick.lnk" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:864
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3476
-
C:\gxwoyi\Agghosts.exe"C:\gxwoyi\Agghosts.exe" 671⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\tracerpt.exe"C:\Windows\SysWOW64\tracerpt.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵PID:3648
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD53ff3a8e2eae2d5fd33220a6a04bd5dba
SHA1ac640fad7a8d1f04a1bf6f3fa85800c0a900b562
SHA2561d902b8e8b91c2d80de943926d6af58815d1ead0f79ae0da1aa473ac9d6b840d
SHA512ebe3ec4138c4a373c58a8a5c4073ae20c3925ef23c5e6c2ab65350e49f679e6827a6e922596a51c9ff250866734e22cbdbfedb84699a87d1a24ff685f2055cd2
-
Filesize
5.2MB
MD51d7cc3187499f8dadc7905cc0d136db6
SHA1f929e95efd9a5deb9ab1c2774ef53697db78fc0f
SHA2566db9f0016f4908dfe4ee908b8e6e46ccac74bb725b43191ee85b4a3d2c41daed
SHA512745771ee686e79dd9452d790a0d279df85e345b3bacc6d362e30f26ee6f7496e63de05b9dfdf8280865e869b5462019e3ac2a8d9d9a33dd8c4cc7802023ae6c8
-
Filesize
1.8MB
MD53c3876000b72164b046c783937ebbf60
SHA11ab7a188590ccd11abc0ba7b55f1c495ca0e6607
SHA2564294b39d25fc61b0163ea3bcb56de6b4f5fe423d50186686661e364cdec4fb9a
SHA512696181bce27076e4e442f36a129dc35b1fd095a49c2576914fab48f572c735d08724f124f7647360030b54e6d3809c89e8c275d31c89ff5edc4d2a7c9242d6e5
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
31.3MB
MD546c0158715bf937ebbbd3f0f4160df53
SHA14025bb5c7dab4c20f43e27ef59fb7b0d59f20b5e
SHA25603f9c6613c68094f94d2099b0f5b61afb7e308d70a19b3bc26a2c4d9a65a33f0
SHA51213a7e0d01d3a79fdd309a447ad130fe3597737dc001ed816f6541f60079b4ee6f36b4d7842fa8672eca94b693925baab6ddb8f84839ad5bf7f0eea3e72f18357
-
Filesize
1KB
MD54714b8fd760072cb8ba2c795bcd54b99
SHA1385a49127225a0e826b8e5ca1a9fc11565911c6e
SHA2566b1433f1569e524a37b029b2e77c824c988c645a18074e865c5b6881ece6fdca
SHA5129e6bac25de1cb751ac17fd7f1a9f074ded0427c7d23a945f655b2f0a7f8be81b296662b57f4a90bcce7b86a53c7c48ace9213d16f5ccc16c5fb92518ea4dae20
-
Filesize
111KB
MD5a9b40e0b76aa5a292cb6052c6c2fd81d
SHA1e15bba9e662ef45350720218617d563620c76823
SHA256f5017d72f3b829a55971f877ebaa257f5e9791ae253ae23111cc45628477c36c
SHA512ad49410a233614128a103ae55155665f563b67daa7411c42bf314a6a6d1c2cb61e4428d9049d0d3209d44a1b5eef1cab00541b6bb41dcf575ff9e7e406a2f23f
-
Filesize
218KB
MD50ea5c7021018a45083ea4eb31f0fc34d
SHA1d636419a870e4774feb272b73e5c9d57dae9485e
SHA256b80d53a3d3ae6db48a7b1835aedb52e85291f35d55b61aa363994217b890dc8a
SHA512a26e6461361b84da71396bdf8227c0d70f84589b92dd33c6549e1e035c4f5cfa778b4ca22b9ebfc380bd593a43260b53cb4b8f6ccb66381bdc64deb7755f9d79
-
Filesize
77KB
MD5f107a3c7371c4543bd3908ba729dd2db
SHA1af8e7e8f446de74db2f31d532e46eab8bbf41e0a
SHA25600df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0
SHA512fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530
-
Filesize
23.7MB
MD5d0b3440e1489563517110872393792ee
SHA1f05d9e0f244272648b149785cdaf0a620516db10
SHA25666aefefbef58bec774db81dc1b074db10ed7b09b7d8e95a7e25501f1bc364080
SHA5127fbec228743d9e0aa316c226ece169567b7a047f198e4f83d43c24edf9516e7cdb162b6563730993b7d64ef47947330d15b3a3160407dea23df003c41e4c5225
-
\??\Volume{f1c94fa5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{08214d0a-6c94-4b04-801c-e3b40a7abcd9}_OnDiskSnapshotProp
Filesize6KB
MD5fb5d3edd07afe957943d8d1db01fa985
SHA1efd752cb966d0a70fbdb0b65c57b0c8744fe8859
SHA25645b13228499873c2ba76cc2f251c3ad261bef2f4951b6a06294760bb072a6878
SHA51206237a8be6c2a96efc84b6c39f2db0d5fe8f3bb2eb69f96e991d376b4d3313e231386d2589f64fa8a9bd981678efa4a12f422a6e0327aeadf631eb3599ec28c7