40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44

Analysis

max time kernel
1s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
Size

1.4MB
MD5

d679cf07aef6c469c53595761b78a608
SHA1

3a31e04b6a0d406375648dca872873385b455996
SHA256

40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44
SHA512

f5b12f6b43f49a1cfd9201db712bfaae1ed42dd933aca7a8a25011856db3f5df093ffe2f00083e8d7d6b2644f40df9005145a69cc543ba329b986b6e3806642b
SSDEEP

24576:IBvKKHgnhSC0badP0QiPYnSFELlFFx0A4cAhPSNfL1JD/tbOFmHPrEH7s:sKKAsadP0QiPzEz0AVISNT1JtMy1

Score

8^/10

persistence upx

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000400000001e96f-1.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
4644	GoogleUpdate.exe
3540	GoogleUpdate.exe
1700	GoogleUpdate.exe
3416	GoogleUpdateComRegisterShell64.exe

Loads dropped DLL 5 IoCs

pid	Process
1316	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
4644	GoogleUpdate.exe
3540	GoogleUpdate.exe
1700	GoogleUpdate.exe
3416	GoogleUpdateComRegisterShell64.exe

Registers COM server for autorun 1 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000400000001e96f-1.dat	upx
behavioral2/memory/1316-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1316-324-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1316-329-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1316-380-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1316-392-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1316-432-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_hi.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_id.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_it.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_fr.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_hi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_hr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_pt-BR.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_vi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_bn.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_en.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_hr.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdateOnDemand.exe	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_ko.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_pt-BR.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ja.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_bg.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_es-419.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ms.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT49EC.tmp	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_lv.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_da.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_sk.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateCore.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ml.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ru.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_sv.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleCrashHandler64.exe	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_it.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_sv.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_no.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdateCore.exe	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_en-GB.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_hu.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_is.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\psuser.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_uk.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\psmachine_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_da.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_fa.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdate.exe	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_nl.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\psuser_64.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_ca.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_te.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_ms.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_sw.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\psmachine.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_ar.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_mr.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_lv.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ta.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdateComRegisterShell64.exe	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_iw.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_ro.dll	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37FB52DA-F779-408D-B505-3F83CFBBFC20}\InprocHandler32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID\ = "GoogleUpdate.CoreClass"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37FB52DA-F779-408D-B505-3F83CFBBFC20}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID\ = "GoogleUpdate.Update3WebSvc.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CLSID\ = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CurVer\ = "GoogleUpdate.OnDemandCOMClassSvc.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc\CurVer\ = "GoogleUpdate.PolicyStatusSvc.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\PROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\ProgID	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\CLSID\ = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods\ = "13"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService = "gupdatem"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ServiceParameters = "/comsvc"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ = "IPackage"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CLSID\ = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\NumMethods\ = "12"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\CLSID\ = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ServiceParameters = "/comsvc"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe
4644	GoogleUpdate.exe
1316	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
1316	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
Token: SeDebugPrivilege	4644	GoogleUpdate.exe
Token: SeDebugPrivilege	4644	GoogleUpdate.exe
Token: SeDebugPrivilege	4644	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4644	1316	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe	101
PID 1316 wrote to memory of 4644	1316	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe	101
PID 1316 wrote to memory of 4644	1316	40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe	101
PID 4644 wrote to memory of 3540	4644	GoogleUpdate.exe	99
PID 4644 wrote to memory of 3540	4644	GoogleUpdate.exe	99
PID 4644 wrote to memory of 3540	4644	GoogleUpdate.exe	99
PID 4644 wrote to memory of 1700	4644	GoogleUpdate.exe	90
PID 4644 wrote to memory of 1700	4644	GoogleUpdate.exe	90
PID 4644 wrote to memory of 1700	4644	GoogleUpdate.exe	90
PID 1700 wrote to memory of 3416	1700	GoogleUpdate.exe	91
PID 1700 wrote to memory of 3416	1700	GoogleUpdate.exe	91

C:\Users\Admin\AppData\Local\Temp\40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe
"C:\Users\Admin\AppData\Local\Temp\40c99291a8725ddde8157ba42e53aec62804e582bc699d4555302a9bd2456e44.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={CAEC6DD3-CA9A-F3F9-2FE5-E6561BA4C3EA}&lang=en-GB&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4644

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Modifies registry class
  PID:3416
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
  2⤵
  PID:2480
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
  2⤵
  PID:1064

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkRCMTAzNTUtMjVFQS00N0M4LTgzNEYtRDJCNTU4NTJDNDhCfSIgdXNlcmlkPSJ7NjlCNEZDRTYtMzhGOC00NUI0LUEzMjYtNDk5MkQyNkRCNjQ5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZCMEY2MDNFLUVGRUItNEFFNS05MDM1LTcxQUZCQzVCMzlBMn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zNTIiIGxhbmc9ImVuLUdCIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7Q0FFQzZERDMtQ0E5QS1GM0Y5LTJGRTUtRTY1NjFCQTRDM0VBfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI4MjgiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
PID:4156
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  PID:4352

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={CAEC6DD3-CA9A-F3F9-2FE5-E6561BA4C3EA}&lang=en-GB&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{2DB10355-25EA-47C8-834F-D2B55852C48B}"
1⤵
PID:3640

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
PID:1432
- C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\120.0.6099.130_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\120.0.6099.130_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\guiA1A1.tmp"
  2⤵
  PID:2264
- - C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\guiA1A1.tmp"
    3⤵
    PID:1876
  - - C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=120.0.6099.130 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7199f70f8,0x7ff7199f7104,0x7ff7199f7110
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      PID:1368
    - - C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{7408ACA9-0F57-4339-B3B4-1AA3607C0367}\CR_2AC84.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=120.0.6099.130 --initial-client-data=0x268,0x26c,0x270,0x25c,0x274,0x7ff7199f70f8,0x7ff7199f7104,0x7ff7199f7110
        5⤵
        
        PID:2200
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"
  2⤵
  PID:8
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"
  2⤵
  PID:2104
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkRCMTAzNTUtMjVFQS00N0M4LTgzNEYtRDJCNTU4NTJDNDhCfSIgdXNlcmlkPSJ7NjlCNEZDRTYtMzhGOC00NUI0LUEzMjYtNDk5MkQyNkRCNjQ5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc0M0RCMDNBLTM5NDItNEJFMS1CNUYwLUQ5M0FEOTZFNUFEQX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTIwLjAuNjA5OS4xMzAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9ImVuLUdCIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTUiIGlpZD0ie0NBRUM2REQzLUNBOUEtRjNGOS0yRkU1LUU2NTYxQkE0QzNFQX0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2Fja2JpcWhiMmRxM3ZjejVmenY3Yml2dnBqNXFfMTIwLjAuNjA5OS4xMzAvMTIwLjAuNjA5OS4xMzBfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjExMTQ3OTg1NiIgdG90YWw9IjExMTQ3OTg1NiIgZG93bmxvYWRfdGltZV9tcz0iMTM3OTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjU5NCIgZG93bmxvYWRfdGltZV9tcz0iMTQ4MTIiIGRvd25sb2FkZWQ9IjExMTQ3OTg1NiIgdG90YWw9IjExMTQ3OTg1NiIgaW5zdGFsbF90aW1lX21zPSIyODk4NCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  PID:2860

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3540

C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe" -Embedding
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
bfb045ceef93ef6ab1cef922a95a630e

SHA1
4a89fc0aa79757f4986b83f15b8780285db86fb6

SHA256
1f6b69d11a3066e21c40002a25986c44e24a66f023a40e5f49eecaea33f5576d

SHA512
9c1bfa88b5b5533ede94158fa3169b9e0458f1ceae04dae0e74f4c23a899ce27d9109bd298a2053fb698e2ed403f51a9b828ee9fa9d66b54a18cd0d969edc194

Download Submit
C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
adae3c47edd1bd2e078f46e7dd448ff9

SHA1
e05b32b580286d45a9a3011cb209deed6fe964fe

SHA256
41a395dc1c9b6e10a32e39fc9bcc3c45611b30723c5a895ab46bd2abdac31d3a

SHA512
c05774d97c45fad2821526f852035954fd6dd9f1320d958657201d3fb378f763b8ff075848e7513c9872405dbabb656895193efda26a2a7587b0ba014a9abe38

Download Submit
C:\Program Files (x86)\Google\Temp\GUM49EB.tmp\goopdateres_de.dll

Filesize
45KB

MD5
35c9a26ea3cc527cf812edf6b20624d7

SHA1
dec5b58d039cfe7992a9fa58cdd80a2b03128054

SHA256
0f9022abd367d05db56b0b6158d4afa8b938ea78c87d86259544bdba83019af1

SHA512
40b5c2c7b56f035fbd2aa28f0fa169b864279dd169f1e019a8454a8a03ef97b6cdb6a82de065a110c75c8c541c973085e7a7d30d6d3741840b89214f438919cb

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Program Files\Google\Chrome\Application\120.0.6099.130\Installer\setup.exe

Filesize
65KB

MD5
6451987962fd7da47876fc120f38d754

SHA1
ca957b05f399816216d9f8995626595b7eb9fd45

SHA256
02b0b6b897a9b658fca08944756e6bccefc7244995cb8ab9cdd445b8253d0d9b

SHA512
5ec8734029b739302f2563f9d80929041fa57878bd587b1afde0fc90cc5eb6280e4e24a4fb0d7b0f33771e8ef5969f9417a3f2f264e1e6e355d8562e91a29ad3

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\20231231073036.pma

Filesize
2KB

MD5
aec2b935af93f5048a4508bdb8fdbc2e

SHA1
fdd8a0ea30f7841b77ade837c52cbc4f2058471e

SHA256
ab53d0c3d1824c31a116b32d6d0ac7ca2bf6b0758d839866dc77392d2dbbdb55

SHA512
984722374d55f813a3fbba62eb0382d8b89e3317b53df081b6d5ad516f28da3b342d0360a020522478dd70df2b32b1864b5c1299ccf3b38d5d3fcdd8f3257d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\4A961068524.tmp

Filesize
1.3MB

MD5
bfafac25aa1a93972b60e9b36ec5d7f8

SHA1
30514d15342d622ee14e7a5e424ea25989c8fb4d

SHA256
b177f474925a433bc557d749ea0f668972204d7b0728684f467cae2b3b883c07

SHA512
31d3a396bc328008b856368c0d9019e1c24dc5dddaf31c9df5b7f2354349b76bde1be1729238d889037226cd532796775a0646d3e6616da9315f2d23a86a05d6

Download Submit
memory/1316-324-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1316-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1316-7-0x0000000000B50000-0x0000000000C9F000-memory.dmp

Filesize
1.3MB

Download
memory/1316-320-0x0000000076930000-0x0000000076993000-memory.dmp

Filesize
396KB

Download
memory/1316-322-0x0000000076930000-0x0000000076993000-memory.dmp

Filesize
396KB

Download
memory/1316-432-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1316-8-0x0000000000B50000-0x0000000000C9F000-memory.dmp

Filesize
1.3MB

Download
memory/1316-329-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1316-6-0x0000000000B50000-0x0000000000C9F000-memory.dmp

Filesize
1.3MB

Download
memory/1316-5-0x0000000000B50000-0x0000000000C9F000-memory.dmp

Filesize
1.3MB

Download
memory/1316-380-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1316-27-0x0000000000B50000-0x0000000000C9F000-memory.dmp

Filesize
1.3MB

Download
memory/1316-386-0x0000000076930000-0x0000000076993000-memory.dmp

Filesize
396KB

Download
memory/1316-392-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1432-395-0x0000000073220000-0x0000000073415000-memory.dmp

Filesize
2.0MB

Download
memory/2104-435-0x00000000007E0000-0x000000000082C000-memory.dmp

Filesize
304KB

Download
memory/3640-394-0x0000000073220000-0x0000000073415000-memory.dmp

Filesize
2.0MB

Download
memory/3640-405-0x0000000073220000-0x0000000073415000-memory.dmp

Filesize
2.0MB

Download
memory/3640-457-0x0000000073220000-0x0000000073415000-memory.dmp

Filesize
2.0MB

Download
memory/4644-393-0x0000000074B30000-0x0000000074D25000-memory.dmp

Filesize
2.0MB

Download
memory/4644-325-0x0000000074B30000-0x0000000074D25000-memory.dmp

Filesize
2.0MB

Download
memory/4644-456-0x0000000074B30000-0x0000000074D25000-memory.dmp

Filesize
2.0MB

Download