f765d1d4012f47223a47c5992da55066e81d76b0714eb347ca6a54c55f4e374c

Analysis

max time kernel
30s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChromeSetup.exe
Size

8.0MB
MD5

780d9df36221ccd24716da39ee3e2708
SHA1

3a2e4f8bc401856f1870e9fd3a3977044db68729
SHA256

f765d1d4012f47223a47c5992da55066e81d76b0714eb347ca6a54c55f4e374c
SHA512

36b1df97a9b0a3ae9cae704f722537c877c6b8a091c513be66bd16645cdf9ab424912e6dac3ddfbbf9419a9d0acc17113dec88418b8134e641a87028e8e4d6c0
SSDEEP

196608:bWi1ZYP2rPma7ts+ndryl6xmrsUbX1YmbWxAnwvS:b7e2rua7tsedwrsUbX1YcWxAnw

Score

6^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\126.0.6478.127\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\uk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\sk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\elevation_service.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Extensions\external_extensions.json	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\de0dc617-3abe-4859-b154-8eed488e0cac.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\Google1836_1530249207\UPDATER.PACKED.7Z	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\1f2b3450-45c8-4e82-b0fe-c652cc5ed962.tmp	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\manifest.fingerprint	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\chrome_100_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\am.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\et.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\fa.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\th.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\8dbef064-9c11-49cf-8207-73d3ef5bbb5a.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\VisualElements\Logo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\ko.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\mr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\dxcompiler.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\vk_swiftshader.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\1f2b3450-45c8-4e82-b0fe-c652cc5ed962.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\ecd19e64-b05f-47a0-9051-267de287ab06.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\SETUP.EX_	126.0.6478.127_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\sv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\mojo_core.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\uninstall.cmd	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\fr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\lv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\tr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\Google1836_1249624114\updater.7z	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\chrome_pwa_launcher.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\nb.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe	126.0.6478.127_chrome_installer.exe
File created	C:\Program Files (x86)\Google1836_1249624114\bin\uninstall.cmd	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\02a9b01c-c4fc-4e63-90d0-b1b42c168c8c.tmp	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\CHROME.PACKED.7Z	126.0.6478.127_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\hi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2516_636530893\Chrome-bin\126.0.6478.127\Locales\hu.pak	setup.exe
File created	C:\Program Files (x86)\Google1836_1249624114\bin\updater.exe	ChromeSetup.exe

Executes dropped EXE 11 IoCs

pid	Process
4796	updater.exe
2456	updater.exe
2948	updater.exe
1168	updater.exe
1780	updater.exe
736	updater.exe
3332	126.0.6478.127_chrome_installer.exe
2516	setup.exe
4336	setup.exe
1528	setup.exe
2132	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\ = "GoogleUpdater TypeLib for IAppWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ = "IUpdaterAppStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}\1.0\ = "GoogleUpdater TypeLib for IUpdaterInternalSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FCD652C-D470-570F-9A74-B31F9AB8F368}\TypeLib\Version = "1.0"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ = "IUpdaterCallbackSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib\ = "{5F793925-C903-4E92-9AE3-77CA5EAB1716}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\5"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\ = "{6430040A-5EBD-4E63-A56F-C71D5990F827}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\ = "GoogleUpdater TypeLib for IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib\ = "{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{708860E0-F641-4611-8895-7D867DD3675B}\LocalService = "GoogleChromeElevationService"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ = "Interface {463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\6"	updater.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4796	updater.exe
4796	updater.exe
4796	updater.exe
4796	updater.exe
4796	updater.exe
4796	updater.exe
2948	updater.exe
2948	updater.exe
2948	updater.exe
2948	updater.exe
2948	updater.exe
2948	updater.exe
1780	updater.exe
1780	updater.exe
1780	updater.exe
1780	updater.exe
1780	updater.exe
1780	updater.exe
1780	updater.exe
1780	updater.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1836	ChromeSetup.exe
Token: SeIncBasePriorityPrivilege	1836	ChromeSetup.exe
Token: 33	3332	126.0.6478.127_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	3332	126.0.6478.127_chrome_installer.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4796	1836	ChromeSetup.exe	81
PID 1836 wrote to memory of 4796	1836	ChromeSetup.exe	81
PID 1836 wrote to memory of 4796	1836	ChromeSetup.exe	81
PID 4796 wrote to memory of 2456	4796	updater.exe	82
PID 4796 wrote to memory of 2456	4796	updater.exe	82
PID 4796 wrote to memory of 2456	4796	updater.exe	82
PID 2948 wrote to memory of 1168	2948	updater.exe	84
PID 2948 wrote to memory of 1168	2948	updater.exe	84
PID 2948 wrote to memory of 1168	2948	updater.exe	84
PID 1780 wrote to memory of 736	1780	updater.exe	86
PID 1780 wrote to memory of 736	1780	updater.exe	86
PID 1780 wrote to memory of 736	1780	updater.exe	86
PID 1780 wrote to memory of 3332	1780	updater.exe	88
PID 1780 wrote to memory of 3332	1780	updater.exe	88
PID 3332 wrote to memory of 2516	3332	126.0.6478.127_chrome_installer.exe	89
PID 3332 wrote to memory of 2516	3332	126.0.6478.127_chrome_installer.exe	89
PID 2516 wrote to memory of 4336	2516	setup.exe	90
PID 2516 wrote to memory of 4336	2516	setup.exe	90
PID 2516 wrote to memory of 1528	2516	setup.exe	92
PID 2516 wrote to memory of 1528	2516	setup.exe	92
PID 1528 wrote to memory of 2132	1528	setup.exe	93
PID 1528 wrote to memory of 2132	1528	setup.exe	93

C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Google1836_1249624114\bin\updater.exe
  "C:\Program Files (x86)\Google1836_1249624114\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1E5E5C4F-2824-A1A8-B948-33835CA392B5}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
  2⤵
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files (x86)\Google1836_1249624114\bin\updater.exe
    "C:\Program Files (x86)\Google1836_1249624114\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x552604,0x552610,0x55261c
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:2456

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x922604,0x922610,0x92261c
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:1168

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x922604,0x922610,0x92261c
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:736
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\126.0.6478.127_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\126.0.6478.127_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\de0dc617-3abe-4859-b154-8eed488e0cac.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\de0dc617-3abe-4859-b154-8eed488e0cac.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.127 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff66bf646a8,0x7ff66bf646b4,0x7ff66bf646c0
      4⤵
      Executes dropped EXE
      PID:4336
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.127 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff66bf646a8,0x7ff66bf646b4,0x7ff66bf646c0
        5⤵
        Executes dropped EXE
        
        PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google1836_1249624114\bin\updater.exe

Filesize
4.4MB

MD5
512a822caed80f9fa3f0dfce20d4faa1

SHA1
16f470de73681ce7ec9b3251ac081879fb37798c

SHA256
8de9266347276d18fe49f84b86f09e6035df2c10e39f22d85bf33d43cf0f5f2c

SHA512
9fc3d74dddd28b325fe3b803c1217d7374b61ae6d7eecb46aa2dafb643b7a45387caba015421da524cc0416c9b3bdbb3d871120c1275e421f86e9d80a3781802

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad\settings.dat

Filesize
40B

MD5
39478f62ae4138961ec18bf49312f132

SHA1
d32997c59969fdf4875d651740005a372ee813a7

SHA256
8ff206c689ee486184ae347202cfbcf07e9aa8688468a221d06208aff2b8b714

SHA512
e9d224100b8f70a192c6286d62cd8d4cacc0be8fb67436954d483cf50eab7c8966618ce29f2dfc431ed03449b27e40eb0476d80cd7f9de44eb12749441988a2e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
e0ee4da712ce8c124aa6591511138c42

SHA1
3c995aa84f0c88624b3998304a39803bd99f116e

SHA256
44ea110f766b1c1df4863665f334421b1d0dd450b859f2d75a53a96d005ab7ff

SHA512
dd93f581ecbf41c75c85388d0eeb809fe64f5c5e0e8b24f13b20b8d2b88cb98c873ebfaeff8a6bdc985b548ed6e866ffc53f465ac5a01018fcd9c58c7faec17c

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
492B

MD5
25063c04c9a38df19a1eb1a5faeb22fe

SHA1
2a63c9e9dc12c179f97c1b00b6864604f425784a

SHA256
45d6823bf385bc181ce0354cb7620dd31ddf2def8e1f2592aa0df573e1dc1714

SHA512
32a0d8a67904ece76f09ec1007af86fa4c8e232116cbaf815e4480e917b0325ca15bf35cfc77c842fbc15e5b00c6c657d831d9696459c4dec6b8655508c0416a

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
a640ca2e70d5d86ee61c65b5fa0a5de3

SHA1
932854c7284e88d764a5f455c2559430282630e3

SHA256
143f8c59a52692d27d38a2da2d510f37237faeee74850381917768adee0975e6

SHA512
855f3de6bda41d5a015922c4127947bd9ad51b2b137ccdbef5232b2f373c24b7c99f0806466c1cbd49387a4d6984f10f71e69dc7ab9a9274e4ec1d376758cdf2

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
aad56e51f8ac4b054630c2a5c92b0c53

SHA1
dead8b94002c857b445754f68b24df5c8d601c64

SHA256
d86313004b0cba5a2abf6995d6623a139721521c533d004a33fe5973ab9b8a00

SHA512
4100d19d339c732f22d9189fb6dbb87f22e8cf42edd0e4f74ba3b89459e3054ae6e8f17be04c978a913dac769dc1519ec8b91cb94db116cc9ec3426aae94cb94

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
5KB

MD5
385f9bc36fc1ff8ea055139d863a115b

SHA1
224133573e82bc9fc44ce8e154b5cf9aebfcdc6f

SHA256
024256c640dae8766434e515fcc3b6608387f0658fe234ab28067ee5f131d613

SHA512
f59fcad6ee41097d9ee1004261eb4e0b3a4c8078f868265664fc999f01a0dd77f96ad0205b5bc25695975bb10ec8ffd44bd61a077a434dcf3dbd972a0509c2dc

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
12KB

MD5
3ca119f03fe5fdfc973870bf144b66e3

SHA1
6a441e421885c158c5885705691211f6115ffefa

SHA256
feea2dff21ba991afa4d3c2e4b516f8c0dc411dcecf73f75b0454056410fb26e

SHA512
3af77035094e96fcd064e2368641ea0588ba3622f7d41893a66a9d094342442ed241bd14fb3a99f4dad45e8db90254fd2cae0ffbee38723100ff28202eafe3b9

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
a3b3717f607aeefd13a8620bf0249126

SHA1
967c5f677da42c8c168ed02d0eeb711a77488324

SHA256
ae36ec2e246d16f4f4a322a761d5eb8a3a83f3b26c0caa1b7da51589c12573b0

SHA512
b323ff92dc94c726f535e9d5e16be2fcce2af041cd6da14841913b75ff912bf9a7ebd81812c9a3f3a32bc79d666a8f20b1141b6b737a888cf925ad7bd446ff4e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
5d21430459639729d0c5295ec47c72d0

SHA1
c8bca46cdbc1e98cc0fbee2e6a0afd0ba6734b76

SHA256
3b8fa3358ecd94efb7e3c9bc44919a0c558cd9914d829dc24451f730f44230b3

SHA512
efccf9e728f244c61e11fa2dbd46ec8c914323e6d41c1c8b345f5a9613519b31dfe058e3a0e7a3d8e38d8596eb4cb81e46c18901671710e29cb39fb417cec70a

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\CR_B6D27.tmp\setup.exe

Filesize
4.1MB

MD5
0849095a80f74794bcac8b3561fc4a58

SHA1
5b27f31892bb7b04c62d3b1f612a45415a3bc32e

SHA256
27dbc6e6ac8630b50fc5473e9a7f341c7d759806f762aa522698ec10bf2f2e62

SHA512
1f52e20fc2812af55e00b7aea59b00af262ea87bc7b652504a3be9b26e500fffeffbed52dc21132b22645f46f2a59f546485e9089e7cfb5f0154041918f52e5c

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1780_1369066556\de0dc617-3abe-4859-b154-8eed488e0cac.tmp

Filesize
652KB

MD5
44c7f06f320e8068a00af6f8930c0511

SHA1
e68c5ff16e0c28a2ec146198b96bfad291743c4b

SHA256
c0dd8ff1c80385821da0fe5102b40420ebe4b476b5832382553dbb6d51ae33c9

SHA512
82343ada963b593fce6718b9d460bfc7d359be629de1b8cf38dc638ba30495d0b5d271d658a9125fe674fe5b3375767e88ce7d8ae6f23d34f89e342d796aa644

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.7MB

MD5
d09b0bceaaccb0b4c2fc6b95b9a5241a

SHA1
5ada2eddc6954dfc50aff07276909866418ce799

SHA256
13e2a3b4ddff74975fd41b9a1d4ed57de5ec67c0f377791dbbba5c8402690eb8

SHA512
aec811b8ae222d21108fff90c501278cfccc1d76f4b01469339f08f09514ff31d508e2abec7ed3c53e196f34ab73544be969e5e284a220e0206d680d8e602ba7

Download Submit
C:\Windows\TEMP\chrome_installer.log

Filesize
22KB

MD5
8a7d8cb4d5b94c9f98f1a8f3232773fe

SHA1
35565bb3461c7939dd46639d584078a81394d764

SHA256
3f91c4255b1d0abe9e6619fa18ae0f3756a80733f4e96cb301ba13d205cbe4b0

SHA512
824bf73ea49293deadeddf886b8c541dc1d87fcf698282a5a19a351fe53b7a6a593f347ed5069f8adad15286d3a13932178b25fd422b7c84dc6354176e590caf

Download Submit