38545e8c5d9f98af07de3dc037e2a50ada7a57d3ef43281f946e3087ffd357b2

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
google.exe
Size 4.9MB
Sample260928-pma5nstdlh
SHA256 38545e8c5d9f98af07de3dc037e2a50ada7a57d3ef43281f946e3087ffd357b2
MD5 8cc7271aae2ed6504dd6d4e539172a6f
SHA1 e04af907402b9de1b458a417b1e3e06846ecb06f
SHA512 59b954d3b628b2b3e8ba1698cbb20df3f41af93b179c7bcc56ca79b08b86e63621486f207564015bc205da1dba261db0775829f1ec67dd015adceb67170c861e
SSDEEP 98304:AI/ZY7YIn34My0BgNnkf7xQ33tChyyj3hrfC/PYglvP6p/aZ+Bos2SGX3G:AGS7YTMy0BgNnFtSyyj3hNg3whos27m
TLSH
T17336331BB792946CC507C23848C38AB1FA35BC945B36AF3FA065CEB54D11DC1E5A8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 6 IoCs

pid	Process
4448	google.exe
4704	gupdt.exe
5592	gupw.exe
1352	gupdt.exe
1724	gupdt.exe
2412	gupdt.exe

Power Settings 1 TTPs 12 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3564	powercfg.exe
4524	powercfg.exe
1556	powercfg.exe
2364	powercfg.exe
5916	powercfg.exe
1412	powercfg.exe
5876	powercfg.exe
1144	powercfg.exe
1652	powercfg.exe
3512	powercfg.exe
1616	powercfg.exe
2556	powercfg.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wsdapi.dll,-200 = "Trusted Devices"	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AppxPackaging.dll,-1001 = "Trusted Packaged App Installation Authorities"	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SessEnv.dll,-101 = "Remote Desktop"	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wifinetworkmanager.dll,-4396 = "Passpoint Trusted Roots"	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wsdapi.dll,-201 = "OEM eSIM Certification Authorities"	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-304 = "Endorsement Key Trusted Root Certification Authorities"	certutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-305 = "Endorsement Key Intermediate Certification Authorities"	certutil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
1376	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe
4448	google.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1652	powercfg.exe
Token: SeCreatePagefilePrivilege	1652	powercfg.exe
Token: SeShutdownPrivilege	3512	powercfg.exe
Token: SeCreatePagefilePrivilege	3512	powercfg.exe
Token: SeShutdownPrivilege	1616	powercfg.exe
Token: SeCreatePagefilePrivilege	1616	powercfg.exe
Token: SeShutdownPrivilege	2556	powercfg.exe
Token: SeCreatePagefilePrivilege	2556	powercfg.exe
Token: SeShutdownPrivilege	3564	powercfg.exe
Token: SeCreatePagefilePrivilege	3564	powercfg.exe
Token: SeShutdownPrivilege	4524	powercfg.exe
Token: SeCreatePagefilePrivilege	4524	powercfg.exe
Token: SeShutdownPrivilege	2364	powercfg.exe
Token: SeCreatePagefilePrivilege	2364	powercfg.exe
Token: SeShutdownPrivilege	5916	powercfg.exe
Token: SeCreatePagefilePrivilege	5916	powercfg.exe
Token: SeShutdownPrivilege	1412	powercfg.exe
Token: SeCreatePagefilePrivilege	1412	powercfg.exe
Token: SeShutdownPrivilege	1556	powercfg.exe
Token: SeCreatePagefilePrivilege	1556	powercfg.exe
Token: SeShutdownPrivilege	5876	powercfg.exe
Token: SeCreatePagefilePrivilege	5876	powercfg.exe
Token: SeShutdownPrivilege	1144	powercfg.exe
Token: SeCreatePagefilePrivilege	1144	powercfg.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 476	4448	google.exe	90
PID 4448 wrote to memory of 4704	4448	google.exe	92
PID 4448 wrote to memory of 5592	4448	google.exe	93
PID 4448 wrote to memory of 1352	4448	google.exe	94
PID 4448 wrote to memory of 1724	4448	google.exe	95
PID 5592 wrote to memory of 1652	5592	gupw.exe	96
PID 5592 wrote to memory of 3512	5592	gupw.exe	98
PID 4448 wrote to memory of 2412	4448	google.exe	100
PID 5592 wrote to memory of 1616	5592	gupw.exe	101
PID 5592 wrote to memory of 2556	5592	gupw.exe	103
PID 5592 wrote to memory of 3564	5592	gupw.exe	105
PID 5592 wrote to memory of 4524	5592	gupw.exe	107
PID 5592 wrote to memory of 2364	5592	gupw.exe	109
PID 5592 wrote to memory of 5916	5592	gupw.exe	111
PID 5592 wrote to memory of 1412	5592	gupw.exe	113
PID 5592 wrote to memory of 1556	5592	gupw.exe	115
PID 5592 wrote to memory of 5876	5592	gupw.exe	117
PID 5592 wrote to memory of 1144	5592	gupw.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\google.exe
"C:\Users\Admin\AppData\Local\Temp\google.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\ProgramData\Google\Chrome\spyll45atb\google.exe
C:\ProgramData\Google\Chrome\spyll45atb\google.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\system32\certutil.exe
  certutil -addstore Root "C:\Windows\TEMP\gucert_tmp.cer"
  2⤵
  - Modifies data under HKEY_USERS
  PID:476
- C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\ProgramData\Google\Chrome\spyll45atb\gupw.exe
  C:\ProgramData\Google\Chrome\spyll45atb\gupw.exe /watch
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  C:\ProgramData\Google\Chrome\spyll45atb\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

google.dll

Path C:\ProgramData\Google\Chrome\spyll45atb\google.dll
Size 37KB
SHA256 3990a66094ebef676eadab51e7d6423a10588d62bf9547b8a50977fd404fe212
MD5 e8de4eb442c8163cc6101a5ec1bf45f2
SHA1 f2561ad849fe5975cd7c2291b1321a72ffac45a2
SHA512 f5341573d58ef653ad3ec9ecb3342a80e57ba646033f2bcc873b785c48a4a98ae619da42454daa1273d272eaf669fbc597ac5353883e7bd4ecba44a327ce2a1c
SSDEEP 384:LGAXc80+8S5MO+KOGJomSKOwIrkTswNCGGMAS49:Ls5E+JlwIrQ2
TLSH
T12C0352C43ED55CD7ED24A23C61EAC2313A38F5E04A53475BE530A6320E13BE16EED686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google.exe

Path C:\ProgramData\Google\Chrome\spyll45atb\google.exe
Size 4.9MB
SHA256 38545e8c5d9f98af07de3dc037e2a50ada7a57d3ef43281f946e3087ffd357b2
MD5 8cc7271aae2ed6504dd6d4e539172a6f
SHA1 e04af907402b9de1b458a417b1e3e06846ecb06f
SHA512 59b954d3b628b2b3e8ba1698cbb20df3f41af93b179c7bcc56ca79b08b86e63621486f207564015bc205da1dba261db0775829f1ec67dd015adceb67170c861e
SSDEEP 98304:AI/ZY7YIn34My0BgNnkf7xQ33tChyyj3hrfC/PYglvP6p/aZ+Bos2SGX3G:AGS7YTMy0BgNnFtSyyj3hNg3whos27m
TLSH
T17336331BB792946CC507C23848C38AB1FA35BC945B36AF3FA065CEB54D11DC1E5A8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucert_tmp.cer

Path C:\Windows\TEMP\gucert_tmp.cer
Size 758B
SHA256 4b7faaa44972a7c995c77a6c8790f5f1c44fcd347aad639df3997d325950f333
MD5 a305f6e9db8fc9c9ed3b3dde921a82e3
SHA1 e3ecd3f50332bd93ab6a1635069cc40da36bbfd1
SHA512 51de92ee709ada533baf4c80975e071fbe2df64e20aaeb463f703fc605957cd3196ef8d5ceb3babb381a2d61503875625de110ee6742854610cb86755f3aeaad
TLSH
T1C001753A0E7D345429439B1C3CD8C25594D4CBB9C122FE62B46790501A402410CCF465
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1352-24-0x00007FF619040000-0x00007FF619533000-memory.dmp

Download

memory/1376-5-0x00007FF7C32B0000-0x00007FF7C37A3000-memory.dmp

Download

memory/1724-26-0x00007FF619040000-0x00007FF619533000-memory.dmp

Download

memory/2412-29-0x00007FF619040000-0x00007FF619533000-memory.dmp

Download

memory/4448-6-0x00007FF77FE80000-0x00007FF780373000-memory.dmp

Download

memory/4448-18-0x00007FF77FE80000-0x00007FF780373000-memory.dmp

Download

memory/4704-21-0x00007FF619040000-0x00007FF619533000-memory.dmp

Download

memory/5592-30-0x00007FF6B7F30000-0x00007FF6B8423000-memory.dmp

Download