a79f714e8c2239baa9f1bfef2e0eedf1373fca1b63e2de8c99e04ce0d183c7d8

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChromeSetup.exe
Size 158KB
Sample260930-apsp6sxvcw
SHA256 a79f714e8c2239baa9f1bfef2e0eedf1373fca1b63e2de8c99e04ce0d183c7d8
MD5 ad53ccb9249ae6a940d7038fdba1eefc
SHA1 c98554d2195d1da79f5428c4cb13529810dbfaff
SHA512 cd154b4702625581a9ce7c39584550e002f33d2867ce523bca8995785755a8269d2f1c293e916c957e917857b35bf626d3678d6d590066997fab9420a8cc8a91
SSDEEP 3072:mOYmNp7I5pFZ8LiEmkvUU/h/fi8yEUyEwtk4voYJQ6F2Tr:mJsoZMtUUA8yaZtk2CxTr
TLSH
T1C3F3F23ABB374C9DC0D5DAB970FB8470E4F2BD91A8502A3C429142743A57DD89F38AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3280	GoogleUpdate.exe

Executes dropped EXE 4 IoCs

pid	Process
1152	GoogleUpdate.exe
3280	GoogleUpdate.exe
3252	GoogleUpdate.exe
2504	GoogleUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "\"C:\\ProgramData\\Google\\Update\\GoogleUpdate.exe\""	GoogleUpdate.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1152	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 1152	3932	ChromeSetup.exe	86
PID 3932 wrote to memory of 3280	3932	ChromeSetup.exe	87
PID 1152 wrote to memory of 3252	1152	GoogleUpdate.exe	98

C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  C:\ProgramData\Google\Update\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\ProgramData\Google\Update\GoogleUpdate.exe
    "C:\ProgramData\Google\Update\GoogleUpdate.exe" -g
    3⤵
    - Executes dropped EXE
    PID:3252
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  "C:\ProgramData\Google\Update\GoogleUpdate.exe" -d "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3280

C:\ProgramData\Google\Update\GoogleUpdate.exe
"C:\ProgramData\Google\Update\GoogleUpdate.exe"
1⤵
- Executes dropped EXE
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\ProgramData\Google\Update\GoogleUpdate.exe
Size 131KB
SHA256 2c9f6e32246d598bcac884cd52f7a8a12f8dfc428b9ae7075aa488902bb155b3
MD5 63100314f6f38ff2d9896073288f7f1c
SHA1 9f39b306292f4e99d89f077c0e8e07f5d34b9465
SHA512 9e8d711190e64418c1bde51e90be50f645d58a565f6f20da9ec0fa0666c2c6b8003aa342f93baca9725119a717a922fd31bf8cc30e28d5bf164e5a26f5be4d07
SSDEEP 3072:UxhavIeD2n5/AaeZAzFJP5L5wgUgZrk6NUY1SUv+Qt2X:MawKZAzFJP5L51xaY10
TLSH
T1E0D37C37FB73809CC587A2B4B6CA9CE1B571FD340070A66D036116687F5B9A48FAE6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g.pid

Path C:\ProgramData\Google\Update\g.pid
Size 8B
SHA256 dc819bcc39e4b2a4ac0f89c6ab09f7f1e638f1a3363a1527e7c8f5da8f79cd90
MD5 f25c5ab4cbd070e4d596a59802f9cd4a
SHA1 f2b7cae96748ba3f580c437d31f3b355ef3c6716
SHA512 a95350e3a6fa1efb29fde679045a90786dcecb402019bd8bf11d2261af9d88a92060cc2f8c27b0ef0eaf346bcb6bd8e8d3fa0189834cb3661fcbd83dd0258307
MD5 SHA1 SHA512

Submit Download

gupdater2.dll

Path C:\ProgramData\Google\Update\gupdater2.dll
Size 18KB
SHA256 54aae2b950ac8cd8eb3b3a5e777b25073a35fd799e8808fc3607a2fe01675752
MD5 872ffc2dcf4af10a72c51c2645b7996b
SHA1 f23c7e86b01024a869a69a911ed8bfbbff0e906b
SHA512 ceb07dc915d75dbebd01064314246f2509764b7b4a72a3fbc4ac3d9a8ea69278256ecc865c1d5164b9184339eef5ab0e07f71af38390cbb3bbaf3bf15c923b89
SSDEEP 384:HwVofDlntkMtgDZ/qOb1111111111111111111yzhDhEXv9z:Hw4DltNEZ/qOb111111111111111111T
TLSH
T1E282937BEFA3C4ADC4CAE3B4B28A9DB9A0B4FC654060192C0362536477477984F6E6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.pid

Path C:\ProgramData\Google\Update\main.pid
Size 8B
SHA256 b5a5a9777e1a0d17679fa80dad391c1dfbccd61601149d24efdb075ece4a5e00
MD5 ed59cca6f5243a6d3f9cd642f89cf255
SHA1 6b506d15d7b3b13cc178c00b4eeda37369cf5b66
SHA512 23ac6866d01fde4f99b03a6decc7ba2353078d0e56c343685348cf9d8be9ca1df1fd0f96338eb4e1e3a5b10a52e86897d60095a617bb8d5defa75eecc21af70d
MD5 SHA1 SHA512

Submit Download

memory/1152-13-0x00007FF7584E0000-0x00007FF7584FB000-memory.dmp

Download

memory/2504-32-0x00007FF7584E0000-0x00007FF7584FB000-memory.dmp

Download

memory/3252-22-0x00007FF7584E0000-0x00007FF7584FB000-memory.dmp

Download

memory/3280-12-0x00007FF7584E0000-0x00007FF7584FB000-memory.dmp

Download

memory/3932-7-0x00007FF64AB70000-0x00007FF64AB80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads