a79f714e8c2239baa9f1bfef2e0eedf1373fca1b63e2de8c99e04ce0d183c7d8

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChromeSetup.exe
Size 158KB
Sample260930-apsp6sxvcw
SHA256 a79f714e8c2239baa9f1bfef2e0eedf1373fca1b63e2de8c99e04ce0d183c7d8
MD5 ad53ccb9249ae6a940d7038fdba1eefc
SHA1 c98554d2195d1da79f5428c4cb13529810dbfaff
SHA512 cd154b4702625581a9ce7c39584550e002f33d2867ce523bca8995785755a8269d2f1c293e916c957e917857b35bf626d3678d6d590066997fab9420a8cc8a91
SSDEEP 3072:mOYmNp7I5pFZ8LiEmkvUU/h/fi8yEUyEwtk4voYJQ6F2Tr:mJsoZMtUUA8yaZtk2CxTr
TLSH
T1C3F3F23ABB374C9DC0D5DAB970FB8470E4F2BD91A8502A3C429142743A57DD89F38AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5116	GoogleUpdate.exe

Executes dropped EXE 2 IoCs

pid	Process
5844	GoogleUpdate.exe
5116	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 5844	712	ChromeSetup.exe	89
PID 712 wrote to memory of 5116	712	ChromeSetup.exe	90

C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:712
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  C:\ProgramData\Google\Update\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:5844
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  "C:\ProgramData\Google\Update\GoogleUpdate.exe" -d "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\ProgramData\Google\Update\GoogleUpdate.exe
Size 131KB
SHA256 2c9f6e32246d598bcac884cd52f7a8a12f8dfc428b9ae7075aa488902bb155b3
MD5 63100314f6f38ff2d9896073288f7f1c
SHA1 9f39b306292f4e99d89f077c0e8e07f5d34b9465
SHA512 9e8d711190e64418c1bde51e90be50f645d58a565f6f20da9ec0fa0666c2c6b8003aa342f93baca9725119a717a922fd31bf8cc30e28d5bf164e5a26f5be4d07
SSDEEP 3072:UxhavIeD2n5/AaeZAzFJP5L5wgUgZrk6NUY1SUv+Qt2X:MawKZAzFJP5L51xaY10
TLSH
T1E0D37C37FB73809CC587A2B4B6CA9CE1B571FD340070A66D036116687F5B9A48FAE6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-10-0x00007FF7F0F00000-0x00007FF7F0F10000-memory.dmp

Download

memory/5116-12-0x00007FF7EB950000-0x00007FF7EB96B000-memory.dmp

Download

memory/5844-11-0x00007FF7EB950000-0x00007FF7EB96B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads