5c57eed1b26743f24eb310f2cdad4670a8901d3b358df55afd0f5fc5c085318e

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
google.exe
Size 18.1MB
Sample260930-pat21sef87
SHA256 5c57eed1b26743f24eb310f2cdad4670a8901d3b358df55afd0f5fc5c085318e
MD5 02366713bb0a81b0ff286c12a37e4c1b
SHA1 2046be26d4750093652f2e47bd3ced843a282726
SHA512 46057a667eece3c506ebcc96c2a9da21b08b275afb0aa86811ea2ba63c0c857646701f8347569b74f25cef42c071a8fc3b1f2918cd027550393970abb43cef6e
SSDEEP 393216:RatsUwlwYAb68tOvFkxb6Ct4lw4w5sUAl:qsxKv1dzCK3sp
TLSH
T11317231AB79758DFCA168139586EE321FD7DEBA06205CF6B9798C2383D32C1A18C53D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
3576	chrome140.exe
4164	gupdt.exe
896	gupw.exe
5676	chrome140.exe
2740	gupdt.exe
4632	gupdt.exe
5288	gupdt.exe
3936	gupdt.exe
4748	gupdt.exe
1824	gupdt.exe
2596	gupdt.exe
2240	gupdt.exe
3972	gupdt.exe
1988	gupdt.exe
5904	gupdt.exe
568	gupdt.exe
932	gupdt.exe
1212	gupdt.exe
1536	gupdt.exe
5808	gupdt.exe
2888	gupdt.exe
4252	gupdt.exe
3840	gupdt.exe
4372	gupdt.exe
4836	gupdt.exe
4448	gupdt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate140 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\0fvyms6kxt\\chrome140.exe\" /user"	google.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3420	powercfg.exe
3008	powercfg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3708	google.exe
3708	google.exe
3708	google.exe
3708	google.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe
896	gupw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3420	powercfg.exe
Token: SeCreatePagefilePrivilege	3420	powercfg.exe
Token: SeShutdownPrivilege	3008	powercfg.exe
Token: SeCreatePagefilePrivilege	3008	powercfg.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3420	3708	google.exe	91
PID 3708 wrote to memory of 3008	3708	google.exe	93
PID 3708 wrote to memory of 4164	3708	google.exe	96
PID 3708 wrote to memory of 896	3708	google.exe	98
PID 896 wrote to memory of 2740	896	gupw.exe	100
PID 896 wrote to memory of 4632	896	gupw.exe	101
PID 896 wrote to memory of 5288	896	gupw.exe	102
PID 896 wrote to memory of 3936	896	gupw.exe	103
PID 896 wrote to memory of 4748	896	gupw.exe	104
PID 896 wrote to memory of 1824	896	gupw.exe	105
PID 896 wrote to memory of 2596	896	gupw.exe	106
PID 896 wrote to memory of 2240	896	gupw.exe	107
PID 896 wrote to memory of 3972	896	gupw.exe	108
PID 896 wrote to memory of 1988	896	gupw.exe	109
PID 896 wrote to memory of 5904	896	gupw.exe	110
PID 896 wrote to memory of 568	896	gupw.exe	111
PID 896 wrote to memory of 932	896	gupw.exe	112
PID 896 wrote to memory of 1212	896	gupw.exe	113
PID 896 wrote to memory of 1536	896	gupw.exe	114
PID 896 wrote to memory of 5808	896	gupw.exe	115
PID 896 wrote to memory of 2888	896	gupw.exe	116
PID 896 wrote to memory of 4252	896	gupw.exe	117
PID 896 wrote to memory of 3840	896	gupw.exe	118
PID 896 wrote to memory of 4372	896	gupw.exe	119
PID 896 wrote to memory of 4836	896	gupw.exe	120
PID 896 wrote to memory of 4448	896	gupw.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\google.exe
"C:\Users\Admin\AppData\Local\Temp\google.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupw.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupw.exe /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2740
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4632
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5288
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3936
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4748
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1824
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2596
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2240
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3972
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1988
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5904
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:568
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:932
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1212
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1536
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5808
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2888
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4252
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3840
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4372
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4836
- - C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4448

C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\chrome140.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\chrome140.exe" /user
1⤵
- Executes dropped EXE
PID:3576

C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\chrome140.exe
C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\chrome140.exe
1⤵
- Executes dropped EXE
PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome140.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\chrome140.exe
Size 18.1MB
SHA256 5c57eed1b26743f24eb310f2cdad4670a8901d3b358df55afd0f5fc5c085318e
MD5 02366713bb0a81b0ff286c12a37e4c1b
SHA1 2046be26d4750093652f2e47bd3ced843a282726
SHA512 46057a667eece3c506ebcc96c2a9da21b08b275afb0aa86811ea2ba63c0c857646701f8347569b74f25cef42c071a8fc3b1f2918cd027550393970abb43cef6e
SSDEEP 393216:RatsUwlwYAb68tOvFkxb6Ct4lw4w5sUAl:qsxKv1dzCK3sp
TLSH
T11317231AB79758DFCA168139586EE321FD7DEBA06205CF6B9798C2383D32C1A18C53D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\0fvyms6kxt\google.dll
Size 400KB
SHA256 f9bfe12a4d812e59902b6bb3443dedc4851b9efe3a39d708991a6fe6a6cc73ef
MD5 ee34b5af1d7893cf0a2bfe316c865324
SHA1 e6a44d4110d7dca7af72521b3a8c054bd2203834
SHA512 c301a340c825078de224ea6a3c65d6e68f3fba8d5eca135fbacf50072b17d7a849ff4d9ead17b1b11641a1b99cce379760f721a7b86011d0dd83e8427cdbd63d
SSDEEP 6144:C4GC+gQ8q2GN/0wP69jwaQB1meCHuby0HRNev+Cuz7WQhCi6rWow6Bym0jfy+bqy:CUWRNpiyfoevW16KSr
TLSH
T14194E909F79718DBDE158178197DA321FA6DDAE8A245CF67869C927C3C73C6A18C03C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-48-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/896-16-0x00007FF7C22F0000-0x00007FF7C3417000-memory.dmp

Download

memory/932-51-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/1212-54-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/1536-57-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/1824-30-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/1988-42-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/2240-36-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/2596-33-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/2740-15-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/2888-63-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/3576-5-0x00007FF66D410000-0x00007FF66E537000-memory.dmp

Download

memory/3708-2-0x00007FF691EA0000-0x00007FF692FC7000-memory.dmp

Download

memory/3708-6-0x00007FF691EA0000-0x00007FF692FC7000-memory.dmp

Download

memory/3708-13-0x00007FF691EA0000-0x00007FF692FC7000-memory.dmp

Download

memory/3708-3-0x00007FF691EA0000-0x00007FF692FC7000-memory.dmp

Download

memory/3840-69-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/3936-24-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/3972-39-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/4164-9-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/4252-66-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/4372-72-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/4448-78-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/4632-18-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/4748-27-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/4836-75-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/5288-21-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/5676-12-0x00007FF66D410000-0x00007FF66E537000-memory.dmp

Download

memory/5808-60-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download

memory/5904-45-0x00007FF677EC0000-0x00007FF678FE7000-memory.dmp

Download