fb7460f1febcc0f1e96f2df6c4b940f3beac750ce8cd1f30f98086400fbbe20e

Analysis

max time kernel
144s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
google.exe
Size 18.5MB
Sample260930-phj7savtdx
SHA256 fb7460f1febcc0f1e96f2df6c4b940f3beac750ce8cd1f30f98086400fbbe20e
MD5 8de4f7dc19cf7f78385e3cbb5b31a684
SHA1 4f1cf8799aca04e99ebce7553a3042ae29706f00
SHA512 2fd0ce2e5fd69497efacafc30fc4daa5c5d44b2c4c948db39ff0c76e9fd80bc373621bb8daded0da29fa18b64f7b6636a2ea9c0f4fe47871f2d8931250b602e0
SSDEEP 393216:ySiO33nWRq4q1bHqzekMosMGbZqzFRq4EJix33nII:viO33nWRqt1bwekfsTb+FRqZJix33nII
TLSH
T16F172315B79724EFCA168234187EA720FE6EDAA46245CB7B879CC27C3D72C6918C43D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
2380	chrome140.exe
2144	gupdt.exe
5296	gupw.exe
1972	chrome140.exe
2288	gupdt.exe
3216	gupdt.exe
3984	gupdt.exe
3328	gupdt.exe
4512	gupdt.exe
2848	gupdt.exe
6104	gupdt.exe
1364	gupdt.exe
5168	gupdt.exe
3628	gupdt.exe
588	gupdt.exe
4604	gupdt.exe
4568	gupdt.exe
1636	gupdt.exe
5876	gupdt.exe
2392	gupdt.exe
3756	gupdt.exe
5872	gupdt.exe
2884	gupdt.exe
3164	gupdt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate140 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\k0re8n0bvr\\chrome140.exe\" /user"	google.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4596	powercfg.exe
5728	powercfg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	google.exe
4908	google.exe
4908	google.exe
4908	google.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe
5296	gupw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5728	powercfg.exe
Token: SeCreatePagefilePrivilege	5728	powercfg.exe
Token: SeShutdownPrivilege	4596	powercfg.exe
Token: SeCreatePagefilePrivilege	4596	powercfg.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 5728	4908	google.exe	92
PID 4908 wrote to memory of 4596	4908	google.exe	94
PID 4908 wrote to memory of 2144	4908	google.exe	96
PID 4908 wrote to memory of 5296	4908	google.exe	98
PID 5296 wrote to memory of 2288	5296	gupw.exe	100
PID 5296 wrote to memory of 3216	5296	gupw.exe	101
PID 5296 wrote to memory of 3984	5296	gupw.exe	102
PID 5296 wrote to memory of 3328	5296	gupw.exe	103
PID 5296 wrote to memory of 4512	5296	gupw.exe	104
PID 5296 wrote to memory of 2848	5296	gupw.exe	105
PID 5296 wrote to memory of 6104	5296	gupw.exe	106
PID 5296 wrote to memory of 1364	5296	gupw.exe	107
PID 5296 wrote to memory of 5168	5296	gupw.exe	108
PID 5296 wrote to memory of 3628	5296	gupw.exe	109
PID 5296 wrote to memory of 588	5296	gupw.exe	110
PID 5296 wrote to memory of 4604	5296	gupw.exe	111
PID 5296 wrote to memory of 4568	5296	gupw.exe	112
PID 5296 wrote to memory of 1636	5296	gupw.exe	113
PID 5296 wrote to memory of 5876	5296	gupw.exe	114
PID 5296 wrote to memory of 2392	5296	gupw.exe	115
PID 5296 wrote to memory of 3756	5296	gupw.exe	116
PID 5296 wrote to memory of 5872	5296	gupw.exe	117
PID 5296 wrote to memory of 2884	5296	gupw.exe	118
PID 5296 wrote to memory of 3164	5296	gupw.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\google.exe
"C:\Users\Admin\AppData\Local\Temp\google.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupw.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupw.exe /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2288
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3216
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3984
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3328
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4512
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2848
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:6104
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1364
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5168
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3628
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:588
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4604
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4568
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1636
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5876
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2392
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3756
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5872
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2884
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3164
- - C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
    3⤵
    PID:2332

C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe" /user
1⤵
- Executes dropped EXE
PID:2380

C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe
C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe
1⤵
- Executes dropped EXE
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome140.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe
Size 18.5MB
SHA256 fb7460f1febcc0f1e96f2df6c4b940f3beac750ce8cd1f30f98086400fbbe20e
MD5 8de4f7dc19cf7f78385e3cbb5b31a684
SHA1 4f1cf8799aca04e99ebce7553a3042ae29706f00
SHA512 2fd0ce2e5fd69497efacafc30fc4daa5c5d44b2c4c948db39ff0c76e9fd80bc373621bb8daded0da29fa18b64f7b6636a2ea9c0f4fe47871f2d8931250b602e0
SSDEEP 393216:ySiO33nWRq4q1bHqzekMosMGbZqzFRq4EJix33nII:viO33nWRqt1bwekfsTb+FRqZJix33nII
TLSH
T16F172315B79724EFCA168234187EA720FE6EDAA46245CB7B879CC27C3D72C6918C43D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\google.dll
Size 514KB
SHA256 ff12e8e95ddb948af9e288ccc3cabd58967b50d6a289d88f1f46ee8e3d169164
MD5 04e71caabc34de23657cc0e0df3c5ed6
SHA1 867798a8b60faf527ad568e4d9692f25a51035b8
SHA512 88b381f862661a916e47b26d634dae932e8438b5cc3de8c4d9c864950e1c96786f885b41a3c7b08b16cd71ea546b8c67fd1f2a39857315190060aef35b036d51
SSDEEP 6144:JKVC5dAQ71xOAczMjK+ZR4b/eC3FEexnHZ4OzU8vm0noOXKtzF2Yhp83y9gpvQOt:JW6CQh0AcqZC/eC3FE25F3AplSr
TLSH
T11CB40A19B75718DBCE158278197DE321FE7DDAA4A245CB67866C927C3C73C6A28C03C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdt.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
Size 18.0MB
SHA256 c43c56d35415430611d3f47089882cb3702ff6b80dc52279b3abeb72ea0934bb
MD5 7376ef18abd8d2e7f1c8a84b804ca6ad
SHA1 9646be905f0c3ff02b8004ffeb14713a740ce22d
SHA512 2f443af68bec4cd76381cf3635a1bbde1598ee3ac75818dcc06943e278b4dcf76b1ed725e52497a81e564d9ee976f064824234badfd3a53c9b188a7bd2c23464
SSDEEP 393216:ySiO33nWRq4q1bHqzekMosMGbZqzFRq4EJix33ni:viO33nWRqt1bwekfsTb+FRqZJix33ni
TLSH
T1C9172305B79724EFCA168234187EE720FE6EDAA46245CB7B8798C27D3D72C6918C43D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdt.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe
Size 2.1MB
SHA256 11de7669f0e8f29206dbe81b40b85aa9254a291a7eac76d006cab2d924657a1e
MD5 4e102b5e39a9ce0dbed15fc1ed322cdf
SHA1 5056a8ca52f9dbeb51c218f1b3c6bd3814d7bfb5
SHA512 534776b5c8e95ee31d41d9993a76575f5101d86bf95d85f2c8d4a5a1f0f0759cd667b97177bec53eb01264b3262586fff312e33f5f71aaee13898a5b736f09f9
SSDEEP 24576:e30k2fSEIYDCmxJmFQ7S8cHLG/IoxqSwWG25rZkoe8tqSlPOsr3tzJEBEIg3:e30kRRYDTv7SDoxiWGakr74Gsr1+B/m
TLSH
T102A5BF15A79711DFCB268234597DB331FD6EAAA46204CF7B9798C27C3D72C2A28C1391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/588-46-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/1364-37-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/1636-55-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/1972-12-0x00007FF661B70000-0x00007FF662CFC000-memory.dmp

Download

memory/2144-9-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/2288-15-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/2332-76-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/2380-4-0x00007FF661B70000-0x00007FF662CFC000-memory.dmp

Download

memory/2392-61-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/2848-31-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/2884-70-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/3164-73-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/3216-17-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/3328-24-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/3628-43-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/3756-64-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/3984-21-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/4512-27-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/4568-52-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/4604-49-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/4908-2-0x00007FF780FE0000-0x00007FF78216C000-memory.dmp

Download

memory/4908-6-0x00007FF780FE0000-0x00007FF78216C000-memory.dmp

Download

memory/4908-13-0x00007FF780FE0000-0x00007FF78216C000-memory.dmp

Download

memory/4908-5-0x00007FF780FE0000-0x00007FF78216C000-memory.dmp

Download

memory/5168-40-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/5296-18-0x00007FF786750000-0x00007FF7878DC000-memory.dmp

Download

memory/5872-67-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/5876-58-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download

memory/6104-34-0x00007FF60C040000-0x00007FF60D1CC000-memory.dmp

Download