Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 12:24
General
- Target google.exe
- Size 17.3MB
- Sample260930-plj17afb72
- SHA256 30c8e1a601a73a6ad520431797be88e65483983eda23af10d8210ce0c77216e2
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\google.exe"C:\Users\Admin\AppData\Local\Temp\google.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exeC:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupw.exeC:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupw.exe /watchu2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exe"C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exe" /user1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exeC:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome140.exe
google.dll
memory/1072-19-0x000002F1C09E0000-0x000002F1C0A00000-memory.dmp
memory/1072-23-0x00007FF664FB0000-0x00007FF66600A000-memory.dmp
memory/1820-10-0x00007FF7E54A0000-0x00007FF7E64FA000-memory.dmp
memory/3848-20-0x00007FF63B6A0000-0x00007FF63C6FA000-memory.dmp
memory/4420-22-0x00007FF7E54A0000-0x00007FF7E64FA000-memory.dmp
memory/4588-24-0x00007FF7E6990000-0x00007FF7E79EA000-memory.dmp