30c8e1a601a73a6ad520431797be88e65483983eda23af10d8210ce0c77216e2

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
google.exe
Size 17.3MB
Sample260930-plj17afb72
SHA256 30c8e1a601a73a6ad520431797be88e65483983eda23af10d8210ce0c77216e2
MD5 c7894dfa5288b360210ff72555b4cc5c
SHA1 3b1ad8f8c224fd7d4b32b33c77e330ee9220f095
SHA512 88c08a87a3fce32393dd726eb50fe6f50d89418b6c7ea30169460fbb8fb72d5c4673d10f97ee19cf14e83b3e11a5efc6afed2936f346f6445c169d72c9b699c7
SSDEEP 196608:sW5dppq4ul2/8Dw2wXmKP1SicUppqU4Rbm1l/QNbmvl/+icfppqU4iXmKPan5dp3:sgWfeFNSicGhpYiczLSDW9ep
TLSH
T14507330663435CCEC2258670A3A8F731F83CBA594951CE3FA6D0C53D1D72EA96D9A3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 32 IoCs

pid	Process
1232	gupdt.exe
5452	gupw.exe
2656	chrome140.exe
2764	chrome140.exe
1596	gupdt.exe
4380	gupdt.exe
4640	gupdt.exe
2192	gupdt.exe
1716	gupdt.exe
1084	gupdt.exe
976	gupdt.exe
5636	gupdt.exe
4284	gupdt.exe
5736	gupdt.exe
5896	gupdt.exe
3448	gupdt.exe
2188	gupdt.exe
3640	gupdt.exe
1096	gupdt.exe
3752	gupdt.exe
4732	gupdt.exe
3392	gupdt.exe
5792	gupdt.exe
2332	gupdt.exe
5940	gupdt.exe
4272	gupdt.exe
5892	gupdt.exe
5060	gupdt.exe
1064	gupdt.exe
2732	gupdt.exe
4540	gupdt.exe
4000	gupdt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate140 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\9pa6f4oyaw\\chrome140.exe\" /user"	google.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4572	powercfg.exe
4236	powercfg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5884	google.exe
5884	google.exe
5884	google.exe
5884	google.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe
5452	gupw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4572	powercfg.exe
Token: SeCreatePagefilePrivilege	4572	powercfg.exe
Token: SeShutdownPrivilege	4236	powercfg.exe
Token: SeCreatePagefilePrivilege	4236	powercfg.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5884 wrote to memory of 4572	5884	google.exe	89
PID 5884 wrote to memory of 4236	5884	google.exe	91
PID 5884 wrote to memory of 1232	5884	google.exe	95
PID 5884 wrote to memory of 5452	5884	google.exe	96
PID 5452 wrote to memory of 1596	5452	gupw.exe	99
PID 5452 wrote to memory of 4380	5452	gupw.exe	100
PID 5452 wrote to memory of 4640	5452	gupw.exe	101
PID 5452 wrote to memory of 2192	5452	gupw.exe	102
PID 5452 wrote to memory of 1716	5452	gupw.exe	104
PID 5452 wrote to memory of 1084	5452	gupw.exe	105
PID 5452 wrote to memory of 976	5452	gupw.exe	106
PID 5452 wrote to memory of 5636	5452	gupw.exe	107
PID 5452 wrote to memory of 4284	5452	gupw.exe	108
PID 5452 wrote to memory of 5736	5452	gupw.exe	109
PID 5452 wrote to memory of 5896	5452	gupw.exe	110
PID 5452 wrote to memory of 3448	5452	gupw.exe	111
PID 5452 wrote to memory of 2188	5452	gupw.exe	112
PID 5452 wrote to memory of 3640	5452	gupw.exe	113
PID 5452 wrote to memory of 1096	5452	gupw.exe	114
PID 5452 wrote to memory of 3752	5452	gupw.exe	115
PID 5452 wrote to memory of 4732	5452	gupw.exe	116
PID 5452 wrote to memory of 3392	5452	gupw.exe	117
PID 5452 wrote to memory of 5792	5452	gupw.exe	118
PID 5452 wrote to memory of 2332	5452	gupw.exe	119
PID 5452 wrote to memory of 5940	5452	gupw.exe	120
PID 5452 wrote to memory of 4272	5452	gupw.exe	121
PID 5452 wrote to memory of 5892	5452	gupw.exe	122
PID 5452 wrote to memory of 5060	5452	gupw.exe	123
PID 5452 wrote to memory of 1064	5452	gupw.exe	124
PID 5452 wrote to memory of 2732	5452	gupw.exe	125
PID 5452 wrote to memory of 4540	5452	gupw.exe	126
PID 5452 wrote to memory of 4000	5452	gupw.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\google.exe
"C:\Users\Admin\AppData\Local\Temp\google.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupw.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupw.exe /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1596
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4380
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4640
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2192
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1716
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1084
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:976
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5636
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4284
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5736
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5896
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3448
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2188
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3640
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1096
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3752
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4732
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3392
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5792
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2332
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5940
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4272
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5892
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5060
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1064
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2732
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4540
- - C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4000

C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exe" /user
1⤵
- Executes dropped EXE
PID:2656

C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exe
C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\chrome140.exe
1⤵
- Executes dropped EXE
PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

google.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\google.dll
Size 195KB
SHA256 7032850803c0b09a4bcede7977a045cabc5decb216a4a9286ff9127dcb5f28bb
MD5 c4d8441448fd39763faf0a1624b3f8ea
SHA1 59743655c19333652a6b3dc1164e8cb8c306007a
SHA512 a2ceffb7843d9a473e595b382298a9f829eea5f375695f3a312958a8f1d4b7e8d56509c5af7e60fbe9d8186cc90502905bcdff82d943108ee875ffd8ab9c38ea
SSDEEP 768:ReGHy5xQxfgGIs1WYyt6+jTh1MYBfOJESiP:ReWyg8tP
TLSH
T10914F8D43E958CD7ED60623862EAC2313E38F5E04B538757A53066310E23BE16FE9696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdt.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
Size 17.3MB
SHA256 30c8e1a601a73a6ad520431797be88e65483983eda23af10d8210ce0c77216e2
MD5 c7894dfa5288b360210ff72555b4cc5c
SHA1 3b1ad8f8c224fd7d4b32b33c77e330ee9220f095
SHA512 88c08a87a3fce32393dd726eb50fe6f50d89418b6c7ea30169460fbb8fb72d5c4673d10f97ee19cf14e83b3e11a5efc6afed2936f346f6445c169d72c9b699c7
SSDEEP 196608:sW5dppq4ul2/8Dw2wXmKP1SicUppqU4Rbm1l/QNbmvl/+icfppqU4iXmKPan5dp3:sgWfeFNSicGhpYiczLSDW9ep
TLSH
T14507330663435CCEC2258670A3A8F731F83CBA594951CE3FA6D0C53D1D72EA96D9A3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdt.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\9pa6f4oyaw\gupdt.exe
Size 10.1MB
SHA256 fd49d8a84bb367e4cd1386f734d035752b6703d768d0b9a23e5266a2d987284b
MD5 01b9faf96fde9cb0320f6ecef7e9a9ff
SHA1 a0bfafc204036a575bd7fc0b0b59da404f92edc3
SHA512 01b094165cb608c828dc1f741af42ddec0a1eb0060104637ce89f27579f88a1b94770421413b941aeda9a257ed194a94daecc1acbc025b73ea779c13f58c5652
SSDEEP 196608:sW5dppq4ul2/8Dw2wXmKP1SicUppqU4Rbm1l/QNbmvU:sgWfeFNSicGhpU
TLSH
T1A8B6330663835CDEC216C67092A8E331FC7DB9545A519F3FA6D0C53C2D32EA568DA3E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-30-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/1064-84-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/1084-27-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/1096-54-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/1232-4-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/1596-12-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/1716-24-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/2188-48-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/2192-21-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/2332-69-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/2656-8-0x00007FF60CD60000-0x00007FF60DDBA000-memory.dmp

Download

memory/2732-87-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/2764-9-0x00007FF60CD60000-0x00007FF60DDBA000-memory.dmp

Download

memory/3392-63-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/3448-45-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/3640-51-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/3752-57-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/4000-93-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/4272-75-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/4284-36-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/4380-15-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/4540-90-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/4640-18-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/4732-60-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/5060-81-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/5452-13-0x00007FF75AF20000-0x00007FF75BF7A000-memory.dmp

Download

memory/5636-33-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/5736-39-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/5792-66-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/5884-10-0x00007FF714B30000-0x00007FF715B8A000-memory.dmp

Download

memory/5892-78-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/5896-42-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download

memory/5940-72-0x00007FF7A1090000-0x00007FF7A20EA000-memory.dmp

Download