5442f15b86580dde0cd77778adfffe628d87c3988488a9d6b282dc93082c8967

Analysis

max time kernel
147s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
google.exe
Size 18.2MB
Sample260930-w9mkjsfd72
SHA256 5442f15b86580dde0cd77778adfffe628d87c3988488a9d6b282dc93082c8967
MD5 b859347ee884f34efba9a656798aa607
SHA1 3f82d256234980a3b5d6d35825bf0ac7848f10f6
SHA512 9a76b6f4b50ad75a57f47b4e0c50d5577097cc1c34a583bd05471b57f31caa7a03dec023f34e7d5c978280d7d064067b3f5a61092d068a2bff8fb961c97f48b4
SSDEEP 393216:mYLq5hi72X8A7H5t9s7Uvk3g5t9s7UvE3Z847ji7V1Ln5u5F9uU:o7i72sA7H5tCJQ5tCBS47ji7VFI5FgU
TLSH
T13F172305F79755CBCA158274287DA331FD2DEAA87241CF6B87D8867D3D62C2A28C43D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
1272	chrome140.exe
5768	gupdt.exe
4976	gupw.exe
6044	chrome140.exe
4840	gupdt.exe
4248	gupdt.exe
5640	gupdt.exe
952	gupdt.exe
1088	gupdt.exe
1648	gupdt.exe
4148	gupdt.exe
2732	gupdt.exe
5212	gupdt.exe
1256	gupdt.exe
2188	gupdt.exe
4144	gupdt.exe
1380	gupdt.exe
4772	gupdt.exe
4468	gupdt.exe
4320	gupdt.exe
4600	gupdt.exe
3556	gupdt.exe
4632	gupdt.exe
4984	gupdt.exe
1028	gupdt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate140 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\18r3uuv2rg\\chrome140.exe\" /user"	google.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3408	powercfg.exe
4676	powercfg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3520	google.exe
3520	google.exe
3520	google.exe
3520	google.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe
4976	gupw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3408	powercfg.exe
Token: SeCreatePagefilePrivilege	3408	powercfg.exe
Token: SeShutdownPrivilege	4676	powercfg.exe
Token: SeCreatePagefilePrivilege	4676	powercfg.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 3408	3520	google.exe	93
PID 3520 wrote to memory of 4676	3520	google.exe	95
PID 3520 wrote to memory of 5768	3520	google.exe	97
PID 3520 wrote to memory of 4976	3520	google.exe	98
PID 4976 wrote to memory of 4840	4976	gupw.exe	101
PID 4976 wrote to memory of 4248	4976	gupw.exe	102
PID 4976 wrote to memory of 5640	4976	gupw.exe	103
PID 4976 wrote to memory of 952	4976	gupw.exe	104
PID 4976 wrote to memory of 1088	4976	gupw.exe	105
PID 4976 wrote to memory of 1648	4976	gupw.exe	106
PID 4976 wrote to memory of 4148	4976	gupw.exe	107
PID 4976 wrote to memory of 2732	4976	gupw.exe	108
PID 4976 wrote to memory of 5212	4976	gupw.exe	109
PID 4976 wrote to memory of 1256	4976	gupw.exe	110
PID 4976 wrote to memory of 2188	4976	gupw.exe	111
PID 4976 wrote to memory of 4144	4976	gupw.exe	112
PID 4976 wrote to memory of 1380	4976	gupw.exe	113
PID 4976 wrote to memory of 4772	4976	gupw.exe	114
PID 4976 wrote to memory of 4468	4976	gupw.exe	115
PID 4976 wrote to memory of 4320	4976	gupw.exe	116
PID 4976 wrote to memory of 4600	4976	gupw.exe	117
PID 4976 wrote to memory of 3556	4976	gupw.exe	118
PID 4976 wrote to memory of 4632	4976	gupw.exe	119
PID 4976 wrote to memory of 4984	4976	gupw.exe	120
PID 4976 wrote to memory of 1028	4976	gupw.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\google.exe
"C:\Users\Admin\AppData\Local\Temp\google.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-ac 0 monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3408
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-dc 0 monitor-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
  2⤵
  - Executes dropped EXE
  PID:5768
- C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupw.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupw.exe /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4840
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4248
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5640
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1088
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1648
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4148
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2732
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:5212
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1256
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:2188
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4144
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1380
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4772
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4468
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4320
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4600
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:3556
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4632
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:4984
- - C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\gupdt.exe
    3⤵
    - Executes dropped EXE
    PID:1028

C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\chrome140.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\chrome140.exe" /user
1⤵
- Executes dropped EXE
PID:1272

C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\chrome140.exe
C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\chrome140.exe
1⤵
- Executes dropped EXE
PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome140.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\chrome140.exe
Size 18.2MB
SHA256 5442f15b86580dde0cd77778adfffe628d87c3988488a9d6b282dc93082c8967
MD5 b859347ee884f34efba9a656798aa607
SHA1 3f82d256234980a3b5d6d35825bf0ac7848f10f6
SHA512 9a76b6f4b50ad75a57f47b4e0c50d5577097cc1c34a583bd05471b57f31caa7a03dec023f34e7d5c978280d7d064067b3f5a61092d068a2bff8fb961c97f48b4
SSDEEP 393216:mYLq5hi72X8A7H5t9s7Uvk3g5t9s7UvE3Z847ji7V1Ln5u5F9uU:o7i72sA7H5tCJQ5tCBS47ji7VFI5FgU
TLSH
T13F172305F79755CBCA158274287DA331FD2DEAA87241CF6B87D8867D3D62C2A28C43D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\18r3uuv2rg\google.dll
Size 434KB
SHA256 94982172fc9ca06620ed0002fba8c976d1a3ec663ee761ef2b44a3639ce75e4c
MD5 d722ed203ebaeb0034ef0d2eca9d659b
SHA1 89cff9b252f1ba9931e4fee74a5ecfd34f805b76
SHA512 3a090c706133e4cb86da4f2b305ec62dbc5dad91a1cb0c16b6c712f5d95a638c9f6ba48385053e3a8ba042d32ac6dde9563d895d4b4d4f0dabffa5ef75c8f5c3
SSDEEP 6144:LHdEfCVrO6bmQHjz33l1+AH7SpTxJuSfUEOKUIC6EEEO4eSrbzRpxNa7TnSr:REfCdzH31tbS9xucSr
TLSH
T1F094E819F75719CFCE168278197DA321FE7DDAE8A245CB67869C827C2C63C6A14C03D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-25-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/1028-75-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/1088-27-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/1256-43-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/1272-4-0x00007FF63CBC0000-0x00007FF63DD02000-memory.dmp

Download

memory/1380-51-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/1648-31-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/2188-45-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/2732-37-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/3520-11-0x00007FF7FB6A0000-0x00007FF7FC7E2000-memory.dmp

Download

memory/3520-5-0x00007FF7FB6A0000-0x00007FF7FC7E2000-memory.dmp

Download

memory/3520-6-0x00007FF7FB6A0000-0x00007FF7FC7E2000-memory.dmp

Download

memory/3520-2-0x00007FF7FB6A0000-0x00007FF7FC7E2000-memory.dmp

Download

memory/3556-67-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4144-49-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4148-33-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4248-19-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4320-61-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4468-57-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4600-63-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4632-69-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4772-55-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4840-15-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/4976-17-0x00007FF7A1360000-0x00007FF7A24A2000-memory.dmp

Download

memory/4984-73-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/5212-39-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/5640-21-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/5768-9-0x00007FF702480000-0x00007FF7035C2000-memory.dmp

Download

memory/6044-13-0x00007FF63CBC0000-0x00007FF63DD02000-memory.dmp

Download