30e727c0414d4b8d1f7b40a63a1371fcee246ac8c9eb32c3840e25bf63cf3497

Analysis

max time kernel
151s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 23.0MB
Sample261022-eel7vshx3w
SHA256 30e727c0414d4b8d1f7b40a63a1371fcee246ac8c9eb32c3840e25bf63cf3497
MD5 d28822bd4af65ab16644f344e5364caa
SHA1 76ef729c26b0ac6c2526564363a2f9a7533de2a6
SHA512 db95946d6c4f2aa09732c7b3bf1fdc6ef22a6c6152550630cfd23778ce004e9c821c036719e8e70c1153736170ad6f454d599e99127789b918f0ece04d7f4573
SSDEEP 393216:ZtqebMt8kv7lfy+R6YSu12tVlgF3vflfGWfhzh:ZtDMt8YBymZSui8F3Z15t
TLSH
T170379F91B70B05F2FA475C3785F6AB2F7B36E6DC8D70C559E8243816B6A2C0B86DC190
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
1736	GoogleWebServices.exe
2796	ChromeAppProcess.exe
2460	GoogleTaskChecker.exe
4796	ChromeAppProcess.exe
2532	ChromeAppProcess.exe
2172	ChromeAppProcess.exe
5584	ChromeAppProcess.exe
5100	ChromeAppProcess.exe
1456	ChromeAppProcess.exe
1028	ChromeAppProcess.exe
1612	ChromeAppProcess.exe
5640	ChromeAppProcess.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\ho7x1zk38n\\GoogleWebServices.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2908	file.exe
2908	file.exe
2908	file.exe
2908	file.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe
2460	GoogleTaskChecker.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2796	2908	file.exe	93
PID 2908 wrote to memory of 2460	2908	file.exe	94
PID 2460 wrote to memory of 4796	2460	GoogleTaskChecker.exe	95
PID 2460 wrote to memory of 2532	2460	GoogleTaskChecker.exe	96
PID 2460 wrote to memory of 2172	2460	GoogleTaskChecker.exe	97
PID 2460 wrote to memory of 5584	2460	GoogleTaskChecker.exe	98
PID 2460 wrote to memory of 5100	2460	GoogleTaskChecker.exe	99
PID 2460 wrote to memory of 1456	2460	GoogleTaskChecker.exe	100
PID 2460 wrote to memory of 1028	2460	GoogleTaskChecker.exe	101
PID 2460 wrote to memory of 1612	2460	GoogleTaskChecker.exe	102
PID 2460 wrote to memory of 5640	2460	GoogleTaskChecker.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\GoogleTaskChecker.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\GoogleTaskChecker.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:4796
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2532
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2172
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:5584
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:5100
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:1456
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:1028
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:1612
- - C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:5640

C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\GoogleWebServices.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\GoogleWebServices.exe" /user
1⤵
- Executes dropped EXE
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeAppProcess.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\ChromeAppProcess.exe
Size 1.1MB
SHA256 3caf2fbf01e0a17a59bd341bdbcc2f093c1e92280fa01b0485eaea46d3d2864a
MD5 e3c735f091642673b8c0e6b80c78da16
SHA1 69720a396b8366d42357792de013f42d78aea969
SHA512 9b9cc7cf7e439c61a89895a0c4c9cc028f21412cb20bd3a74dcf755d8407dc582e52a38b1aa36bf28b69a810a225451a1fb49e5b85394f44718e3092c5af7ebd
SSDEEP 6144:VnYxr89LVo6tCxGgx7Kh839+D5bwJe95veItZay2q6P/vjO6nhJB+D:ZT5o6tW8YSbWe7vltZYvP/vjOUhJBs
TLSH
T15B452AD1B60F19F1BA479C3745F6A92F7B36E1DC8DB0C499F8253857E3A280782AC191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleWebServices.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\GoogleWebServices.exe
Size 23.0MB
SHA256 30e727c0414d4b8d1f7b40a63a1371fcee246ac8c9eb32c3840e25bf63cf3497
MD5 d28822bd4af65ab16644f344e5364caa
SHA1 76ef729c26b0ac6c2526564363a2f9a7533de2a6
SHA512 db95946d6c4f2aa09732c7b3bf1fdc6ef22a6c6152550630cfd23778ce004e9c821c036719e8e70c1153736170ad6f454d599e99127789b918f0ece04d7f4573
SSDEEP 393216:ZtqebMt8kv7lfy+R6YSu12tVlgF3vflfGWfhzh:ZtDMt8YBymZSui8F3Z15t
TLSH
T170379F91B70B05F2FA475C3785F6AB2F7B36E6DC8D70C559E8243816B6A2C0B86DC190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrometask.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\ho7x1zk38n\chrometask.dll
Size 908KB
SHA256 e3bc5f953259ae9be9123bf3f6c22efdbf9644c1b0cfca18b1065cb735e36a17
MD5 df9b684eeef22f02b30909b820c16709
SHA1 94794b32683bf57d346bcbcb7428a87399a53d84
SHA512 537861593e66a76be054322282de4e06520812deb59ecfbd0738227946c658c38f2e6631d911d3eefb9042ea3647fe48e6ea763256b621910b06fbdc992fc6b2
SSDEEP 12288:vLPr3vnytVFOL6KGdqhwPkVo+dAtcRm0UdTrGdXWAQ:DPDatYhHuPeAORmJdTidXWAQ
TLSH
T1CD150605F71719CBEF6541746DBDB321EA6EDBA46188CB739A5C823D3CB2C2E5881381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-38-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/1456-35-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/1612-41-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/1736-5-0x00007FF7B1140000-0x00007FF7B27ED000-memory.dmp

Download

memory/2172-25-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/2460-23-0x00007FF6AAF90000-0x00007FF6AC63D000-memory.dmp

Download

memory/2532-22-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/2796-16-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/2908-2-0x00007FF793490000-0x00007FF794B3D000-memory.dmp

Download

memory/2908-19-0x00007FF793490000-0x00007FF794B3D000-memory.dmp

Download

memory/2908-7-0x00007FF793490000-0x00007FF794B3D000-memory.dmp

Download

memory/2908-6-0x00007FF793490000-0x00007FF794B3D000-memory.dmp

Download

memory/4796-20-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/5100-31-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download

memory/5584-29-0x00007FF799B30000-0x00007FF79B1DD000-memory.dmp

Download