Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 05:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target file.exe
- Size 25.9MB
- Sample261022-gpvyvscy4q
- SHA256 e616c3309a5be564c4e167e720c9abbe8475e414545a02924ef03549a4aecc91
- MD5 3495f7dbc6851090797d48d32cd5cfc9
- SHA1 66493cca88965248f92fdb9bb2c1584c75b30e88
- SHA512 e8bd1a9681908d77f5d41c49f4a7b23ab7f9b14ac3d95866aeacbdad1446f17fe019b32864fa408921ff9148c8ff6e6086f1930641267e5798c83a47221caf67
- SSDEEP 393216:XEvdNfeXZFJV9xgtBFgDcFCeOruS04SHF/Cd5+:UmFLQFKrNqSva/Cd0
- TLSH T10C57AF51F30B05F6FB434C3649F9AB2F7B39E2DC8974C556E428242ABAA3C1B45DC291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1812 GoogleChromeSyncService.exe 4432 ChromeSessionRunner.exe 4124 ChromeTaskChecker.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdateCore32 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\ckkd1ejj91\\GoogleChromeSyncService.exe\" /user" file.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4164 file.exe 4164 file.exe 4164 file.exe 4164 file.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4164 wrote to memory of 4432 4164 file.exe 93 PID 4164 wrote to memory of 4124 4164 file.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\ChromeSessionRunner.exe"C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\ChromeSessionRunner.exe"2⤵
- Executes dropped EXE
PID:4432
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\ChromeTaskChecker.exe"C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\ChromeTaskChecker.exe" /watchu2⤵
- Executes dropped EXE
PID:4124
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\GoogleChromeSyncService.exe"C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\GoogleChromeSyncService.exe" /user1⤵
- Executes dropped EXE
PID:1812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\ChromeTaskChecker.exe
- Size 21.5MB
- SHA256 83a4bbc274e35a66834b78bf1ed8347fb1be89435dc3528534889fb1722fac22
- MD5 26ea0220923529f67cf5da00261e6386
- SHA1 d320d448f18398d78cae0abb50d7d3f11ca6c789
- SHA512 a9c76618b38ae4eb5240d0562aaa3697a8b0f362e85f47ecd39d987f71f59a654203341a2fc625acfb7dd379670b5cd0e832b3eb2793df1ec736076a1df0ccea
- SSDEEP 196608:7GErESk2IdN+6PeXZF35Vt65qHxertL1yWcTDcFCeOruF7YrIc:XEvdNfeXZFJV9xgtBFgDcFCeOruSJ
- TLSH T153379F51F30B05F6FB434C3649F9AB2F7B39E2DC8974C556E428242ABAA3C1B45DC291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\GoogleChromeSyncService.exe
- Size 25.9MB
- SHA256 e616c3309a5be564c4e167e720c9abbe8475e414545a02924ef03549a4aecc91
- MD5 3495f7dbc6851090797d48d32cd5cfc9
- SHA1 66493cca88965248f92fdb9bb2c1584c75b30e88
- SHA512 e8bd1a9681908d77f5d41c49f4a7b23ab7f9b14ac3d95866aeacbdad1446f17fe019b32864fa408921ff9148c8ff6e6086f1930641267e5798c83a47221caf67
- SSDEEP 393216:XEvdNfeXZFJV9xgtBFgDcFCeOruS04SHF/Cd5+:UmFLQFKrNqSva/Cd0
- TLSH T10C57AF51F30B05F6FB434C3649F9AB2F7B39E2DC8974C556E428242ABAA3C1B45DC291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\ckkd1ejj91\chrmapp.dll
- Size 2.1MB
- SHA256 c60cee9703cfcba9c24be56bb3e2e53984e83dea6d74371bedab7ecb76c74647
- MD5 59e372d4da9fe6906b9733ab11af973f
- SHA1 ee5b30bceba5c240191d46c502a04298cb093d65
- SHA512 9981a3f090aa6b27e433e2f4df8c02d98840c6556792d502faddadff0b37b324c815700eabe13e46da4bfcba4c2a2d781ca3e08889120ed19d7dc39811576f93
- SSDEEP 24576:HecMTJ4dt43RNtg13Fyh0HapytixlCApd0VVcAQ:HzNxza3Xr07cAQ
- TLSH T196A5D505F35715CFEF5541B06DBDA712EA9DCBA4A18CCA379A5C827D3CB2C2E1884392
- MD5 SHA1 SHA512 SSDEEP TLSH