| File name: | ChromeSetup.exe |
| Full analysis: | https://app.any.run/tasks/b62ee37c-df56-419e-8dce-1e6b08a39010 |
| Verdict: | Malicious activity |
| Analysis date: | July 05, 2024, 10:56:51 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 85F1A3E3524388443A338684E033D698 |
| SHA1: | 4C915DDDE3DCE4D82A6514B29A79858C5F812D9B |
| SHA256: | 06B4FEEC69D9106FD70955442BB80285DB107784BAD2354F2BC8C860043D08AB |
| SSDEEP: | 98304:t4BYczm130D5Lj/hIRhDIJMm6H5C2mONi01c0f6OJKByb+Tvdeu3KRZt8JqBa0cL:/C51 |
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:05:20 03:05:15+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 2784256 |
| InitializedDataSize: | 5907968 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13da10 |
| OSVersion: | 10 |
| ImageVersion: | - |
| SubsystemVersion: | 10 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 127.0.6490.0 |
| ProductVersionNumber: | 127.0.6490.0 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Google LLC |
| FileDescription: | Google Chrome Installer |
| FileVersion: | 127.0.6490.0 |
| InternalName: | Google Chrome |
| LegalCopyright: | Copyright 2024 Google LLC. All rights reserved. |
| ProductName: | Google Chrome Installer |
| ProductVersion: | 127.0.6490.0 |
| CompanyShortName: | |
| ProductShortName: | Chrome Installer |
| LastChange: | b56e2a5f8b86a55dbfbd13c1533cad9914c69c06-refs/branch-heads/6490@{#1} |
| OfficialBuild: | 1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6164 | "C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe" | C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe | — | explorer.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Installer Version: 127.0.6490.0 Modules
| |||||||||||||||
| 6260 | "C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={600EB9AE-9340-02D8-4E0D-B840BA120D86}&lang=en-GB&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=VDKB&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2 --expect-elevated | C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe | ChromeSetup.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Chrome Installer Version: 127.0.6490.0 Modules
| |||||||||||||||
| 6296 | "C:\WINDOWS\SystemTemp\Google6260_654525618\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={600EB9AE-9340-02D8-4E0D-B840BA120D86}&lang=en-GB&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=VDKB&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2 --expect-elevated | C:\Windows\SystemTemp\Google6260_654525618\bin\updater.exe | ChromeSetup.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: GoogleUpdater (x86) Version: 127.0.6490.0 Modules
| |||||||||||||||
| 6316 | C:\WINDOWS\SystemTemp\Google6260_654525618\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x55758c,0x557598,0x5575a4 | C:\Windows\SystemTemp\Google6260_654525618\bin\updater.exe | — | updater.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: GoogleUpdater (x86) Version: 127.0.6490.0 Modules
| |||||||||||||||
| 6420 | "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update-internal | C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe | services.exe | ||||||||||||
User: SYSTEM Company: Google LLC Integrity Level: SYSTEM Description: GoogleUpdater (x86) Exit code: 0 Version: 127.0.6490.0 Modules
| |||||||||||||||
| 6440 | "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7f758c,0x7f7598,0x7f75a4 | C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe | — | updater.exe | |||||||||||
User: SYSTEM Company: Google LLC Integrity Level: SYSTEM Description: GoogleUpdater (x86) Exit code: 0 Version: 127.0.6490.0 Modules
| |||||||||||||||
| 6532 | "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update | C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe | services.exe | ||||||||||||
User: SYSTEM Company: Google LLC Integrity Level: SYSTEM Description: GoogleUpdater (x86) Version: 127.0.6490.0 Modules
| |||||||||||||||
| 6552 | "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7f758c,0x7f7598,0x7f75a4 | C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe | — | updater.exe | |||||||||||
User: SYSTEM Company: Google LLC Integrity Level: SYSTEM Description: GoogleUpdater (x86) Version: 127.0.6490.0 Modules
| |||||||||||||||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | pv |
Value: 127.0.6490.0 | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | name |
Value: GoogleUpdater | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | pv |
Value: 127.0.6490.0 | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | name |
Value: GoogleUpdater | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7AA668AD-44C9-562C-B3B0-104376A71AFE} |
| Operation: | write | Name: | AppID |
Value: {7AA668AD-44C9-562C-B3B0-104376A71AFE} | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7AA668AD-44C9-562C-B3B0-104376A71AFE} |
| Operation: | write | Name: | LocalService |
Value: GoogleUpdaterInternalService127.0.6490.0 | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7AA668AD-44C9-562C-B3B0-104376A71AFE} |
| Operation: | write | Name: | ServiceParameters |
Value: --com-service | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF978A78-4301-5160-9D81-9DA6EED2B58F}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF978A78-4301-5160-9D81-9DA6EED2B58F}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (6296) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4168B26-4DAC-5948-8F80-84C2235AD469}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6260 | ChromeSetup.exe | C:\WINDOWS\SystemTemp\Google6260_1850420417\UPDATER.PACKED.7Z | — | |
MD5:— | SHA256:— | |||
| 6296 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\updater.log | text | |
MD5:DD5F9094932C11E720326441C463421E | SHA256:EA9B5ACE2A9B0C7E961F13F83B64706DDCE453DC1E6C4A787DC7525E2D9738C1 | |||
| 6420 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\6d8ae55f-269d-406c-bf5c-3c3076e94f46.tmp | binary | |
MD5:A044B322619899F8AF9AD37DBE4658AA | SHA256:293ABA71A0A14A48C2CAF28073BD802933CFB123F853CB31F7AA8A196E650028 | |||
| 6296 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat | binary | |
MD5:F13CD6A2D925EBA7BB37DFF32C2BA348 | SHA256:1D74C99357383E67F4BCD510753AC95B6D58E38AB02C057C7D627A7B22BBE58C | |||
| 6532 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\prefs.json | binary | |
MD5:7547D012994AFD51247AF2EFA37C8E10 | SHA256:7030DA3EB73EB2B3DC3ECE80580487FDCA62AB5CCFED584606455FA4FB1F4454 | |||
| 6420 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\aa24cd9f-65b0-4a75-aac4-67c5298ebd72.tmp | binary | |
MD5:AA2D0C0C72BB528CF4168EA91C1C9A56 | SHA256:E03E9D262CA3B7D19E37C3A69C7D8B46BD3F5542AA555A17D864071C28257B2C | |||
| 6532 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF1d2444.TMP | binary | |
MD5:A044B322619899F8AF9AD37DBE4658AA | SHA256:293ABA71A0A14A48C2CAF28073BD802933CFB123F853CB31F7AA8A196E650028 | |||
| 6296 | updater.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:B4674EB3547D71AA617A6C3CDA73D39E | SHA256:CA30CE27514F9CBEC12556AB31A7D285812459E83E212B121A0C652732B71C61 | |||
| 6420 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\prefs.json | binary | |
MD5:AA2D0C0C72BB528CF4168EA91C1C9A56 | SHA256:E03E9D262CA3B7D19E37C3A69C7D8B46BD3F5542AA555A17D864071C28257B2C | |||
| 6420 | updater.exe | C:\Windows\SystemTemp\Google6420_569534052\scoped_dir6420_615144429\GoogleUpdate.exe | executable | |
MD5:3AA2C853D6BC7AF7F2F9B8A934943EFD | SHA256:07034876B9EC0B59432B96FEDB7E10E332440159F9802FAAD5F5B99F01885F6B | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2340 | MoUsoCoreWorker.exe | GET | 200 | 23.58.217.29:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
1888 | svchost.exe | GET | 200 | 23.58.217.29:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
6296 | updater.exe | GET | 200 | 142.250.185.131:80 | http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCRq%2FXldMamzQqGAD6YrjKf | unknown | — | — | unknown |
6532 | updater.exe | GET | — | 216.58.206.78:80 | http://dl.google.com/release2/chrome/jcs2etny43kupyauxqlnc3ytci_126.0.6478.127/-8a69d345-d564-463c-aff1-a69d9e530f96-_126.0.6478.127_all_kqgvyxebv4r63jac66435t45xq.crx3 | unknown | — | — | unknown |
6296 | updater.exe | GET | 200 | 142.250.185.67:80 | http://c.pki.goog/r/r1.crl | unknown | — | — | unknown |
6532 | updater.exe | GET | 403 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome/jcs2etny43kupyauxqlnc3ytci_126.0.6478.127/-8a69d345-d564-463c-aff1-a69d9e530f96-_126.0.6478.127_all_kqgvyxebv4r63jac66435t45xq.crx3 | unknown | — | — | unknown |
2272 | RUXIMICS.exe | GET | 200 | 23.58.217.29:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
6296 | updater.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2340 | MoUsoCoreWorker.exe | 23.58.217.29:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4032 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1888 | svchost.exe | 23.58.217.29:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
2272 | RUXIMICS.exe | 23.58.217.29:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
2340 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6532 | updater.exe | 142.250.186.99:443 | update.googleapis.com | GOOGLE | US | whitelisted |
6296 | updater.exe | 216.58.206.78:443 | dl.google.com | GOOGLE | US | whitelisted |
1888 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6004 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
dl.google.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
c.pki.goog |
| unknown |
o.pki.goog |
| unknown |
edgedl.me.gvt1.com |
| whitelisted |