| File name: | ChromeSetup (5).exe |
| Full analysis: | https://app.any.run/tasks/5fdc2965-eb97-4f96-a79b-44d61d109324 |
| Verdict: | Malicious activity |
| Analysis date: | October 23, 2024, 16:34:18 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections |
| MD5: | 622DAC213585829FCCDED2DD443642BA |
| SHA1: | B0DF9ED21A122EEFEE7E566B29BF8D4E8A7BCE69 |
| SHA256: | 080AC8173892B86A67E021BAEE0FEDF02EB7C39C1F747F73DCB71C28AA366D8B |
| SSDEEP: | 98304:sJOajhYAsUeyS0KTFnY1viV7azuAYy9gSPWAgVuyDztsyLFHJiePAZrPI5D+PeZF:FRcJoRZew3 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- ChromeSetup (5).exe (PID: 3912)
Application launched itself
- updater.exe (PID: 6964)
- updater.exe (PID: 7032)
- ChromeSetup (5).exe (PID: 3912)
- updater.exe (PID: 5264)
- setup.exe (PID: 7684)
- setup.exe (PID: 7888)
Executable content was dropped or overwritten
- updater.exe (PID: 7032)
- updater.exe (PID: 6964)
- 130.0.6723.69_chrome_installer.exe (PID: 7644)
- setup.exe (PID: 7684)
Executes as Windows Service
- updater.exe (PID: 5264)
- updater.exe (PID: 7032)
INFO
Process checks computer location settings
- ChromeSetup (5).exe (PID: 3912)
Checks supported languages
- ChromeSetup (5).exe (PID: 3912)
Reads the computer name
- ChromeSetup (5).exe (PID: 3912)
Manual execution by a user
- chrome.exe (PID: 7988)
Executes as Windows Service
- elevation_service.exe (PID: 6176)
Application launched itself
- chrome.exe (PID: 7988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:10:14 03:02:02+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 3359232 |
| InitializedDataSize: | 6839808 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1b6fd0 |
| OSVersion: | 10 |
| ImageVersion: | - |
| SubsystemVersion: | 10 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 131.0.6776.0 |
| ProductVersionNumber: | 131.0.6776.0 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Google LLC |
| FileDescription: | Google Installer |
| FileVersion: | 131.0.6776.0 |
| InternalName: | Google Installer(x86) |
| LegalCopyright: | Copyright 2024 Google LLC. All rights reserved. |
| OriginalFileName: | UpdaterSetup.exe |
| ProductName: | Google Installer |
| ProductVersion: | 131.0.6776.0 |
| CompanyShortName: | |
| ProductShortName: | GoogleUpdater |
| LastChange: | 9375f838d3d59edadc27380f48f0f1c166dc626b-refs/branch-heads/6776@{#1} |
| OfficialBuild: | 1 |
Total processes
155
Monitored processes
30
Malicious processes
0
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 864 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations=is-enterprise-managed=no --field-trial-handle=6268,i,6196711445005046290,17946843060422725274,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 130.0.6723.69 Modules
| |||||||||||||||
| 1732 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5076,i,6196711445005046290,17946843060422725274,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 130.0.6723.69 Modules
| |||||||||||||||
| 1752 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations=is-enterprise-managed=no --field-trial-handle=6540,i,6196711445005046290,17946843060422725274,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 130.0.6723.69 Modules
| |||||||||||||||
| 3028 | "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0xb66290,0xb6629c,0xb662a8 | C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe | — | updater.exe | |||||||||||
User: SYSTEM Company: Google LLC Integrity Level: SYSTEM Description: Google Updater Exit code: 0 Version: 131.0.6776.0 | |||||||||||||||
| 3700 | C:\WINDOWS\SystemTemp\Google5596_685463414\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0xbd6290,0xbd629c,0xbd62a8 | C:\Windows\SystemTemp\Google5596_685463414\bin\updater.exe | — | updater.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Updater Exit code: 0 Version: 131.0.6776.0 Modules
| |||||||||||||||
| 3912 | "C:\Users\admin\AppData\Local\Temp\ChromeSetup (5).exe" | C:\Users\admin\AppData\Local\Temp\ChromeSetup (5).exe | — | explorer.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 0 Version: 131.0.6776.0 Modules
| |||||||||||||||
| 4164 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,6196711445005046290,17946843060422725274,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 130.0.6723.69 Modules
| |||||||||||||||
| 5264 | "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --system --windows-service --service=update | C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe | services.exe | ||||||||||||
User: SYSTEM Company: Google LLC Integrity Level: SYSTEM Description: Google Updater Exit code: 0 Version: 131.0.6776.0 Modules
| |||||||||||||||
| 5596 | "C:\Users\admin\AppData\Local\Temp\ChromeSetup (5).exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={CE9F5415-EFC5-CF57-AA42-24ABC6974CD0}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2 --expect-elevated | C:\Users\admin\AppData\Local\Temp\ChromeSetup (5).exe | ChromeSetup (5).exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 131.0.6776.0 Modules
| |||||||||||||||
| 5824 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5276,i,6196711445005046290,17946843060422725274,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 130.0.6723.69 Modules
| |||||||||||||||
Total events
7 875
Read events
7 625
Write events
220
Delete events
30
Modification events
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | pv |
Value: 131.0.6776.0 | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | name |
Value: GoogleUpdater | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | pv |
Value: 131.0.6776.0 | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab} |
| Operation: | write | Name: | name |
Value: GoogleUpdater | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7405F538-1185-5D46-BDE0-8FD5C0DBFF39} |
| Operation: | write | Name: | AppID |
Value: {7405F538-1185-5D46-BDE0-8FD5C0DBFF39} | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7405F538-1185-5D46-BDE0-8FD5C0DBFF39} |
| Operation: | write | Name: | LocalService |
Value: GoogleUpdaterInternalService131.0.6776.0 | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7405F538-1185-5D46-BDE0-8FD5C0DBFF39} |
| Operation: | write | Name: | ServiceParameters |
Value: --com-service | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC1132BC-C84F-5D90-9BB6-3D44C6394B28}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC1132BC-C84F-5D90-9BB6-3D44C6394B28}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
| (PID) Process: | (6964) updater.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5BB0C40-8078-5D97-80DD-2C8F4510263D}\TypeLib |
| Operation: | write | Name: | Version |
Value: 1.0 | |||
Executable files
8
Suspicious files
91
Text files
41
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5596 | ChromeSetup (5).exe | C:\Windows\SystemTemp\Google5596_95572377\UPDATER.PACKED.7Z | — | |
MD5:— | SHA256:— | |||
| 6964 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat | binary | |
MD5:2E46F5C8A9FBBDD6AFDEF36CA215E409 | SHA256:2CD41C90A7F3D545E468A3386EC6805E1FB621962ED5C1A0E6C65474FEC7964C | |||
| 7032 | updater.exe | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe | executable | |
MD5:E2937E33C2554EECC37C804A7F99F8B7 | SHA256:5DDE29F028E75EE72F50902D20C41B699EF8FC5C294F04A321DEAC6909FFE409 | |||
| 7032 | updater.exe | C:\Windows\SystemTemp\Google7032_92764246\scoped_dir7032_1560684910\GoogleUpdate.exe | executable | |
MD5:3AA2C853D6BC7AF7F2F9B8A934943EFD | SHA256:07034876B9EC0B59432B96FEDB7E10E332440159F9802FAAD5F5B99F01885F6B | |||
| 7032 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF8c3f5.TMP | binary | |
MD5:4A2784F1CA879E8FBBD97E39D0DE3CC9 | SHA256:2BCD0A4051B1FA5B0444CEE9FD9F7341FAFE1EAE36659511926EBEFBA648DEE9 | |||
| 6964 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\prefs.json | binary | |
MD5:4A2784F1CA879E8FBBD97E39D0DE3CC9 | SHA256:2BCD0A4051B1FA5B0444CEE9FD9F7341FAFE1EAE36659511926EBEFBA648DEE9 | |||
| 5264 | updater.exe | C:\Windows\SystemTemp\chrome_url_fetcher_5264_358275214\-8a69d345-d564-463c-aff1-a69d9e530f96-_130.0.6723.69_all_adegkywnvp3gw7zhxvvctkfvgsqq.crx3 | — | |
MD5:— | SHA256:— | |||
| 5264 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\{8a69d345-d564-463c-aff1-a69d9e530f96}_1.ba9bf94b44dc701b13100bac95cce2b43c1f323c7057bfea244a0143be0dbcaf | — | |
MD5:— | SHA256:— | |||
| 5264 | updater.exe | C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5264_720628190\130.0.6723.69_chrome_installer.exe | — | |
MD5:— | SHA256:— | |||
| 6964 | updater.exe | C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe | executable | |
MD5:E2937E33C2554EECC37C804A7F99F8B7 | SHA256:5DDE29F028E75EE72F50902D20C41B699EF8FC5C294F04A321DEAC6909FFE409 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
57
DNS requests
50
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5488 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6964 | updater.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | unknown | — | — | whitelisted |
6964 | updater.exe | GET | 200 | 142.250.185.227:80 | http://c.pki.goog/r/r1.crl | unknown | — | — | whitelisted |
6964 | updater.exe | GET | 200 | 142.250.185.99:80 | http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDzySkSNBgXtBKLijHUmMxR | unknown | — | — | whitelisted |
4360 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
632 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5264 | updater.exe | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome/e6q2oobxv53l2yqsgdtrlz7ndu_130.0.6723.69/-8a69d345-d564-463c-aff1-a69d9e530f96-_130.0.6723.69_all_adegkywnvp3gw7zhxvvctkfvgsqq.crx3 | unknown | — | — | whitelisted |
7112 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
7496 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6944 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5488 | MoUsoCoreWorker.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5488 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5264 | updater.exe | 172.217.16.195:443 | update.googleapis.com | GOOGLE | US | whitelisted |
6964 | updater.exe | 142.250.186.78:443 | dl.google.com | GOOGLE | US | whitelisted |
6964 | updater.exe | 142.250.185.67:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
dl.google.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
c.pki.goog |
| whitelisted |
o.pki.goog |
| whitelisted |
edgedl.me.gvt1.com |
| whitelisted |