| File name: | Install-GooglePlayGames-Beta.exe |
| Full analysis: | https://app.any.run/tasks/e69b988c-c92f-4f11-bf35-75843d30cd48 |
| Verdict: | Malicious activity |
| Analysis date: | August 31, 2024, 12:45:06 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows |
| MD5: | 3A3E46BC2ACF7A1CB7664D38822DF0A1 |
| SHA1: | E53E18BEB22C1AEF9860D729028F8207B5A43885 |
| SHA256: | 63511DCAF7B17D68A942F36F86A34E6E0C006BEEE5A16A5C9DE3FBA0E73FD814 |
| SSDEEP: | 98304:r22Hs3Ha+cpTINAnF5WC+p5pnjgQaCpW8J1pT0jcflB2bz14buCU51wn206/UiJ3:Z08rriYzoEu5V7HbMsNSw49Y0nuwfXM |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- Install-GooglePlayGames-Beta.exe (PID: 6168)
Executable content was dropped or overwritten
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- GoogleUpdateSetup.exe (PID: 6968)
Drops the executable file immediately after the start
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- GoogleUpdateSetup.exe (PID: 6968)
Reads the date of Windows installation
- Install-GooglePlayGames-Beta.exe (PID: 6168)
Application launched itself
- Install-GooglePlayGames-Beta.exe (PID: 6168)
Potential Corporate Privacy Violation
- svchost.exe (PID: 2700)
Checks Windows Trust Settings
- Install-GooglePlayGames-Beta.exe (PID: 6168)
Process requests binary or script from the Internet
- svchost.exe (PID: 2700)
INFO
Reads the computer name
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- GoogleUpdate.exe (PID: 1776)
- Install-GooglePlayGames-Beta.exe (PID: 1164)
- GoogleUpdate.exe (PID: 236)
- GoogleUpdate.exe (PID: 4820)
- GoogleUpdate.exe (PID: 4088)
- GoogleUpdate.exe (PID: 4344)
Checks supported languages
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- GoogleUpdate.exe (PID: 1776)
- GoogleUpdate.exe (PID: 4088)
- Install-GooglePlayGames-Beta.exe (PID: 1164)
- GoogleUpdateSetup.exe (PID: 6968)
- GoogleUpdate.exe (PID: 236)
- GoogleUpdate.exe (PID: 4820)
- GoogleUpdateOnDemand.exe (PID: 5172)
- GoogleUpdate.exe (PID: 4344)
- GoogleUpdateBroker.exe (PID: 1556)
Creates files in the program directory
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- GoogleUpdate.exe (PID: 1776)
- GoogleUpdate.exe (PID: 4088)
- GoogleUpdate.exe (PID: 4820)
- GoogleUpdate.exe (PID: 236)
- GoogleUpdate.exe (PID: 4344)
Creates files or folders in the user directory
- Install-GooglePlayGames-Beta.exe (PID: 6168)
Reads the machine GUID from the registry
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- Install-GooglePlayGames-Beta.exe (PID: 1164)
- GoogleUpdate.exe (PID: 4344)
- GoogleUpdate.exe (PID: 4820)
Create files in a temporary directory
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- svchost.exe (PID: 2700)
Checks proxy server information
- Install-GooglePlayGames-Beta.exe (PID: 6168)
- GoogleUpdate.exe (PID: 4820)
- GoogleUpdate.exe (PID: 4344)
Process checks computer location settings
- Install-GooglePlayGames-Beta.exe (PID: 6168)
The process uses the downloaded file
- Install-GooglePlayGames-Beta.exe (PID: 6168)
Reads the software policy settings
- GoogleUpdate.exe (PID: 4344)
- GoogleUpdate.exe (PID: 4820)
- Install-GooglePlayGames-Beta.exe (PID: 6168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2071:01:10 11:16:29+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 48 |
| CodeSize: | 2811904 |
| InitializedDataSize: | 72192 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x0000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 24.8.1053.0 |
| ProductVersionNumber: | 24.8.1053.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | Google LLC |
| FileDescription: | Google Play Games Installer |
| FileVersion: | 24.8.1053.0 |
| InternalName: | ProdBrandedInstaller.exe |
| LegalCopyright: | Copyright 2023 Google LLC |
| OriginalFileName: | ProdBrandedInstaller.exe |
| ProductName: | Google Play Games |
| ProductVersion: | 24.8.1053.0 |
| AssemblyVersion: | 24.8.1053.0 |
Total processes
131
Monitored processes
11
Malicious processes
0
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 236 | "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe | — | GoogleUpdateBroker.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.36.51 Modules
| |||||||||||||||
| 1164 | "C:\Users\admin\Desktop\Install-GooglePlayGames-Beta.exe" -install gpg_install_c4507d38-9c61-4e91-a0a2-b4dfd8409cc2 "C:\Users\admin\AppData\Local\Temp\m3f3lv11.uga" | C:\Users\admin\Desktop\Install-GooglePlayGames-Beta.exe | Install-GooglePlayGames-Beta.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Play Games Installer Version: 24.8.1053.0 Modules
| |||||||||||||||
| 1556 | "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateBroker.exe" -Embedding | C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateBroker.exe | — | svchost.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Update Exit code: 0 Version: 1.3.36.371 Modules
| |||||||||||||||
| 1776 | C:\WINDOWS\SystemTemp\GUM168A.tmp\GoogleUpdate.exe /install "runtime=true&needsadmin=true" /silent | C:\Windows\SystemTemp\GUM168A.tmp\GoogleUpdate.exe | — | GoogleUpdateSetup.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.36.371 Modules
| |||||||||||||||
| 2700 | C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITS | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4088 | "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /healthcheck | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe | — | GoogleUpdate.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.36.51 Modules
| |||||||||||||||
| 4344 | "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi41MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4MkY0OUI4MC02NDRCLTQ0QzYtQjlBMy1FQ0E3OEFCMUM1RjJ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezUxQjVBMTYwLUVGQ0QtNDk2RS05NTMzLTg2MjNDRUEzRTQ3Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MiIgbmV4dHZlcnNpb249IjEuMy4zNi4zNzEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjM5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe | GoogleUpdate.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.36.51 Modules
| |||||||||||||||
| 4820 | "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe | GoogleUpdateOnDemand.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Installer Version: 1.3.36.51 Modules
| |||||||||||||||
| 5172 | "C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateOnDemand.exe" -Embedding | C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleUpdateOnDemand.exe | — | svchost.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Update Exit code: 0 Version: 1.3.36.371 Modules
| |||||||||||||||
| 6168 | "C:\Users\admin\Desktop\Install-GooglePlayGames-Beta.exe" | C:\Users\admin\Desktop\Install-GooglePlayGames-Beta.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Play Games Installer Version: 24.8.1053.0 Modules
| |||||||||||||||
Total events
16 772
Read events
14 842
Write events
1 891
Delete events
39
Modification events
| (PID) Process: | (2700) svchost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS |
| Operation: | write | Name: | PerfMMFileName |
Value: Global\MMF_BITS6aa395ec-638d-472d-b25c-49bb780a049a | |||
| (PID) Process: | (6168) Install-GooglePlayGames-Beta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6168) Install-GooglePlayGames-Beta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6168) Install-GooglePlayGames-Beta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6168) Install-GooglePlayGames-Beta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (1164) Install-GooglePlayGames-Beta.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Play Games |
| Operation: | write | Name: | WindowsGuid |
Value: 06241f0b-5573-406a-841d-71a59d121a45 | |||
| (PID) Process: | (1776) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Update |
| Operation: | delete value | Name: | uid |
Value: | |||
| (PID) Process: | (1776) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Update |
| Operation: | delete value | Name: | old-uid |
Value: | |||
| (PID) Process: | (1776) GoogleUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update |
| Operation: | delete value | Name: | uid |
Value: | |||
| (PID) Process: | (1776) GoogleUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update |
| Operation: | delete value | Name: | old-uid |
Value: | |||
Executable files
72
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6168 | Install-GooglePlayGames-Beta.exe | C:\Users\admin\AppData\Local\Temp\m3f3lv11.uga\CrashReporting.dll | executable | |
MD5:4DB168C083ABE117EBA10134D40498E8 | SHA256:452736D33B932982609D02A4169BFFA4EFBCA4DB70B21603E257A2D343240642 | |||
| 6968 | GoogleUpdateSetup.exe | C:\Windows\SystemTemp\GUM168A.tmp\GoogleUpdate.exe | executable | |
MD5:BAF0B64AF9FCEAB44942506F3AF21C87 | SHA256:581EDECA339BB8C5EBC1D0193AD77F5CAFA329C5A9ADF8F5299B1AFABED6623B | |||
| 6168 | Install-GooglePlayGames-Beta.exe | C:\Users\admin\AppData\Local\Temp\m3f3lv11.uga\recorder_delegate_lib.dll | executable | |
MD5:235940882ED3551CEB35C1CEB6B29594 | SHA256:72305C38935FEBA7EC2D2A00914F2BBBCAB19904FD38A91A2FF5FD32EBFA505E | |||
| 6968 | GoogleUpdateSetup.exe | C:\Windows\SystemTemp\GUM168A.tmp\GoogleUpdateBroker.exe | executable | |
MD5:FF2D1B951CAFE2A3B88A168900844303 | SHA256:F8E20A4EFB9BB32AF39E3CBC414412B3B01C0442ABFE214A58BC3ECCFFFD35B7 | |||
| 6968 | GoogleUpdateSetup.exe | C:\Windows\SystemTemp\GUM168A.tmp\GoogleUpdateOnDemand.exe | executable | |
MD5:B191834EB918C5BCAA46E594561C53C9 | SHA256:0FA78EEA190E3AE9DDB0E6CD85EB5188947CE0BA748FC6D567ADE48B1FB3AE27 | |||
| 6968 | GoogleUpdateSetup.exe | C:\Windows\SystemTemp\GUM168A.tmp\GoogleCrashHandler.exe | executable | |
MD5:4C3832FBE84B8CE63D8E3AB7D76F9983 | SHA256:8FE2226E8BEC5A45D4B819359192AB92446B54859BF8877573AB7A3C8B4ADA76 | |||
| 6168 | Install-GooglePlayGames-Beta.exe | C:\Users\admin\AppData\Local\Temp\m3f3lv11.uga\crashpad_handler.exe | executable | |
MD5:DC836FFB17DC7944BBB3F8BCE4688865 | SHA256:0D1550F7C41E8638E45202DF4C793CCEE4C342E7491EC4D1BB3E2DDB0BEF0D49 | |||
| 2700 | svchost.exe | C:\ProgramData\Microsoft\Network\Downloader\qmgr.db | edb | |
MD5:6047E1D6520C48DAAED882C066BDE1A7 | SHA256:9BB73109987CBCC0DBBB8D8089EAA3DD166A53066DDC02DD7298FD4680549C40 | |||
| 6168 | Install-GooglePlayGames-Beta.exe | C:\Users\admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad\settings.dat | binary | |
MD5:61C51807FA1E9449670FE45CAC231718 | SHA256:6D1FF7621F6F681E632584A1AC1818348FC7A4D3674CF607571543E5A31FE608 | |||
| 6168 | Install-GooglePlayGames-Beta.exe | C:\Users\admin\AppData\Local\Temp\m3f3lv11.uga\GoogleUpdateSetup.exe | executable | |
MD5:88A857CB7CA6702AB812666B4C88DFE9 | SHA256:027299EA8DFA96E0E59794C59ABFD562E2F675E8B8B9A84028DA8C58C58D243F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
6
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2700 | svchost.exe | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/Play/ifpbz3jqrkgbz3uvuylwz7h3ua_24.8.469.6/HPE-24.8.469.6-CIP.exe | unknown | — | — | whitelisted |
2700 | svchost.exe | GET | — | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/Play/ifpbz3jqrkgbz3uvuylwz7h3ua_24.8.469.6/HPE-24.8.469.6-CIP.exe | unknown | — | — | whitelisted |
— | — | POST | 200 | 142.250.185.163:443 | https://update.googleapis.com/service/update2?cup2key=13:5IpjMEDxqXwmHW629yx--vSkeCBCRpYGioEu8NOLbbA&cup2hreq=f6b79c85e5691ecc18393939c9c81e618d5ecb40f3c513b572b1ec908a9ab631 | unknown | xml | 1.39 Kb | — |
— | — | POST | 200 | 216.239.32.223:443 | https://play.googleapis.com/log?hasfast=true | unknown | binary | 85 b | — |
— | — | POST | 200 | 142.250.185.163:443 | https://update.googleapis.com/service/update2 | unknown | xml | 233 b | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2248 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4324 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4344 | GoogleUpdate.exe | 142.250.185.163:443 | update.googleapis.com | GOOGLE | US | whitelisted |
4820 | GoogleUpdate.exe | 142.250.185.163:443 | update.googleapis.com | GOOGLE | US | whitelisted |
2700 | svchost.exe | 34.104.35.123:80 | edgedl.me.gvt1.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
edgedl.me.gvt1.com |
| whitelisted |
play.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2700 | svchost.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2700 | svchost.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
Process | Message |
|---|---|
Install-GooglePlayGames-Beta.exe | I0000 00:00:1725108325.316361 4540 battlestar_recorder_delegate.cc:95] Successfully initialized recorder using log source value: 1518
|