| File name: | 43a40af03bbd859de1b4abb9d9a7b089-sample.zip |
| Full analysis: | https://app.any.run/tasks/b26c3550-4e6c-41c2-a44a-1ddb4624f85e |
| Verdict: | Malicious activity |
| Analysis date: | April 25, 2019, 20:53:43 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | E3425CE3D138E1FB6F75C05267E197B9 |
| SHA1: | FEBD06D04AFAD8D4A5F07737101088540F267780 |
| SHA256: | 7ED9F72C3EA84FD5DE91DFC2185D3F8068B55E7C84F6FE9EEBB6A2D1AF12A94B |
| SSDEEP: | 24576:uK+g80yOWnZumRLl2lXJn7XRHFn/xyQBak4tGvqmy401R:94nrRgfnXJynk4gqmyR |
MALICIOUS
Loads dropped or rewritten executable
- GoogleUpdate.exe (PID: 4092)
- GoogleUpdate.exe (PID: 1332)
- GoogleUpdate.exe (PID: 2532)
- GoogleUpdate.exe (PID: 1440)
- GoogleUpdate.exe (PID: 804)
- GoogleUpdate.exe (PID: 3816)
- GoogleUpdate.exe (PID: 3796)
Application was dropped or rewritten from another process
- GoogleUpdate.exe (PID: 1332)
- ChromeSetup.exe (PID: 2432)
- GoogleUpdateSetup.exe (PID: 3124)
- GoogleUpdate.exe (PID: 804)
Changes settings of System certificates
- GoogleUpdate.exe (PID: 4092)
Loads the Task Scheduler COM API
- GoogleUpdate.exe (PID: 804)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3872)
- GoogleUpdateSetup.exe (PID: 3124)
- ChromeSetup.exe (PID: 2432)
- GoogleUpdate.exe (PID: 804)
Creates files in the program directory
- GoogleUpdateSetup.exe (PID: 3124)
- GoogleUpdate.exe (PID: 804)
Disables SEHOP
- GoogleUpdate.exe (PID: 804)
Adds / modifies Windows certificates
- GoogleUpdate.exe (PID: 4092)
Creates COM task schedule object
- GoogleUpdate.exe (PID: 804)
- GoogleUpdate.exe (PID: 3796)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0009 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2019:04:25 20:53:01 |
| ZipCRC: | 0x65122627 |
| ZipCompressedSize: | 1127747 |
| ZipUncompressedSize: | 1214008 |
| ZipFileName: | ChromeSetup.exe |
Total processes
43
Monitored processes
10
Malicious processes
8
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 804 | "C:\Program Files\GUM6DBB.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0FACA4A6-FA93-69AC-63A1-5DF819999DB7}&lang=en&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBD&installdataindex=defaultbrowser" /installelevated | C:\Program Files\GUM6DBB.tmp\GoogleUpdate.exe | GoogleUpdateSetup.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.34.7 Modules
| |||||||||||||||
| 1332 | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0FACA4A6-FA93-69AC-63A1-5DF819999DB7}&lang=en&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBD&installdataindex=defaultbrowser" | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdate.exe | — | ChromeSetup.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 0 Version: 1.3.34.7 Modules
| |||||||||||||||
| 1440 | "C:\Program Files\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0FACA4A6-FA93-69AC-63A1-5DF819999DB7}&lang=en&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBD&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{4435C568-7058-4336-8375-A5ABBF7FADE2}" | C:\Program Files\Google\Update\GoogleUpdate.exe | — | GoogleUpdate.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.33.23 Modules
| |||||||||||||||
| 2432 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb3872.14871\ChromeSetup.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb3872.14871\ChromeSetup.exe | WinRAR.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Update Setup Exit code: 0 Version: 1.3.34.7 Modules
| |||||||||||||||
| 2532 | "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc | C:\Program Files\Google\Update\GoogleUpdate.exe | services.exe | ||||||||||||
User: SYSTEM Company: Google Inc. Integrity Level: SYSTEM Description: Google Installer Exit code: 0 Version: 1.3.33.23 Modules
| |||||||||||||||
| 3124 | "C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdateSetup.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0FACA4A6-FA93-69AC-63A1-5DF819999DB7}&lang=en&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBD&installdataindex=defaultbrowser" /installelevated /nomitag | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdateSetup.exe | GoogleUpdate.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Update Setup Exit code: 0 Version: 1.3.34.7 Modules
| |||||||||||||||
| 3796 | "C:\Program Files\Google\Update\GoogleUpdate.exe" /regserver | C:\Program Files\Google\Update\GoogleUpdate.exe | — | GoogleUpdate.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.33.23 Modules
| |||||||||||||||
| 3816 | "C:\Program Files\Google\Update\GoogleUpdate.exe" /regsvc | C:\Program Files\Google\Update\GoogleUpdate.exe | — | GoogleUpdate.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.33.23 Modules
| |||||||||||||||
| 3872 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\43a40af03bbd859de1b4abb9d9a7b089-sample.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 4092 | "C:\Program Files\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNC43IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzMuMjMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDQzNUM1NjgtNzA1OC00MzM2LTgzNzUtQTVBQkJGN0ZBREUyfSIgdXNlcmlkPSJ7RkNENkRGOEQtOUQ5My00RUVFLUFBNDMtQUQ0OEQyRDM5RUVFfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezJFOEFFMTY5LTdGQkItNDcyNS05QjRELUU5MzA5MTNFRjZGNn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMyIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjMzLjIzIiBuZXh0dmVyc2lvbj0iMS4zLjM0LjciIGxhbmc9ImVuIiBicmFuZD0iQ0hCRCIgY2xpZW50PSIiIGlpZD0iezBGQUNBNEE2LUZBOTMtNjlBQy02M0ExLTVERjgxOTk5OURCN30iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTY1NiIvPjwvYXBwPjwvcmVxdWVzdD4 | C:\Program Files\Google\Update\GoogleUpdate.exe | GoogleUpdate.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: HIGH Description: Google Installer Exit code: 0 Version: 1.3.33.23 Modules
| |||||||||||||||
Total events
2 627
Read events
963
Write events
1 541
Delete events
123
Modification events
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\43a40af03bbd859de1b4abb9d9a7b089-sample.zip | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (3872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
214
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3872 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3872.14871\ChromeSetup.exe | executable | |
MD5:— | SHA256:— | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\goopdate.dll | executable | |
MD5:0E93218F6DE56FF1859C75D7784EEFDE | SHA256:1A788AE8AF762AA5031690800DDEC8CD7EEE1560404C5D01EBF5B37886F05ED6 | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdateCore.exe | executable | |
MD5:6D37412968A6E3242710255A8015F6E1 | SHA256:8BAB2C5DE1DCA54EB609A5093C1AD92B4396AA43FAB87A5FEF48F5DF3283C26B | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdate.exe | executable | |
MD5:FBC17BBA12B23433AFEAA9DA138B9B1A | SHA256:4D3234649D557A63D2B5DBE3600DA69AB4A4C9D9979E700D4B536589C4A00234 | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdateOnDemand.exe | executable | |
MD5:5D5A0950E50318416EC3E1487D2FE63E | SHA256:93C8D91DA7D29EB3DF820C3C6BCDD1B09E3E2AC84B4A877D4257A870388B6FB2 | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdateBroker.exe | executable | |
MD5:0FE546732413AC42046A36F739B063F1 | SHA256:96C6C3F2234583D5138C8EAA7B62AC0AEF0990F3AE5033DB870EC6EA5134331D | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleCrashHandler.exe | executable | |
MD5:27322C0A2F2B96D47EBA58E550FC85F2 | SHA256:C054E7261BC72489FF575009A6532E19373E3B76679735A4EC1F140314ABD327 | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdateComRegisterShell64.exe | executable | |
MD5:7D4A5D2C3BE057EEA014DD3D7A08D3C2 | SHA256:26D4C072249D9220E18E481E89CAF426234F34B726F8D1FA3B4940DCC75DD338 | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\npGoogleUpdate3.dll | executable | |
MD5:78CF8E4F9D1D211415E1ED8EDCD2CF7D | SHA256:E6AE710FD9F93C913C652DB447A49E4EEEF074EAFC00211149B7E8AB6CE3CF4F | |||
| 2432 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUM67FE.tmp\GoogleUpdateHelper.msi | executable | |
MD5:BC2703B6E27C16242284F831C44AD3EA | SHA256:F0E67875664A438F3C16DDA0DECF8B39C37770E766D98A350BBA8418D0A9CC6E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
3
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 200 | 173.194.183.168:80 | http://r3---sn-aigl6ney.gvt1.com/edgedl/release2/chrome/APs8ZpW3XIoO_74.0.3729.108/74.0.3729.108_chrome_installer.exe?cms_redirect=yes&mip=185.192.69.22&mm=28&mn=sn-aigl6ney&ms=nvh&mt=1556225452&mv=u&pl=24&shardbypass=yes | US | — | — | whitelisted |
— | — | HEAD | 302 | 172.217.22.14:80 | http://redirector.gvt1.com/edgedl/release2/chrome/APs8ZpW3XIoO_74.0.3729.108/74.0.3729.108_chrome_installer.exe | US | — | — | whitelisted |
— | — | GET | — | 173.194.183.168:80 | http://r3---sn-aigl6ney.gvt1.com/edgedl/release2/chrome/APs8ZpW3XIoO_74.0.3729.108/74.0.3729.108_chrome_installer.exe?cms_redirect=yes&mip=185.192.69.22&mm=28&mn=sn-aigl6ney&ms=nvh&mt=1556225452&mv=u&pl=24&shardbypass=yes | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 172.217.22.14:80 | redirector.gvt1.com | Google Inc. | US | whitelisted |
— | — | 173.194.183.168:80 | r3---sn-aigl6ney.gvt1.com | Google Inc. | US | whitelisted |
4092 | GoogleUpdate.exe | 172.217.16.163:443 | update.googleapis.com | Google Inc. | US | whitelisted |
2532 | GoogleUpdate.exe | 172.217.16.163:443 | update.googleapis.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
update.googleapis.com |
| whitelisted |
redirector.gvt1.com |
| whitelisted |
r3---sn-aigl6ney.gvt1.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |