| File name: | ChromeSetup.exe |
| Full analysis: | https://app.any.run/tasks/8de94704-d7f8-470d-9101-c14b6df879ac |
| Verdict: | Malicious activity |
| Analysis date: | October 07, 2019, 13:48:00 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | BB51BD844BA5BCB5A717F1E4A0816DE3 |
| SHA1: | 7D3C6EA82622B67A1D2D7F8E7CC694C8DB8F153E |
| SHA256: | 911340494C2E24A4C4A874F1F6465FDC370B36AE3D363C1C7C7080FD78BDFA6A |
| SSDEEP: | 24576:q6JGMnMpfVArKlhbP6GFibQC1QSvKZHHf1FqbI4Cn:47/MPGFibsSipHubPa |
MALICIOUS
Loads the Task Scheduler COM API
- GoogleUpdate.exe (PID: 1588)
Changes the autorun value in the registry
- GoogleUpdate.exe (PID: 1588)
Application was dropped or rewritten from another process
- GoogleUpdate.exe (PID: 1588)
- GoogleUpdate.exe (PID: 3796)
- GoogleUpdate.exe (PID: 3668)
- GoogleUpdate.exe (PID: 2800)
- GoogleUpdate.exe (PID: 2872)
Loads dropped or rewritten executable
- GoogleUpdate.exe (PID: 1588)
- GoogleUpdate.exe (PID: 3796)
- GoogleUpdate.exe (PID: 2800)
- GoogleUpdate.exe (PID: 2872)
- GoogleUpdate.exe (PID: 3668)
SUSPICIOUS
Executable content was dropped or overwritten
- ChromeSetup.exe (PID: 3272)
- GoogleUpdate.exe (PID: 1588)
Starts itself from another location
- GoogleUpdate.exe (PID: 1588)
Creates COM task schedule object
- GoogleUpdate.exe (PID: 3796)
- GoogleUpdate.exe (PID: 1588)
Executed via COM
- GoogleUpdate.exe (PID: 3668)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:05:07 01:16:52+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 14.2 |
| CodeSize: | 82944 |
| InitializedDataSize: | 1044480 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x4ea5 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.3.34.11 |
| ProductVersionNumber: | 1.3.34.11 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Google LLC |
| FileDescription: | Google Update Setup |
| FileVersion: | 1.3.34.11 |
| InternalName: | Google Update Setup |
| LegalCopyright: | Copyright 2018 Google LLC |
| OriginalFileName: | GoogleUpdateSetup.exe |
| ProductName: | Google Update |
| ProductVersion: | 1.3.34.11 |
| LanguageId: | en |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 06-May-2019 23:16:52 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | Google LLC |
| FileDescription: | Google Update Setup |
| FileVersion: | 1.3.34.11 |
| InternalName: | Google Update Setup |
| LegalCopyright: | Copyright 2018 Google LLC |
| OriginalFilename: | GoogleUpdateSetup.exe |
| ProductName: | Google Update |
| ProductVersion: | 1.3.34.11 |
| LanguageId: | en |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000100 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 06-May-2019 23:16:52 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000143BF | 0x00014400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.67163 |
.rdata | 0x00016000 | 0x00006D84 | 0x00006E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.26188 |
.data | 0x0001D000 | 0x00001290 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.99865 |
.rsrc | 0x0001F000 | 0x000F64BC | 0x000F6600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.98306 |
.reloc | 0x00116000 | 0x000010DC | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.36692 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.20417 | 1166 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
2 | 4.13669 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 3.91985 | 744 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 4.83772 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 3.68656 | 1640 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 4.50268 | 3752 | Latin 1 / Western European | English - United States | RT_ICON |
101 | 2.86669 | 90 | Latin 1 / Western European | English - United States | RT_GROUP_ICON |
102 | 7.9998 | 975824 | Latin 1 / Western European | UNKNOWN | B |
1321 | 3.68352 | 426 | Latin 1 / Western European | Serbian - Serbia (Cyrillic) | RT_STRING |
Imports
KERNEL32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
ole32.dll |
Total processes
39
Monitored processes
6
Malicious processes
5
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1588 | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={4EA16AC7-FD5A-47C3-875B-DBF4A2008C20}&iid={58811302-68E9-2A3F-F134-A2229B45DD2B}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome%20Canary&needsadmin=false&ap=-statsdef_1&installdataindex=empty" | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\GoogleUpdate.exe | ChromeSetup.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 0 Version: 1.3.34.11 Modules
| |||||||||||||||
| 2800 | "C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNC4xMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjM0LjExIiBpc21hY2hpbmU9IjAiIHNlc3Npb25pZD0iezNFRDA0NjlCLTY0MkEtNDNFMS04MjFELTY3RDAwRTAyRTM4Mn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins5M0Q2RjE2QS1GQUM1LTQ1MzctQkY0Ny0zRUZCNUI4QjYyQjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjMiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDg2Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNC4xMSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9Ins1ODgxMTMwMi02OEU5LTJBM0YtRjEzNC1BMjIyOUI0NUREMkJ9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjEzNDQiLz48L2FwcD48L3JlcXVlc3Q- | C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe | GoogleUpdate.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 0 Version: 1.3.34.11 Modules
| |||||||||||||||
| 2872 | "C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" /handoff "appguid={4EA16AC7-FD5A-47C3-875B-DBF4A2008C20}&iid={58811302-68E9-2A3F-F134-A2229B45DD2B}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome%20Canary&needsadmin=false&ap=-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{3ED0469B-642A-43E1-821D-67D00E02E382}" | C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe | — | GoogleUpdate.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 0 Version: 1.3.34.11 Modules
| |||||||||||||||
| 3272 | "C:\Users\admin\Desktop\ChromeSetup.exe" | C:\Users\admin\Desktop\ChromeSetup.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Update Setup Exit code: 0 Version: 1.3.34.11 Modules
| |||||||||||||||
| 3668 | "C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" -Embedding | C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe | svchost.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 0 Version: 1.3.34.11 Modules
| |||||||||||||||
| 3796 | "C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" /regserver | C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe | — | GoogleUpdate.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 0 Version: 1.3.34.11 Modules
| |||||||||||||||
Total events
5 230
Read events
467
Write events
4 753
Delete events
10
Modification events
| (PID) Process: | (1588) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{4EA16AC7-FD5A-47C3-875B-DBF4A2008C20} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (1588) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update |
| Operation: | write | Name: | path |
Value: C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe | |||
| (PID) Process: | (1588) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update |
| Operation: | write | Name: | UninstallCmdLine |
Value: "C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" /uninstall | |||
| (PID) Process: | (1588) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D} |
| Operation: | write | Name: | pv |
Value: 1.3.34.11 | |||
| (PID) Process: | (1588) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D} |
| Operation: | write | Name: | name |
Value: Google Update | |||
| (PID) Process: | (1588) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D} |
| Operation: | write | Name: | pv |
Value: 1.3.34.11 | |||
| (PID) Process: | (1588) GoogleUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Google Update |
Value: C:\Users\admin\AppData\Local\Google\Update\1.3.34.11\GoogleUpdateCore.exe | |||
| (PID) Process: | (3796) GoogleUpdate.exe | Key: | HKEY_CLASSES_ROOT\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 |
| Operation: | write | Name: | |
Value: C:\Users\admin\AppData\Local\Google\Update\1.3.34.11\psuser.dll | |||
| (PID) Process: | (3796) GoogleUpdate.exe | Key: | HKEY_CLASSES_ROOT\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Both | |||
| (PID) Process: | (3796) GoogleUpdate.exe | Key: | HKEY_CLASSES_ROOT\CLSID\{7C1C4A7A-97BC-47C0-A53F-C58185CA379A}\InprocHandler32 |
| Operation: | write | Name: | |
Value: C:\Users\admin\AppData\Local\Google\Update\1.3.34.11\psuser.dll | |||
Executable files
143
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\GoogleUpdateHelper.msi | executable | |
MD5:202B7EC9D41CDA7ECC9A5DB38301AB9F | SHA256:28280E562EA8A542551505A1944F98A723F31A18B1BA69F59431245E432D2779 | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\GoogleUpdateComRegisterShell64.exe | executable | |
MD5:396BA164448844FCD0C72DD802AC7DB6 | SHA256:F3ADA0BB7459836BA250314EA6D417694C974445F0F7218EA8A48B60C557BB89 | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\goopdate.dll | executable | |
MD5:69D1BF5384CEA587E6CC69AC827CC02D | SHA256:D8F9C6A2E3F784E4A9C9DD714E1FBFEA1883B920216DC01AD9D56700B17C0671 | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\GoogleUpdateOnDemand.exe | executable | |
MD5:597CB67524C8E93909696845D60A1647 | SHA256:68F5E571FA04F07B33B82C2F7E4354DEC80F037CCF419722C26FE091F649AD39 | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\GoogleUpdateBroker.exe | executable | |
MD5:700C3948A21D47D991EF8DAF7A176AE9 | SHA256:D1FFD6FAE6250D7F03621E54D7B8DAC9882FF98E7FB2CAC174C5A34A0F157BDD | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\psmachine.dll | executable | |
MD5:64DD97E3EAFE04D5E41F0F90111E50E2 | SHA256:C7AC5FFA7C18C96369137CC81A57F9293D8585DCDBDDDABB34363F514359F4CE | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\GoogleUpdateWebPlugin.exe | executable | |
MD5:A2A18AE5F51BD129EC673B22D8DF497E | SHA256:2F5025FFA478854B92626515B3187FA2BBAD7EA064079AC804D54482DC30B92A | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\psmachine_64.dll | executable | |
MD5:100939CC975C159C589CEBD0479775F1 | SHA256:DA372F0567004D6A5EA481203C955011B41DC6D1A856482CAC0F0D54DB66FA54 | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\npGoogleUpdate3.dll | executable | |
MD5:CDBE4728D075CA5050B3B9FA7138F8B8 | SHA256:051C42124192595EC6D22577E4870FAD2A8AC52F04A43CB77372A99D48A9B718 | |||
| 3272 | ChromeSetup.exe | C:\Users\admin\AppData\Local\Temp\GUMDEC.tmp\psuser.dll | executable | |
MD5:0F2166B652DB61EFAF7DA3BEEBCFDA65 | SHA256:2760DAFA83722514E76AAB3DAED075750933DB3D03C27D34D52B1C122F5A4113 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
3
Threats
2
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 173.194.7.73:80 | r3---sn-p5qlsnsy.gvt1.com | Google Inc. | US | whitelisted |
2800 | GoogleUpdate.exe | 172.217.21.195:443 | update.googleapis.com | Google Inc. | US | whitelisted |
— | — | 172.217.22.14:80 | redirector.gvt1.com | Google Inc. | US | whitelisted |
3668 | GoogleUpdate.exe | 172.217.21.195:443 | update.googleapis.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
update.googleapis.com |
| whitelisted |
redirector.gvt1.com |
| whitelisted |
r3---sn-p5qlsnsy.gvt1.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
— | — | Misc activity | ET INFO EXE - Served Attached HTTP |