Overview

overview

10

Static

static

GitHub Desktop.exe

windows7-x64

5

GitHub Desktop.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    2s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GitHub Desktop.exe

  • Size

    3.5MB

  • MD5

    b4997c79cfc3aadcf67ea98b35d02416

  • SHA1

    7c439b88a9f8bfadb02ae1a3eab10130fcc7fcec

  • SHA256

    e358ccc2222e1f8acc1ccbe3596f50fbb24d7e744850df3c04eca6c5eeeba2e5

  • SHA512

    58770e14fabf655a9331cba7e283c3dfc8f4eef5a5c63502a5cf7e34b43a2bc6e6b431e392f5e06c02119ca1f87c329fa26f0b3c9653b4d9fbb1b029c8626c38

  • SSDEEP

    49152:fdGRbHsngxm8dAEWPZkjf7xvPSPYl/mJpA6ZD5Uu66n3:oRbMnd8dAEWPZkZKP2mJpACDv/3

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe
    "C:\Users\Admin\AppData\Local\Temp\GitHub Desktop.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1536-54-0x0000000000AB0000-0x0000000000E42000-memory.dmp

    Filesize

    3.6MB

    Download