Analysis
-
max time kernel
31s -
max time network
26s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
20/09/2023, 13:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://github.com/git-for-windows/git/releases/download/v2.16.1.windows.4
Resource
win10-20230915-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://github.com/git-for-windows/git/releases/download/v2.16.1.windows.4
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133396897863902606" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 4308 2816 chrome.exe 70 PID 2816 wrote to memory of 4308 2816 chrome.exe 70 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2368 2816 chrome.exe 74 PID 2816 wrote to memory of 2156 2816 chrome.exe 72 PID 2816 wrote to memory of 2156 2816 chrome.exe 72 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73 PID 2816 wrote to memory of 3188 2816 chrome.exe 73
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github.com/git-for-windows/git/releases/download/v2.16.1.windows.41⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff90fa19758,0x7ff90fa19768,0x7ff90fa197782⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:82⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:82⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:22⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2764 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:12⤵PID:372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2656 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:12⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4324 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:12⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2812 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:82⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1644,i,297308388699578103,13910444025604845025,131072 /prefetch:82⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53ec42ea831348ecc1a1e923cc0784af3
SHA130f769dece04b26a37c13adc900ab51770ef42ce
SHA256fd315b597dbad85128f478008d3e86a06089b3cd604a1c1e78eb3913c21b30e5
SHA51279e21f8f9a57c4e648faaea58807a86718130c7452bbe9e875b5354dacb68e748ed709a5065e86909e12e2ac8bad0b13ae5527d07dc223867ed51b7aa46d7a8f
-
Filesize
1KB
MD5252c572d69bcba4438ca254e16a5a112
SHA1a52a94a0a9d2687f4e59349f1f53a9f75580733f
SHA256a30cb8dc03047340549300c08a6b74e0c0cc8c7eb03f0febaf6823a3cd82cfe4
SHA5121c1fdbc56736837ecc9501d51adf6757b37f56850f6addf5ae1260cde402cb2e4714eed668567121a02017bc152bb6602f76c20d37a4364ea8b79c09fd5d378f
-
Filesize
5KB
MD5e6ed23a6b9c93c0d4e65fa989b78dcf5
SHA114bc0e45f42940ce2ca90b43cb8d032b9dcd874a
SHA2565461e1815ab3cf2a9d4461785bdd68ca5c827a96a013229c3731d73cd79cc1af
SHA51216f7078bf086f64c1c5f93f888dfe7963fdff3fd1b89356d18df8ffce97c5dec6b2c056400211c08e4539e7d2bf6ba640b32c9480c3f9db3dc35c4def1b217db
-
Filesize
5KB
MD53242e56041276b7d1b4c9d09ebb2ee17
SHA11702a5cd7013a0932d1d6e5f2e88bf4f9c797844
SHA2562d9b006078a4dfd67d328bc37f605df10461f168cb80591367f8e4ec3173445b
SHA5120eab2e143aed159c31f99f707ead1dba94f5eff4ae6cd9573e9f9f30948efad1939eae3fb2a5ebfef295ded7b6f15c0daa45b79df0e1f4fea8e35d49ff1587c9
-
Filesize
102KB
MD55be6632d40dc82d520abe679e8fb2cc4
SHA1d78fc0bfb47a64079a4786b0240450d729e767a5
SHA256eac06bf1bcfc335991bd856ad951fd514450a379a8166705760d9b8988e3c050
SHA51255e5d9537ca8152007926e053cef89f5b337a534d93be0db1770d4f1cd535c714ee4f07cde09f61faa6cc36c286de4fcaf4c0172f6897e6c468a349d896f21cd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd