942865de5f19c42fdae32b77988f8d68e72ff78deef26b93d970b494bc2c7e87

Analysis

user interaction
yes
max time kernel
262s
max time network
209s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gh_2.97.0_windows_amd64.msi
Size 14.5MB
Sample260810-pm114agb33
SHA256 942865de5f19c42fdae32b77988f8d68e72ff78deef26b93d970b494bc2c7e87
MD5 12847da3d29ccbd956f443b9c00f551e
SHA1 668b517b9fc3fbf7bd63f2dc4bda33fadaa530f5
SHA512 2469794dad81e337795e6f0d5d475fe071e915ad65c6537188d4a6e7a31bcecab686cfb2b0f1a135a6e37f5147e9e8f354e18d15e0cdb6474db1b8f2d4f420d8
SSDEEP 393216:xJZYrCOyZJyIJluezLUtltu8mjWiuk9FUzsBPNUDLUzzQraPNc5n:+rCOyZJJurtDbFiukHBPNvEraPNc
TLSH
T1FAE633037C405637C5AB0D718AF75721AE68FE181B94884B63757A89FEF25C04B327EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5872	gh.exe
5316	gh.exe
3300	gh.exe
1408	gh.exe
1832	gh.exe
2796	gh.exe

Loads dropped DLL 2 IoCs

pid	Process
5676	MsiExec.exe
4092	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6076	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\GitHub CLI\gh.exe	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFD70F29E04E133D53.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{16394977-6CA9-462C-99D8-7ABC61F1810B}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4D2B69C908B69D95.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFECA9BFAE2CED508A.TMP	msiexec.exe
File created	C:\Windows\Installer\e59f3bd.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBBB.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f3bf.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9CACC7562B6F1238.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f3bd.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6076	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\779493619AC6C264998DA7CB161F18B0\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\ProductName = "GitHub CLI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\SourceList\PackageName = "gh_2.97.0_windows_amd64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\779493619AC6C264998DA7CB161F18B0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\PackageCode = "F3F177D5F76CE3346A644FC2C97C1466"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\Version = "39911424"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\779493619AC6C264998DA7CB161F18B0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1359BFC8959BB1E4AAE2A40FFFCCA44F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1359BFC8959BB1E4AAE2A40FFFCCA44F\779493619AC6C264998DA7CB161F18B0	msiexec.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1928	msiexec.exe
1928	msiexec.exe
4888	powershell.exe
4888	powershell.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	1928	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeMachineAccountPrivilege	6076	msiexec.exe
Token: SeTcbPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	6076	msiexec.exe
Token: SeTakeOwnershipPrivilege	6076	msiexec.exe
Token: SeLoadDriverPrivilege	6076	msiexec.exe
Token: SeSystemProfilePrivilege	6076	msiexec.exe
Token: SeSystemtimePrivilege	6076	msiexec.exe
Token: SeProfSingleProcessPrivilege	6076	msiexec.exe
Token: SeIncBasePriorityPrivilege	6076	msiexec.exe
Token: SeCreatePagefilePrivilege	6076	msiexec.exe
Token: SeCreatePermanentPrivilege	6076	msiexec.exe
Token: SeBackupPrivilege	6076	msiexec.exe
Token: SeRestorePrivilege	6076	msiexec.exe
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeDebugPrivilege	6076	msiexec.exe
Token: SeAuditPrivilege	6076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6076	msiexec.exe
Token: SeChangeNotifyPrivilege	6076	msiexec.exe
Token: SeRemoteShutdownPrivilege	6076	msiexec.exe
Token: SeUndockPrivilege	6076	msiexec.exe
Token: SeSyncAgentPrivilege	6076	msiexec.exe
Token: SeEnableDelegationPrivilege	6076	msiexec.exe
Token: SeManageVolumePrivilege	6076	msiexec.exe
Token: SeImpersonatePrivilege	6076	msiexec.exe
Token: SeCreateGlobalPrivilege	6076	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeMachineAccountPrivilege	6076	msiexec.exe
Token: SeTcbPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	6076	msiexec.exe
Token: SeTakeOwnershipPrivilege	6076	msiexec.exe
Token: SeLoadDriverPrivilege	6076	msiexec.exe
Token: SeSystemProfilePrivilege	6076	msiexec.exe
Token: SeSystemtimePrivilege	6076	msiexec.exe
Token: SeProfSingleProcessPrivilege	6076	msiexec.exe
Token: SeIncBasePriorityPrivilege	6076	msiexec.exe
Token: SeCreatePagefilePrivilege	6076	msiexec.exe
Token: SeCreatePermanentPrivilege	6076	msiexec.exe
Token: SeBackupPrivilege	6076	msiexec.exe
Token: SeRestorePrivilege	6076	msiexec.exe
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeDebugPrivilege	6076	msiexec.exe
Token: SeAuditPrivilege	6076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6076	msiexec.exe
Token: SeChangeNotifyPrivilege	6076	msiexec.exe
Token: SeRemoteShutdownPrivilege	6076	msiexec.exe
Token: SeUndockPrivilege	6076	msiexec.exe
Token: SeSyncAgentPrivilege	6076	msiexec.exe
Token: SeEnableDelegationPrivilege	6076	msiexec.exe
Token: SeManageVolumePrivilege	6076	msiexec.exe
Token: SeImpersonatePrivilege	6076	msiexec.exe
Token: SeCreateGlobalPrivilege	6076	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6076	msiexec.exe
6076	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6076	msiexec.exe
1928	msiexec.exe
5676	MsiExec.exe
4092	MsiExec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 5676	1928	msiexec.exe	91
PID 1928 wrote to memory of 3516	1928	msiexec.exe	97
PID 1928 wrote to memory of 4092	1928	msiexec.exe	99
PID 5552 wrote to memory of 5872	5552	powershell.exe	104
PID 5872 wrote to memory of 2196	5872	gh.exe	105
PID 5552 wrote to memory of 5316	5552	powershell.exe	106
PID 5316 wrote to memory of 4804	5316	gh.exe	107
PID 5552 wrote to memory of 3300	5552	powershell.exe	108
PID 3300 wrote to memory of 4200	3300	gh.exe	109
PID 5552 wrote to memory of 1408	5552	powershell.exe	110
PID 1408 wrote to memory of 5892	1408	gh.exe	111
PID 5552 wrote to memory of 1832	5552	powershell.exe	112
PID 1832 wrote to memory of 5324	1832	gh.exe	113
PID 5552 wrote to memory of 2796	5552	powershell.exe	114
PID 2796 wrote to memory of 1120	2796	gh.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gh_2.97.0_windows_amd64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA38E709873656D9C5CAF2621EBA1370 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5676
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3516
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 60569C27DFC590F5CF1BCF5BC02AB480
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Program Files\GitHub CLI\gh.exe
  "C:\Program Files\GitHub CLI\gh.exe" --version
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\system32\tzutil.exe
    tzutil /g
    3⤵
    PID:2196
- C:\Program Files\GitHub CLI\gh.exe
  "C:\Program Files\GitHub CLI\gh.exe" config set telemetry disabled
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\system32\tzutil.exe
    tzutil /g
    3⤵
    PID:4804
- C:\Program Files\GitHub CLI\gh.exe
  "C:\Program Files\GitHub CLI\gh.exe" auto login
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\tzutil.exe
    tzutil /g
    3⤵
    PID:4200
- C:\Program Files\GitHub CLI\gh.exe
  "C:\Program Files\GitHub CLI\gh.exe" config set telemtry enable
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\tzutil.exe
    tzutil /g
    3⤵
    PID:5892
- C:\Program Files\GitHub CLI\gh.exe
  "C:\Program Files\GitHub CLI\gh.exe" config set telemtry enable
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\tzutil.exe
    tzutil /g
    3⤵
    PID:5324
- C:\Program Files\GitHub CLI\gh.exe
  "C:\Program Files\GitHub CLI\gh.exe" repo view cli/cli
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\tzutil.exe
    tzutil /g
    3⤵
    PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f3be.rbs

Path C:\Config.Msi\e59f3be.rbs
Size 8KB
SHA256 24649ef19491314577c5648b5a083845f430cd4d67153a674a8a8856834fda57
MD5 44daa3acaf631d14dd1c537bb8f59bf5
SHA1 83da03687a205e033fdf4abaaeea3d924e6336a1
SHA512 dffcbc7a7b298521890ad46ab607ba6fd839b8690796632a8a2d653a3ef9468b55a63a0a5919320b836e585cda5fedb94758d201d1c634ce25fb130285b701d9
SSDEEP 96:dmKIBoQo3stZnKCPIuQ4UAL1glCsTlfm4UAL1glC6jNb1ZTlfZFR5WXW5oJVCCpP:Aby3QKCfQXxYIwXxYAP6CCpP
TLSH
T124025051676082E2E85AE735C70347203BB3D7E9A310A34B0ADCA1705F82B599F9768E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh.exe

Path C:\Program Files\GitHub CLI\gh.exe
Size 39.8MB
SHA256 e2efa10a5d2ce93cac9bc4b676932b62947c0967c01c8f2c3a9cb4437ad358d3
MD5 f0cc29de676806eb691a7a13d36cdfe1
SHA1 194f39e80434ff6ba05ee59448d40406ca864088
SHA512 f0a0a0787ddca2742041126ffd5fbaa5aefc3fac319fa354d474bc8b3ca4daafe7db8fa8bcbfc8d501935bc059219116fea14a006ab4502b907ef3ff5bdc4a67
SSDEEP 196608:W5poDJ2uwILLHE8NwIBvYorLOg4nkkAvD9nfakx3Fv9kFj:W7o9k8uZ5g4nLABniK9Mj
TLSH
T15D973943F8A50CE5D4ADC935C56286137F627CA9872423C77B58FA206F3ABD096BB350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

device-id

Path C:\Users\Admin\AppData\Local\GitHub CLI\device-id
Size 36B
SHA256 fde2162340925fa1c80d6e0ec057e127bea70095fcc582106d61d3310db20a11
MD5 2eedd912f2b1a1c53a853159e69d24b3
SHA1 a2e0e88dd0a8a7b2b42d04ac0353068b3c35c92f
SHA512 c94e3579b47ea3a28f3e43b4ebe8e573ae225d9a17b4d727f4d4307fd2b8f52b994bab7095bd164569d9c40441c88da5e144295773d9441bac0033e7b461b9a0
MD5 SHA1 SHA512

Submit Download

MSI8B4E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8B4E.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hclqwqti.jez.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hclqwqti.jez.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

config.yml

Path C:\Users\Admin\AppData\Roaming\GitHub CLI\config.yml
Size 1KB
SHA256 cddb6bd378d25ee98302124ec7eb62a2ba7f58d148a74fa2dbc870f6413484cd
MD5 91b94d36ec4847fe080224a756270ad3
SHA1 fab51141b56ea87956500324afcb6b449a15ce4f
SHA512 d98cb1a164260c58f6ecc299854a4974a649806df18daddb83237e2b0da493841dd68f0e440bd667293ddd9e545be7140f2e542f80fba0092166ff648fe230d0
TLSH
T11C31146769A132260E075042E259C3BE93988575637339F9686C72EC910752CC3ABF7D
MD5 SHA1 SHA512 TLSH

Submit Download

config.yml

Path C:\Users\Admin\AppData\Roaming\GitHub CLI\config.yml
Size 1KB
SHA256 d6d81808f5dda5f8a18aa73100a318d0e22797b942fb19339f4f67afbab1eb97
MD5 2f8643028cefc4f942af49f07855fb4b
SHA1 b6587808183658edddafbd458c3e2b449896b39b
SHA512 cce13fd23ffb88e148b988ecdc34f5095170bcfc67573814427db2cc2aeb570dcb046aa9c701d472846eb2a84efc203d87dca4bdd17d6b5fe38865b927d098ca
TLSH
T1EE31147769A132260E07A042E259C3BE93988575637339F9686C73EC910752CC3ABF7D
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1A8.tmp

Path C:\Windows\Installer\MSI1A8.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f3bd.msi

Path C:\Windows\Installer\e59f3bd.msi
Size 14.5MB
SHA256 942865de5f19c42fdae32b77988f8d68e72ff78deef26b93d970b494bc2c7e87
MD5 12847da3d29ccbd956f443b9c00f551e
SHA1 668b517b9fc3fbf7bd63f2dc4bda33fadaa530f5
SHA512 2469794dad81e337795e6f0d5d475fe071e915ad65c6537188d4a6e7a31bcecab686cfb2b0f1a135a6e37f5147e9e8f354e18d15e0cdb6474db1b8f2d4f420d8
SSDEEP 393216:xJZYrCOyZJyIJluezLUtltu8mjWiuk9FUzsBPNUDLUzzQraPNc5n:+rCOyZJJurtDbFiukHBPNvEraPNc
TLSH
T1FAE633037C405637C5AB0D718AF75721AE68FE181B94884B63757A89FEF25C04B327EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 357f163e385baaaaeddd6b178b41dd98ead80d76c425d59436c45ca998a70ad6
MD5 b1e74d652ca752d22c15d0bd2053c48a
SHA1 13b0a644b9f9b19dff0e1855c61483b3ff7eff2b
SHA512 85fdf34791675b535fbe07218b72fc82423afa40b42d46a8809decaf2a47ca85826595d2a6c0739c1e86a931dee008665c766f863c296e5f160d13b967c1a02b
SSDEEP 24576:xFo3DMPvdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:zHU
TLSH
T17457B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{dadc53fe-4155-4074-8aae-44b526f16840}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{dadc53fe-4155-4074-8aae-44b526f16840}_OnDiskSnapshotProp
Size 6KB
SHA256 bfb7f1cc9f56ac7a9bbd0e936ed228776de9e42252b44076965f3e2fd21f5a30
MD5 51af7fa8e037df792e3326b9c803991f
SHA1 b814977f7153c8fa7608dc0b735b999078474b9a
SHA512 57e7b14bf7105b56906f13dda3f9cce5a6de51dafdadeb18c9312df6f048dc3e715ad6967b43e0d38f5b17810f8d72c8ccf56479b133655d2ff85fe157bd4715
SSDEEP 96:FRm70Cvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:vdeb++uVm
TLSH
T148D188081AF54711E2B3AB7129F14557A837B811FF33CB8E0198638E2671A10F936F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4888-35-0x0000000005DF0000-0x000000000643A000-memory.dmp

Download

memory/4888-36-0x0000000005C20000-0x0000000005C42000-memory.dmp

Download

memory/4888-34-0x0000000005720000-0x0000000005756000-memory.dmp

Download

memory/4888-41-0x0000000006520000-0x000000000687B000-memory.dmp

Download

memory/4888-38-0x00000000064B0000-0x0000000006516000-memory.dmp

Download

memory/4888-37-0x0000000006440000-0x00000000064A6000-memory.dmp

Download

memory/5552-65-0x00000246B1C80000-0x00000246B1C9E000-memory.dmp

Download

memory/5552-63-0x00000246B1BA0000-0x00000246B1C52000-memory.dmp

Download

memory/5552-64-0x00000246B1A20000-0x00000246B1A2A000-memory.dmp

Download

memory/5552-44-0x00000246B1620000-0x00000246B1642000-memory.dmp

Download

memory/5552-66-0x00000246B1C60000-0x00000246B1C6A000-memory.dmp

Download

memory/5552-67-0x00000246B20D0000-0x00000246B20EC000-memory.dmp

Download

memory/5552-68-0x00000246B1C70000-0x00000246B1C78000-memory.dmp

Download

memory/5552-69-0x00000246B1CA0000-0x00000246B1CA6000-memory.dmp

Download

memory/5552-70-0x00000246B1CB0000-0x00000246B1CBA000-memory.dmp

Download

memory/5552-62-0x00000246B1B80000-0x00000246B1B9E000-memory.dmp

Download

memory/5552-47-0x00000246B1A30000-0x00000246B1A78000-memory.dmp

Download