Technical Information
Malicious functions
Injects code into
the following user processes:
- git_installer.exe
Modifies file system
Creates the following files
- %TEMP%\7ze1a857b0\chrome_100_percent.pak
- %TEMP%\7ze1a857b0\chrome_200_percent.pak
- %TEMP%\7ze1a857b0\icudtl.dat
- %TEMP%\7ze1a857b0\license.electron.txt
- %TEMP%\7ze1a857b0\licenses.chromium.html
- %TEMP%\7ze1a857b0\locales\af.pak
- %TEMP%\7ze1a857b0\locales\am.pak
- %TEMP%\7ze1a857b0\locales\ar.pak
- %TEMP%\7ze1a857b0\locales\bg.pak
- %TEMP%\7ze1a857b0\locales\bn.pak
- %TEMP%\7ze1a857b0\locales\ca.pak
- %TEMP%\7ze1a857b0\locales\cs.pak
- %TEMP%\7ze1a857b0\locales\da.pak
- %TEMP%\7ze1a857b0\locales\de.pak
- %TEMP%\7ze1a857b0\locales\el.pak
- %TEMP%\7ze1a857b0\locales\en-gb.pak
- %TEMP%\7ze1a857b0\locales\en-us.pak
- %TEMP%\7ze1a857b0\locales\es-419.pak
- %TEMP%\7ze1a857b0\locales\es.pak
- %TEMP%\7ze1a857b0\locales\et.pak
- %TEMP%\7ze1a857b0\locales\fa.pak
- %TEMP%\7ze1a857b0\locales\fi.pak
- %TEMP%\7ze1a857b0\locales\fil.pak
- %TEMP%\7ze1a857b0\locales\fr.pak
- %TEMP%\7ze1a857b0\locales\gu.pak
- %TEMP%\7ze1a857b0\locales\he.pak
- %TEMP%\7ze1a857b0\locales\hi.pak
- %TEMP%\7ze1a857b0\locales\hr.pak
- %TEMP%\7ze1a857b0\locales\hu.pak
- %TEMP%\7ze1a857b0\locales\id.pak
- %TEMP%\7ze1a857b0\locales\it.pak
- %TEMP%\7ze1a857b0\locales\ja.pak
- %TEMP%\7ze1a857b0\locales\kn.pak
- %TEMP%\7ze1a857b0\locales\ko.pak
- %TEMP%\7ze1a857b0\locales\lt.pak
- %TEMP%\7ze1a857b0\locales\lv.pak
- %TEMP%\7ze1a857b0\locales\ml.pak
- %TEMP%\7ze1a857b0\locales\mr.pak
- %TEMP%\7ze1a857b0\locales\ms.pak
- %TEMP%\7ze1a857b0\locales\nb.pak
- %TEMP%\7ze1a857b0\locales\nl.pak
- %TEMP%\7ze1a857b0\locales\pl.pak
- %TEMP%\7ze1a857b0\locales\pt-br.pak
- %TEMP%\7ze1a857b0\locales\pt-pt.pak
- %TEMP%\7ze1a857b0\locales\ro.pak
- %TEMP%\7ze1a857b0\locales\ru.pak
- %TEMP%\7ze1a857b0\locales\sk.pak
- %TEMP%\7ze1a857b0\locales\sl.pak
- %TEMP%\7ze1a857b0\locales\sr.pak
- %TEMP%\7ze1a857b0\locales\sv.pak
- %TEMP%\7ze1a857b0\locales\sw.pak
- %TEMP%\7ze1a857b0\locales\ta.pak
- %TEMP%\7ze1a857b0\locales\te.pak
- %TEMP%\7ze1a857b0\locales\th.pak
- %TEMP%\7ze1a857b0\locales\tr.pak
- %TEMP%\7ze1a857b0\locales\uk.pak
- %TEMP%\7ze1a857b0\locales\ur.pak
- %TEMP%\7ze1a857b0\locales\vi.pak
- %TEMP%\7ze1a857b0\locales\zh-cn.pak
- %TEMP%\7ze1a857b0\locales\zh-tw.pak
- %TEMP%\7ze1a857b0\resources\app.asar
- %TEMP%\7ze1a857b0\resources.pak
- %TEMP%\7ze1a857b0\snapshot_blob.bin
- %TEMP%\7ze1a857b0\v8_context_snapshot.bin
- %TEMP%\7ze1a857b0\vk_swiftshader_icd.json
- %TEMP%\7ze1a857b0\d3dcompiler_47.dll
- %TEMP%\7ze1a857b0\ffmpeg.dll
- %TEMP%\7ze1a857b0\git_installer.exe
- %TEMP%\7ze1a857b0\libegl.dll
- %TEMP%\7ze1a857b0\libglesv2.dll
- %TEMP%\7ze1a857b0\vk_swiftshader.dll
- %TEMP%\7ze1a857b0\vulkan-1.dll
- %APPDATA%\github-installer\code cache\js\index
- %APPDATA%\github-installer\local storage\leveldb\log
- %APPDATA%\github-installer\local storage\leveldb\manifest-000001
- %APPDATA%\github-installer\code cache\wasm\index
- %APPDATA%\github-installer\local storage\leveldb\000001.dbtmp
- %APPDATA%\github-installer\code cache\wasm\index-dir\temp-index
- %APPDATA%\github-installer\code cache\js\index-dir\temp-index
- %APPDATA%\github-installer\gpucache\index
- %APPDATA%\github-installer\gpucache\data_0
- %APPDATA%\github-installer\gpucache\data_1
- %APPDATA%\github-installer\gpucache\data_2
- %APPDATA%\github-installer\gpucache\data_3
- %APPDATA%\github-installer\dawnwebgpucache\index
- %APPDATA%\github-installer\dawnwebgpucache\data_0
- %APPDATA%\github-installer\dawnwebgpucache\data_1
- %APPDATA%\github-installer\dawnwebgpucache\data_2
- %APPDATA%\github-installer\dawnwebgpucache\data_3
- %APPDATA%\github-installer\dawngraphitecache\index
- %APPDATA%\github-installer\dawngraphitecache\data_0
- %APPDATA%\microsoft\spelling\en-us\default.dic
- %APPDATA%\github-installer\dawngraphitecache\data_1
- %APPDATA%\github-installer\dawngraphitecache\data_2
- %APPDATA%\microsoft\spelling\en-us\default.exc
- %APPDATA%\github-installer\dawngraphitecache\data_3
- %APPDATA%\microsoft\spelling\en-us\default.acl
- %APPDATA%\github-installer\shared dictionary\cache\index
- %APPDATA%\github-installer\shared dictionary\db-journal
- %APPDATA%\github-installer\dips-journal
- %APPDATA%\github-installer\network\trust tokens-journal
- %APPDATA%\github-installer\shared dictionary\db
- %APPDATA%\github-installer\shared dictionary\cache\index-dir\temp-index
- %APPDATA%\github-installer\network\trust tokens
- %APPDATA%\github-installer\dips
- %APPDATA%\github-installer\dips-shm
- %APPDATA%\github-installer\dips-wal
- %APPDATA%\github-installer\network\cookies-journal
- %APPDATA%\github-installer\network\cookies
- %APPDATA%\github-installer\cache\cache_data\index
- %APPDATA%\github-installer\cache\cache_data\data_0
- %APPDATA%\github-installer\cache\cache_data\data_1
- %APPDATA%\github-installer\cache\cache_data\data_2
- %APPDATA%\github-installer\cache\cache_data\data_3
- %APPDATA%\github-installer\cache\cache_data\f_000001
- %APPDATA%\github-installer\cache\cache_data\f_000002
- %APPDATA%\github-installer\3e822a53-0c4f-4543-a01e-a7303a1e3a04.tmp
- %APPDATA%\github-installer\fae670b7-735b-4d5d-8687-ce284fe39c14.tmp
- %TEMP%\s.ps1
- %APPDATA%\github-installer\network\f847126f-fe9f-49df-955f-c36a284857dc.tmp
- %TEMP%\screen.jpg
- nul
- %APPDATA%\github-installer\network\3ae19d0c-15e4-41b2-abac-e089a3a07757.tmp
Deletes following files that it created itself
- %APPDATA%\github-installer\dips-journal
- %TEMP%\screen.jpg
- %TEMP%\s.ps1
Moves the following files
- from %APPDATA%\github-installer\code cache\wasm\index-dir\temp-index to %APPDATA%\github-installer\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\github-installer\local storage\leveldb\000001.dbtmp to %APPDATA%\github-installer\local storage\leveldb\current
- from %APPDATA%\github-installer\code cache\js\index-dir\temp-index to %APPDATA%\github-installer\code cache\js\index-dir\the-real-index
- from %APPDATA%\github-installer\shared dictionary\cache\index-dir\temp-index to %APPDATA%\github-installer\shared dictionary\cache\index-dir\the-real-index
- from %APPDATA%\github-installer\3e822a53-0c4f-4543-a01e-a7303a1e3a04.tmp to %APPDATA%\github-installer\local state
- from %APPDATA%\github-installer\fae670b7-735b-4d5d-8687-ce284fe39c14.tmp to %APPDATA%\github-installer\preferences
- from %APPDATA%\github-installer\network\f847126f-fe9f-49df-955f-c36a284857dc.tmp to %APPDATA%\github-installer\network\network persistent state
Network activity
Connects to
- 'ip##i.co':443
- 'fo###.#oogleapis.com':443
- 'ap#.##legram.org':443
TCP
Other
- 'ip##i.co':443
- 'fo###.#oogleapis.com':443
- 'ap#.##legram.org':443
- 'fo###.gstatic.com':443
UDP
- DNS ASK ip##i.co
- DNS ASK fo###.#oogleapis.com
- DNS ASK ap#.##legram.org
- DNS ASK fo###.gstatic.com
- 'fo###.gstatic.com':443
Miscellaneous
Creates and executes the following
- '%TEMP%\7ze1a857b0\git_installer.exe'
- '%TEMP%\7ze1a857b0\git_installer.exe' --type=gpu-process --user-data-dir="%APPDATA%\github-installer" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAA...
- '%TEMP%\7ze1a857b0\git_installer.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\github-installer" --field-trial-handle=1700,i,8044216739931659...
- '%TEMP%\7ze1a857b0\git_installer.exe' --type=renderer --user-data-dir="%APPDATA%\github-installer" --app-path="%TEMP%\7zE1A857B0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --devi...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "%TEMP%\s.ps1"
- '%TEMP%\7ze1a857b0\git_installer.exe' --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="%...
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get manufacturer"
- '<SYSTEM32>\wbem\wmic.exe' computersystem get manufacturer
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxMouse""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxMouse"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxService""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxService"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs""
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get size"
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get size
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -ExecutionPolicy Bypass -File "%TEMP%\s.ps1""
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get manufacturer"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxMouse""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxService""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get size"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -ExecutionPolicy Bypass -File "%TEMP%\s.ps1""' (with hidden window)
