Edit tour

Windows Analysis Report
http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip

Overview

General Information

Sample URL:	http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip
Analysis ID:	755944
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Found strings related to Crypto-Mining

Creates a DirectInput object (often for capturing keystrokes)

Drops PE files

PE file contains sections with non-standard names

Found dropped PE file which has not been started or loaded

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4568 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 2032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1688,i,3397768869367393147,5374517795823175940,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 7068 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\git-scm.zip MD5: B89F9ADB5A6E465B6EB4575913CD2687)

7za.exe (PID: 6812 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3" "C:\Users\user\Downloads\git-scm.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 6208 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /fgsdsaewrewf/downsreps1/downloads/git-scm.zip HTTP/1.1Host: bitbucket.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /d514dc8e-d997-48d3-b917-bb42f589d297/downloads/483e5252-5043-4c2e-9ac6-11db96ba8916/git-scm.zip?response-content-disposition=attachment%3B%20filename%3D%22git-scm.zip%22&AWSAccessKeyId=ASIA6KOSE3BNKAJJPTDQ&Signature=bRjYfTJdz0c6s%2F4Aogp6lio1mHc%3D&x-amz-security-token=FwoGZXIvYXdzEFMaDBh8tuHL8eqUWLWjrSK%2BAS6J7aVzmoERxdzw%2FQCZyO2eyJ5I8qLxUmdKwyTwcCOWBy71kqONDRhErtN0SWeyWAuVlrPQ7MxTUWnqnSGuoM%2FXQp5KZqkdtQcUosMw8jaNyWaH8zRdn2RTlIyO%2FFeXVEwY5PYkbkN23P5PxTFV6Emiod8xDqbF8PTFGSbjCAcoeVu53BViAX2YConqYc2swPryu0VOG%2B8HtwFm4ArbDQSxZr44FQ7dO7TDxDlcqu9PEDZRxzbT%2FD839vhGUKoorKmXnAYyLcXNqSrkc7rdQg%2BU36TpYIgUjJLQB4qn828RU71NPpJ37Imrl7UExSrmSqQ7bg%3D%3D&Expires=1669716916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /fgsdsaewrewf/downsreps1/downloads/git-scm.zip HTTP/1.1Host: bitbucket.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unarchiver.exe, 00000005.00000002.592168618.000000000093B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: git-scm.exe.6.dr

Static PE information: Section: A7aQ5eE ZLIB complexity 0.9989115918803418

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1688,i,3397768869367393147,5374517795823175940,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\git-scm.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3" "C:\Users\user\Downloads\git-scm.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1688,i,3397768869367393147,5374517795823175940,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\git-scm.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3" "C:\Users\user\Downloads\git-scm.zip	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: .gitignore0.6.dr

Binary or memory string: *.sln

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\db377158-cdde-4495-b6ce-3ebd68e182c1.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: classification engine

Classification label: mal52.mine.win@34/691@9/8

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: git-scm.exe.6.dr

Static PE information: section name: A7aQ5eE

Source: C:\Windows\SysWOW64\7za.exe

File created: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git-scm.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git-scm.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 5_2_00C3B1D6 GetSystemInfo,

5_2_00C3B1D6

Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\android\features\tab_ui	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\android\features\tab_ui\java	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\android\features\tab_ui\java\src	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\android\features\tab_ui\java\src\org	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\android\features\tab_ui\java\src\org\chromium	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\android\features\tab_ui\java\src\org\chromium\chrome	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3" "C:\Users\user\Downloads\git-scm.zip

Source: disconnect_entitylist.json.6.dr	String found in binary or memory: "jsecoin.com"
Source: disconnect_entitylist.json.6.dr	String found in binary or memory: "coinhive.com"

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: Utils.java.6.dr, TabUtils.java.6.dr, AddAccountActivity.java.6.dr, PortfolioFragment.java.6.dr, android_browser_tests.gni.6.dr, BraveDynamicColors.java.6.dr, CloseBraveManager.java.6.dr, AddressUtils.java.6.dr, BravePasswordSettingsBase.java.6.dr, CrossPromotionalModalDialogFragment.java.6.dr, SearchEngineOnboardingFragment.java.6.dr, BraveSettingsLauncherImpl.java.6.dr, BraveSearchEnginePreference.java.6.dr, BraveBaseSearchEngineAdapter.java.6.dr, NetworkResponsesCollector.java.6.dr, FragmentNavigationItemAdapter.java.6.dr, BraveSyncScreensPreference.java.6.dr, BraveAdaptiveCaptchaUtils.java.6.dr, BraveNotificationPlatformBridge.java.6.dr, BraveRewardsTipConfirmationFragment.java.6.dr, BraveTabGroupUiCoordinator.java.6.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: slide_out_top.xml.6.dr	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: BarcodeTrackerFactory.java.6.dr, BarcodeTracker.java.6.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: BraveReferrer.java.6.dr	String found in binary or memory: http://www.stub.co/?
Source: Utils.java.6.dr	String found in binary or memory: https://0x.org/
Source: BraveRewardsOnboardingFragment.java.6.dr, BraveActivity.java.6.dr	String found in binary or memory: https://basicattentiontoken.org/user-terms-of-service/
Source: BraveActivity.java.6.dr	String found in binary or memory: https://brave.com/faq-rewards/#unclaimed-funds
Source: BraveSetDefaultBrowserUtils.java.6.dr	String found in binary or memory: https://brave.com/privacy-features/
Source: BraveActivity.java.6.dr	String found in binary or memory: https://brave.com/privacy/#rewards
Source: WelcomeOnboardingActivity.java.6.dr	String found in binary or memory: https://brave.com/privacy/browser/#how-we-improve-brave
Source: chromium_minor_bump.md.6.dr, BraveExternalNavigationHandler.java.6.dr, PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: BraveHelpAndFeedbackLauncherImpl.java.6.dr	String found in binary or memory: https://community.brave.com/
Source: AppMenuIconRowFooter.java.6.dr	String found in binary or memory: https://crbug.com/891593
Source: disconnect_entitylist.json.6.dr	String found in binary or memory: https://creativecommons.org/licenses/by-nc-sa/4.0/.
Source: disconnect_entitylist.json.6.dr	String found in binary or memory: https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode.txt.
Source: BraveSetDefaultBrowserUtils.java.6.dr	String found in binary or memory: https://developer.android.com/reference/android/provider/Settings#ACTION_MANAGE_DEFAULT_APPS_SETTING
Source: WalletConstants.java.6.dr	String found in binary or memory: https://doc.aurora.dev/bridge/bridge-overview/
Source: codeql-analysis.yml.6.dr	String found in binary or memory: https://docs.github.com/en/free-pro-team
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue)
Source: codeql-analysis.yml.6.dr	String found in binary or memory: https://git.io/JvXDl
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/issues)
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes
Source: PULL_REQUEST_TEMPLATE.md.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Brave-Wallet
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Custom-Headers
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/P3A
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/QA-Guide
Source: PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Security-reviews)
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave
Source: manager.js.6.dr	String found in binary or memory: https://github.com/brave/brave-core
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://github.com/brave/security/issues/new/choose)
Source: PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	String found in binary or memory: https://google.github.io/eng-practices/review/developer/cl-descriptions.html)
Source: RateFeedbackUtils.java.6.dr	String found in binary or memory: https://laptop-updates.brave.com/1/feedback
Source: BraveShieldsUtils.java.6.dr	String found in binary or memory: https://laptop-updates.brave.com/1/webcompat
Source: BraveVpnPreferences.java.6.dr	String found in binary or memory: https://play.google.com/store/account/subscriptions
Source: WalletConstants.java.6.dr	String found in binary or memory: https://rainbowbridge.app
Source: WalletConstants.java.6.dr	String found in binary or memory: https://rainbowbridge.app/approvals
Source: Utils.java.6.dr	String found in binary or memory: https://support.brave.com
Source: BraveWebrtcPolicyPreference.java.6.dr	String found in binary or memory: https://support.brave.com/hc/en-us/articles/360017989132-How-do-I-change-my-Privacy-Settings-#webrtc
Source: BraveVpnPreferences.java.6.dr	String found in binary or memory: https://support.brave.com/hc/en-us/articles/360045045952
Source: NotificationIntent.java.6.dr	String found in binary or memory: https://support.brave.com/hc/en-us/articles/360045401211/
Source: WalletConstants.java.6.dr	String found in binary or memory: https://support.brave.com/hc/en-us/articles/4409513799693
Source: SponsoredImageUtil.java.6.dr	String found in binary or memory: https://www.instagram.com/vass_captures/

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	3 Masquerading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label
https://0x.org/	0%	Avira URL Cloud	safe
https://crbug.com/891593	0%	Avira URL Cloud	safe
https://doc.aurora.dev/bridge/bridge-overview/	0%	Avira URL Cloud	safe
https://git.io/JvXDl	0%	Avira URL Cloud	safe
https://rainbowbridge.app/approvals	0%	Avira URL Cloud	safe
https://rainbowbridge.app	0%	Avira URL Cloud	safe
https://google.github.io/eng-practices/review/developer/cl-descriptions.html)	0%	Avira URL Cloud	safe
http://www.stub.co/?	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.216.43.17	true	false	high
bitbucket.org	104.192.141.1	true	false	high
accounts.google.com	172.217.168.45	true	false	high
www.google.com	172.217.168.36	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip	false	high
http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/brave/brave-core	manager.js.6.dr	false		high
https://laptop-updates.brave.com/1/webcompat	BraveShieldsUtils.java.6.dr	false		high
https://doc.aurora.dev/bridge/bridge-overview/	WalletConstants.java.6.dr	false	Avira URL Cloud: safe	unknown
https://brave.com/privacy-features/	BraveSetDefaultBrowserUtils.java.6.dr	false		high
https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://brave.com/privacy/#rewards	BraveActivity.java.6.dr	false		high
https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue)	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode.txt.	disconnect_entitylist.json.6.dr	false		high
https://laptop-updates.brave.com/1/feedback	RateFeedbackUtils.java.6.dr	false		high
https://crbug.com/891593	AppMenuIconRowFooter.java.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/brave/brave-browser/wiki/Security-reviews)	PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
http://mozilla.org/MPL/2.0/.	Utils.java.6.dr, TabUtils.java.6.dr, AddAccountActivity.java.6.dr, PortfolioFragment.java.6.dr, android_browser_tests.gni.6.dr, BraveDynamicColors.java.6.dr, CloseBraveManager.java.6.dr, AddressUtils.java.6.dr, BravePasswordSettingsBase.java.6.dr, CrossPromotionalModalDialogFragment.java.6.dr, SearchEngineOnboardingFragment.java.6.dr, BraveSettingsLauncherImpl.java.6.dr, BraveSearchEnginePreference.java.6.dr, BraveBaseSearchEngineAdapter.java.6.dr, NetworkResponsesCollector.java.6.dr, FragmentNavigationItemAdapter.java.6.dr, BraveSyncScreensPreference.java.6.dr, BraveAdaptiveCaptchaUtils.java.6.dr, BraveNotificationPlatformBridge.java.6.dr, BraveRewardsTipConfirmationFragment.java.6.dr, BraveTabGroupUiCoordinator.java.6.dr	false		high
https://rainbowbridge.app/approvals	WalletConstants.java.6.dr	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/account/subscriptions	BraveVpnPreferences.java.6.dr	false		high
https://support.brave.com/hc/en-us/articles/4409513799693	WalletConstants.java.6.dr	false		high
https://0x.org/	Utils.java.6.dr	false	Avira URL Cloud: safe	unknown
https://developer.android.com/reference/android/provider/Settings#ACTION_MANAGE_DEFAULT_APPS_SETTING	BraveSetDefaultBrowserUtils.java.6.dr	false		high
https://github.com/brave/brave-browser/wiki/Custom-Headers	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://www.instagram.com/vass_captures/	SponsoredImageUtil.java.6.dr	false		high
https://brave.com/faq-rewards/#unclaimed-funds	BraveActivity.java.6.dr	false		high
https://github.com/brave/security/issues/new/choose)	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://chromium.googlesource.com/chromium/src/	chromium_minor_bump.md.6.dr, BraveExternalNavigationHandler.java.6.dr, PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://git.io/JvXDl	codeql-analysis.yml.6.dr	false	Avira URL Cloud: safe	unknown
https://rainbowbridge.app	WalletConstants.java.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/brave/brave-browser/wiki/Brave-Wallet	PULL_REQUEST_TEMPLATE.md.6.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	BarcodeTrackerFactory.java.6.dr, BarcodeTracker.java.6.dr	false		high
https://google.github.io/eng-practices/review/developer/cl-descriptions.html)	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://support.brave.com/hc/en-us/articles/360045401211/	NotificationIntent.java.6.dr	false		high
https://creativecommons.org/licenses/by-nc-sa/4.0/.	disconnect_entitylist.json.6.dr	false		high
https://brave.com/privacy/browser/#how-we-improve-brave	WelcomeOnboardingActivity.java.6.dr	false		high
https://community.brave.com/	BraveHelpAndFeedbackLauncherImpl.java.6.dr	false		high
https://github.com/brave/brave-browser/wiki/P3A	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
http://schemas.android.com/apk/res/android	slide_out_top.xml.6.dr	false		high
https://basicattentiontoken.org/user-terms-of-service/	BraveRewardsOnboardingFragment.java.6.dr, BraveActivity.java.6.dr	false		high
http://www.stub.co/?	BraveReferrer.java.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.github.com/en/free-pro-team	codeql-analysis.yml.6.dr	false		high
https://support.brave.com/hc/en-us/articles/360017989132-How-do-I-change-my-Privacy-Settings-#webrtc	BraveWebrtcPolicyPreference.java.6.dr	false		high
https://support.brave.com	Utils.java.6.dr	false		high
https://support.brave.com/hc/en-us/articles/360045045952	BraveVpnPreferences.java.6.dr	false		high
https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://github.com/brave/brave-browser/wiki/QA-Guide	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high
https://github.com/brave/brave-browser/issues)	PULL_REQUEST_TEMPLATE.md.6.dr, PULL_REQUEST_TEMPLATE.md0.6.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
52.216.43.17	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
104.192.141.1	bitbucket.org	United States	16509	AMAZON-02US	false
172.217.168.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	755944
Start date and time:	2022-11-29 10:44:05 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.mine.win@34/691@9/8
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 38 Number of non-executed functions: 0

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313213952
Entropy (8bit):	0.034522512015418165
Encrypted:	false
SSDEEP:	12288:x5wQHcGgQbHB8vC+hPb0A1GUjbMe08/AR:x5wkEQbH2FB8soRW
MD5:	A8B4698FF1496A0E54F6CBFA67CBE784
SHA1:	9BFC48BC1F5AACF8540E95CB80F7FF4DDAF9618D
SHA-256:	FC07959F5D918F5E8F737FBC6E955C5799BF3C3D820A2E1B7A398487568DBAF1
SHA-512:	ABD8571D5C9254F225A928A150E96EF785B0726D43720BE4C011DEF48A2492CA35A30E61717031DEA006430DC37BA6CFFF6F21DF8574A8D1EB6D7ACF2200C705
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`...`...`...c...`...e...`...d...`...c...`...e..`...d...`...a...`...a.?.`...e...`.....`...b...`.Rich..`.........PE..L....\|c..........................................@.......................................@.....................................(....`..,....................0...!......8...........................(...@...............P............................text............................... ..`.rdata..............................@..@.data....!..........................@....gfids.......@......................@..@.tls.........P......................@....rsrc...,....`......................@..@.reloc...!...0..."..................@..BA7aQ5eE......`......................@..@........................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	689
Entropy (8bit):	5.164717203060325
Encrypted:	false
SSDEEP:
MD5:	C2B72F6C7D33B14C3BF4C455F993D358
SHA1:	88C0BB65DE2F383A0DC78037642E3BED0F945411
SHA-256:	79848345799677C917952E39951294B8912FF78F9883AEAAC5EB8973A6D93D4B
SHA-512:	82163FADE3F36B9C5D17A511E6BDAF838970A66F9E52FC5A01A2F3A383750C108C7D5A97964C9D2D309ED27C5DCB6E8BFCAD4CCF7A8EA27D5615D123EB59F55B
Malicious:	false
Reputation:	low
Preview:	11/29/2022 10:45 AM: Unpack: C:\Users\user\Downloads\git-scm.zip..11/29/2022 10:45 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3..11/29/2022 10:45 AM: Received from standard out: ..11/29/2022 10:45 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..11/29/2022 10:45 AM: Received from standard out: ..11/29/2022 10:45 AM: Received from standard out: Scanning the drive for archives:..11/29/2022 10:45 AM: Received from standard out: 1 file, 64796422 bytes (62 MiB)..11/29/2022 10:45 AM: Received from standard out: ..11/29/2022 10:45 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\git-scm.zip..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	15745
Entropy (8bit):	7.9813459093658405
Encrypted:	false
SSDEEP:
MD5:	ACBE896EB9A2D50E08518C208543CEDC
SHA1:	DE3E33F87C1EC38A02253144F8721E36DBCC41EF
SHA-256:	FB56E1A6D4AEF87DB354A74085088AB7534122B6165EC8ACD517AE650CFBFC2E
SHA-512:	CDC28BF6F357ABA484EA7244B7D5ADB17AB18827C789EBAC6384120D0DB252A75195C8C64ED30148EC3E3D691B2AE25D003430527362206CFFB4CB372F4D70FF
Malicious:	false
Reputation:	low
Preview:	PK.........aU................git/PK..........xU6DI..q...D......git-scm.exe.].\|TG.....#...B..W(....@PI.6.\.+i...)RBk..*......#...l..V.....Zi.h.QIhi..Vli.D.xi.5...<.3.........'Z...........G.G.R.....+J."..)..O......(...Oi.,x~...Vg.\........w...O~...........o.....-.n......;.....M.....t......?.......................;...m.....MG..........r.]w..}.w.[Q.X........PR,#,....(..3..C..E...V.3...~.?#X.m.IGu.f ..c......fU....Vez{J.r..mS...T.2;....C....i......c...]._~...Y}.bH.j......[......r..C.>.{ .E..u.Mi.BxV.f.^.u._q.....h.}..&....... ...G[..Z...'uw;.;.9..U......M.:U.....D......}.r..v.......O.{w..........P....(QD......v.=....m...?.Y...)..,...p..=O./ruUu.E.~..O....F.g...)U.o.S...d`.~..~K.F...;.z]w.w_.Q....I.X'....'.y_..`.F.o..Zb.....f.......>m..&vnU..#.X.\3O...v..9o....(...4.........v.m;\#M..f.{.WP....Q.......N.w..Q...0(.~V.g(J~...%....:....~I....Z.R.{5......4...&.=..\..G.../.".jY..".'...W.t>Y..\|.[.F[z....W9......kK7.:.:.-..~k.U:.kt.S...wk...w.....

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2022 10:45:12.860362053 CET	192.168.2.4	8.8.8.8	0x2bc9	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:12.866660118 CET	192.168.2.4	8.8.8.8	0x554	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:13.236970901 CET	192.168.2.4	8.8.8.8	0xae70	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:15.268969059 CET	192.168.2.4	8.8.8.8	0xc358	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:15.477646112 CET	192.168.2.4	8.8.8.8	0xdc53	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:15.534902096 CET	192.168.2.4	8.8.8.8	0x6b7d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.310319901 CET	192.168.2.4	8.8.8.8	0x14ec	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:46:15.664331913 CET	192.168.2.4	8.8.8.8	0xb886	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:46:15.834960938 CET	192.168.2.4	8.8.8.8	0x68d4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2022 10:45:12.894131899 CET	8.8.8.8	192.168.2.4	0x554	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2022 10:45:12.894131899 CET	8.8.8.8	192.168.2.4	0x554	No error (0)	clients.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:12.898982048 CET	8.8.8.8	192.168.2.4	0x2bc9	No error (0)	accounts.google.com		172.217.168.45	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:13.258764029 CET	8.8.8.8	192.168.2.4	0xae70	No error (0)	bitbucket.org		104.192.141.1	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:15.297570944 CET	8.8.8.8	192.168.2.4	0xc358	No error (0)	bitbucket.org		104.192.141.1	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:15.495198011 CET	8.8.8.8	192.168.2.4	0xdc53	No error (0)	www.google.com		172.217.168.36	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:15.554085016 CET	8.8.8.8	192.168.2.4	0x6b7d	No error (0)	www.google.com		172.217.168.36	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.43.17	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.142.57	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.91.233	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.147.51	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.93.76	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.82.248	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.113.187	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:45:16.329972029 CET	8.8.8.8	192.168.2.4	0x14ec	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.128.9	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:46:15.681950092 CET	8.8.8.8	192.168.2.4	0xb886	No error (0)	www.google.com		172.217.168.36	A (IP address)	IN (0x0001)	false
Nov 29, 2022 10:46:15.854098082 CET	8.8.8.8	192.168.2.4	0x68d4	No error (0)	www.google.com		172.217.168.36	A (IP address)	IN (0x0001)	false

Timestamp	kBytes transferred	Direction	Data
2022-11-29 09:45:15 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-11-29 09:45:15 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-kZo0EYhDHEvdRo1KlRK5Uw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 29 Nov 2022 09:45:15 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5811 X-Daystart: 6315 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-11-29 09:45:15 UTC	2	IN	Data Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 31 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 36 33 31 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5811" elapsed_seconds="6315"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-11-29 09:45:15 UTC	2	IN	Data Raw: 76 59 6e 4d 76 4e 7a 49 30 51 55 46 58 4e 56 39 7a 54 32 52 76 64 55 77 79 4d 45 52 45 53 45 5a 47 56 6d 4a 6e 51 51 2f 31 2e 30 2e 30 2e 36 5f 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 Data Ascii: vYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size
2022-11-29 09:45:15 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-11-29 09:45:15 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-11-29 09:45:15 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-11-29 09:45:15 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 29 Nov 2022 09:45:15 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-UYc8xg2AS6w2U6vUiEKW6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-11-29 09:45:15 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-11-29 09:45:15 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-11-29 09:45:15 UTC	4	OUT	GET /fgsdsaewrewf/downsreps1/downloads/git-scm.zip HTTP/1.1 Host: bitbucket.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-11-29 09:45:16 UTC	5	IN	HTTP/1.1 302 Found content-security-policy-report-only: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com stats.g.doubleclick.net sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; object-src 'none'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 988152.120 vary: Accept-Language, Origin x-usage-request-cost: 11985.10 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: aa1d54b493ecbead x-usage-output-ops: 0 x-used-mesh: False x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Tue, 29 Nov 2022 09:45:16 GMT x-usage-user-time: 0.310486 x-usage-system-time: 0.049067 location: https://bbuseruploads.s3.amazonaws.com/d514dc8e-d997-48d3-b917-bb42f589d297/downloads/483e5252-5043-4c2e-9ac6-11db96ba8916/git-scm.zip?response-content-disposition=attachment%3B%20filename%3D%22git-scm.zip%22&AWSAccessKeyId=ASIA6KOSE3BNKAJJPTDQ&Signature=bRjYfTJdz0c6s%2F4Aogp6lio1mHc%3D&x-amz-security-token=FwoGZXIvYXdzEFMaDBh8tuHL8eqUWLWjrSK%2BAS6J7aVzmoERxdzw%2FQCZyO2eyJ5I8qLxUmdKwyTwcCOWBy71kqONDRhErtN0SWeyWAuVlrPQ7MxTUWnqnSGuoM%2FXQp5KZqkdtQcUosMw8jaNyWaH8zRdn2RTlIyO%2FFeXVEwY5PYkbkN23P5PxTFV6Emiod8xDqbF8PTFGSbjCAcoeVu53BViAX2YConqYc2swPryu0VOG%2B8HtwFm4ArbDQSxZr44FQ7dO7TDxDlcqu9PEDZRxzbT%2FD839vhGUKoorKmXnAYyLcXNqSrkc7rdQg%2BU36TpYIgUjJLQB4qn828RU71NPpJ37Imrl7UExSrmSqQ7bg%3D%3D&Expires=1669716916 expires: Tue, 29 Nov 2022 09:45:16 GMT x-served-by: 7bbf69ac56e4 x-envoy-upstream-service-time: 504 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 979082ecfb45 x-render-time: 0.4906888008117676 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 979082ecfb45 x-request-count: 970 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Target ID:	0
Start time:	10:45:09
Start date:	29/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	10:45:10
Start date:	29/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1688,i,3397768869367393147,5374517795823175940,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git-scm.exe

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.gitattributes

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\CODEOWNERS

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\ISSUE_TEMPLATE.md

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\ISSUE_TEMPLATE\all.md

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\ISSUE_TEMPLATE\android.md

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\ISSUE_TEMPLATE\chromium_minor_bump.md

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\ISSUE_TEMPLATE\desktop.md

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\PULL_REQUEST_TEMPLATE.md

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.github\workflows\pull_request.yml

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.gitignore

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\.sonarcloud.properties

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\.brave_gclient

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\.eslintrc.json

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\.gitallowed

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\.gitattributes

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\.github\CODEOWNERS

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\.github\PULL_REQUEST_TEMPLATE.md

C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3\git\brave-core-master\.github\labeler.yml

Windows Analysis Report
http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip

Target ID:	2
Start time:	10:45:11
Start date:	29/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bitbucket.org/fgsdsaewrewf/downsreps1/downloads/git-scm.zip
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	5
Start time:	10:45:58
Start date:	29/11/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\git-scm.zip
Imagebase:	0x360000
File size:	12800 bytes
MD5 hash:	B89F9ADB5A6E465B6EB4575913CD2687
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Target ID:	6
Start time:	10:45:59
Start date:	29/11/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\hkw5vb1n.vz3" "C:\Users\user\Downloads\git-scm.zip
Imagebase:	0x11c0000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Execution Coverage:	18.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.7%
Total number of Nodes:	60
Total number of Limit Nodes:	3

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre