Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1VSCodeUser....3.exe
windows7-x64
10VSCodeUser....3.exe
windows10-2004-x64
10VSCodeUser...-1.dll
windows7-x64
3VSCodeUser...-1.dll
windows10-2004-x64
3VSCodeUser...10.dll
windows7-x64
3VSCodeUser...10.dll
windows10-2004-x64
3VSCodeUser...30.dll
windows7-x64
1VSCodeUser...30.dll
windows10-2004-x64
1VSCodeUser...re.dll
windows7-x64
1VSCodeUser...re.dll
windows10-2004-x64
1VSCodeUser...bs.dll
windows7-x64
1VSCodeUser...bs.dll
windows10-2004-x64
3VSCodeUser...ds.dll
windows7-x64
1VSCodeUser...ds.dll
windows10-2004-x64
7VSCodeUser...ec.dll
windows7-x64
1VSCodeUser...ec.dll
windows10-2004-x64
1VSCodeUser...ic.dll
windows7-x64
1VSCodeUser...ic.dll
windows10-2004-x64
1VSCodeUser...l2.dll
windows7-x64
1VSCodeUser...l2.dll
windows10-2004-x64
3VSCodeUser...ts.xml
windows7-x64
1VSCodeUser...ts.xml
windows10-2004-x64
1VSCodeUser...el.exe
windows7-x64
VSCodeUser...el.exe
windows10-2004-x64
Resubmissions
04/02/2023, 21:43
230204-1lbwcseg47 10Analysis
-
max time kernel
134s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2023, 21:43
Static task
static1
Behavioral task
behavioral1
Sample
VSCodeUserSetup-x64-1.74.3/VSCodeUserSetup-x64-1.74.3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
VSCodeUserSetup-x64-1.74.3/VSCodeUserSetup-x64-1.74.3.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgcc_s_seh-1.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgcc_s_seh-1.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgmp-10.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgmp-10.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgnutls-30.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgnutls-30.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfcore.dll
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfcore.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfcsubs.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfcsubs.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfds.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfds.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfdvdec.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfdvdec.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/MemoryDiagnostic.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/MemoryDiagnostic.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/MessagingDataModel2.dll
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/MessagingDataModel2.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/docs/defaults.xml
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/docs/defaults.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/mcupdate_GenuineIntel.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
VSCodeUserSetup-x64-1.74.3/upl/locales/mcupdate_GenuineIntel.exe
Resource
win10v2004-20220812-en
General
-
Target
VSCodeUserSetup-x64-1.74.3/VSCodeUserSetup-x64-1.74.3.exe
-
Size
680.7MB
-
MD5
07e845f93ca6fcbd10bad391aa94eaa0
-
SHA1
340a9c9c85644f973302a694686eb8cba8ab1876
-
SHA256
369ad6d01ffbd5af4a4da72d648afb41af0b694bbb05a39be0f4314daddce219
-
SHA512
44d5ff91002d37cb994b736cf350cbb61fde7ae618a4404950921f49f3f9488341212229cff0b411b20d800f99b7cfa612684ccf4543b613ab41f3ee81bd8aeb
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4tp4:VSSzMGS26x1MUTM+/Fha
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 3 IoCs
pid Process 1508 voiceadequovl.exe 2164 voiceadequovl.exe 4652 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce VSCodeUserSetup-x64-1.74.3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" VSCodeUserSetup-x64-1.74.3.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2164 set thread context of 4652 2164 voiceadequovl.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3500 powershell.exe 3500 powershell.exe 3868 powershell.exe 3868 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2164 voiceadequovl.exe Token: SeDebugPrivilege 3500 powershell.exe Token: SeDebugPrivilege 3868 powershell.exe Token: SeIncreaseQuotaPrivilege 2032 wmic.exe Token: SeSecurityPrivilege 2032 wmic.exe Token: SeTakeOwnershipPrivilege 2032 wmic.exe Token: SeLoadDriverPrivilege 2032 wmic.exe Token: SeSystemProfilePrivilege 2032 wmic.exe Token: SeSystemtimePrivilege 2032 wmic.exe Token: SeProfSingleProcessPrivilege 2032 wmic.exe Token: SeIncBasePriorityPrivilege 2032 wmic.exe Token: SeCreatePagefilePrivilege 2032 wmic.exe Token: SeBackupPrivilege 2032 wmic.exe Token: SeRestorePrivilege 2032 wmic.exe Token: SeShutdownPrivilege 2032 wmic.exe Token: SeDebugPrivilege 2032 wmic.exe Token: SeSystemEnvironmentPrivilege 2032 wmic.exe Token: SeRemoteShutdownPrivilege 2032 wmic.exe Token: SeUndockPrivilege 2032 wmic.exe Token: SeManageVolumePrivilege 2032 wmic.exe Token: 33 2032 wmic.exe Token: 34 2032 wmic.exe Token: 35 2032 wmic.exe Token: 36 2032 wmic.exe Token: SeIncreaseQuotaPrivilege 2032 wmic.exe Token: SeSecurityPrivilege 2032 wmic.exe Token: SeTakeOwnershipPrivilege 2032 wmic.exe Token: SeLoadDriverPrivilege 2032 wmic.exe Token: SeSystemProfilePrivilege 2032 wmic.exe Token: SeSystemtimePrivilege 2032 wmic.exe Token: SeProfSingleProcessPrivilege 2032 wmic.exe Token: SeIncBasePriorityPrivilege 2032 wmic.exe Token: SeCreatePagefilePrivilege 2032 wmic.exe Token: SeBackupPrivilege 2032 wmic.exe Token: SeRestorePrivilege 2032 wmic.exe Token: SeShutdownPrivilege 2032 wmic.exe Token: SeDebugPrivilege 2032 wmic.exe Token: SeSystemEnvironmentPrivilege 2032 wmic.exe Token: SeRemoteShutdownPrivilege 2032 wmic.exe Token: SeUndockPrivilege 2032 wmic.exe Token: SeManageVolumePrivilege 2032 wmic.exe Token: 33 2032 wmic.exe Token: 34 2032 wmic.exe Token: 35 2032 wmic.exe Token: 36 2032 wmic.exe Token: SeIncreaseQuotaPrivilege 3412 WMIC.exe Token: SeSecurityPrivilege 3412 WMIC.exe Token: SeTakeOwnershipPrivilege 3412 WMIC.exe Token: SeLoadDriverPrivilege 3412 WMIC.exe Token: SeSystemProfilePrivilege 3412 WMIC.exe Token: SeSystemtimePrivilege 3412 WMIC.exe Token: SeProfSingleProcessPrivilege 3412 WMIC.exe Token: SeIncBasePriorityPrivilege 3412 WMIC.exe Token: SeCreatePagefilePrivilege 3412 WMIC.exe Token: SeBackupPrivilege 3412 WMIC.exe Token: SeRestorePrivilege 3412 WMIC.exe Token: SeShutdownPrivilege 3412 WMIC.exe Token: SeDebugPrivilege 3412 WMIC.exe Token: SeSystemEnvironmentPrivilege 3412 WMIC.exe Token: SeRemoteShutdownPrivilege 3412 WMIC.exe Token: SeUndockPrivilege 3412 WMIC.exe Token: SeManageVolumePrivilege 3412 WMIC.exe Token: 33 3412 WMIC.exe Token: 34 3412 WMIC.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4112 wrote to memory of 1508 4112 VSCodeUserSetup-x64-1.74.3.exe 81 PID 4112 wrote to memory of 1508 4112 VSCodeUserSetup-x64-1.74.3.exe 81 PID 4112 wrote to memory of 1508 4112 VSCodeUserSetup-x64-1.74.3.exe 81 PID 1508 wrote to memory of 2164 1508 voiceadequovl.exe 87 PID 1508 wrote to memory of 2164 1508 voiceadequovl.exe 87 PID 1508 wrote to memory of 2164 1508 voiceadequovl.exe 87 PID 2164 wrote to memory of 3500 2164 voiceadequovl.exe 89 PID 2164 wrote to memory of 3500 2164 voiceadequovl.exe 89 PID 2164 wrote to memory of 3500 2164 voiceadequovl.exe 89 PID 2164 wrote to memory of 2900 2164 voiceadequovl.exe 91 PID 2164 wrote to memory of 2900 2164 voiceadequovl.exe 91 PID 2164 wrote to memory of 2900 2164 voiceadequovl.exe 91 PID 2900 wrote to memory of 3868 2900 cmd.exe 93 PID 2900 wrote to memory of 3868 2900 cmd.exe 93 PID 2900 wrote to memory of 3868 2900 cmd.exe 93 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 2164 wrote to memory of 4652 2164 voiceadequovl.exe 94 PID 4652 wrote to memory of 2032 4652 voiceadequovl.exe 95 PID 4652 wrote to memory of 2032 4652 voiceadequovl.exe 95 PID 4652 wrote to memory of 2032 4652 voiceadequovl.exe 95 PID 4652 wrote to memory of 4988 4652 voiceadequovl.exe 98 PID 4652 wrote to memory of 4988 4652 voiceadequovl.exe 98 PID 4652 wrote to memory of 4988 4652 voiceadequovl.exe 98 PID 4988 wrote to memory of 3412 4988 cmd.exe 100 PID 4988 wrote to memory of 3412 4988 cmd.exe 100 PID 4988 wrote to memory of 3412 4988 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3\VSCodeUserSetup-x64-1.74.3.exe"C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3\VSCodeUserSetup-x64-1.74.3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵PID:4324
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵PID:4084
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56195a91754effb4df74dbc72cdf4f7a6
SHA1aba262f5726c6d77659fe0d3195e36a85046b427
SHA2563254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
SHA512ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
-
Filesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
Filesize
16KB
MD593959e20fa97dc7ed1edcbf93e6aa8ab
SHA18edeb19ba5f206f3ba99d0eba5fd5c6d96ebd3d0
SHA2562a62cae0d46c18e8d9cc7b082a0554b1616b5a6eaa03205ae3b7a11014a351a7
SHA5125693b1e08a97207734260e7ef64ea44a0bc4912e011c8f2ada40f359ebd3bf7fddd9a30e123c7a2ffe2955265a67c31931f03f7c696a89bb7733cb80b3fac431
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
Filesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
Filesize
323.0MB
MD5e9027b372de884793705fa56469c22a5
SHA1f0c2be49a32fffe79d3a24fe451a321cde3531af
SHA256569659639341e1aa5d21a9865ad5440b3dba4f11efb0ff138d1a3fb77d807990
SHA5126e6c5be2ac0b6138024ab30070b6b1cedd0424d555bc23c7e3aa1de745af5f6bfb0e8517e657647433430a92b7f147136f3fc999461c119192f0c02420994677