4ab764a919423949ab256b8bc68edbc953c7ee1f4153d880a2f3d4b76681028e

Analysis

max time kernel
148s
max time network
158s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/02/2023, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VSCodeUserSetup-x64-1.74.3.exe
Size

88.8MB
MD5

c4739833c15febf0151ba533b5aecee9
SHA1

154b082d7beef9402be9a8556e8d2f9cba08c544
SHA256

4ab764a919423949ab256b8bc68edbc953c7ee1f4153d880a2f3d4b76681028e
SHA512

1d70d625ea99b8f5809d733f9afa9072732265920d74f7a2d01b9e00b7e2c2e5765301f728b1ada93530b8f132a4d3d1f62655863ac1ae25c66ad2c131b3606d
SSDEEP

1572864:z4PrjCbcFnCeMzFOAXdzo9QODR2AGrwFBz2rkdOmsJZBOoE9fXM3gWFp+:8PryeMZOQJU26FBz2QdOmsqfXlWFp+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1492	VSCodeUserSetup-x64-1.74.3.tmp

Loads dropped DLL 1 IoCs

pid	Process
1588	VSCodeUserSetup-x64-1.74.3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1876	chrome.exe
1936	chrome.exe
1936	chrome.exe
2344	chrome.exe
2352	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe
1936	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1492	1588	VSCodeUserSetup-x64-1.74.3.exe	27
PID 1588 wrote to memory of 1492	1588	VSCodeUserSetup-x64-1.74.3.exe	27
PID 1588 wrote to memory of 1492	1588	VSCodeUserSetup-x64-1.74.3.exe	27
PID 1588 wrote to memory of 1492	1588	VSCodeUserSetup-x64-1.74.3.exe	27
PID 1588 wrote to memory of 1492	1588	VSCodeUserSetup-x64-1.74.3.exe	27
PID 1588 wrote to memory of 1492	1588	VSCodeUserSetup-x64-1.74.3.exe	27
PID 1588 wrote to memory of 1492	1588	VSCodeUserSetup-x64-1.74.3.exe	27
PID 1936 wrote to memory of 1880	1936	chrome.exe	30
PID 1936 wrote to memory of 1880	1936	chrome.exe	30
PID 1936 wrote to memory of 1880	1936	chrome.exe	30
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1996	1936	chrome.exe	31
PID 1936 wrote to memory of 1876	1936	chrome.exe	32
PID 1936 wrote to memory of 1876	1936	chrome.exe	32
PID 1936 wrote to memory of 1876	1936	chrome.exe	32
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33
PID 1936 wrote to memory of 1480	1936	chrome.exe	33

C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3.exe
"C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\is-AROJA.tmp\VSCodeUserSetup-x64-1.74.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AROJA.tmp\VSCodeUserSetup-x64-1.74.3.tmp" /SL5="$70122,92043323,828416,C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.74.3.exe"
  2⤵
  - Executes dropped EXE
  PID:1492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef68e4f50,0x7fef68e4f60,0x7fef68e4f70
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3220 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3832 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,3015291168425359146,18280130892760078910,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=724 /prefetch:1
  2⤵
  PID:2468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-AROJA.tmp\VSCodeUserSetup-x64-1.74.3.tmp

Filesize
2.5MB

MD5
78d348f50d4c5c9ac6fa862d132fb854

SHA1
3eae936e26d51f608b5c41002f949aca324c4a2e

SHA256
7ec482e67544f5e8d2440abdcc1addba4cc420f2d1f4e5392876c6197f41958b

SHA512
c6f1d70b8782eb032ff7d1cad5eb115aa2da5494913e8a34b25a2a85fce7093b60f3b15765a65c9060edba3dcedcf2e4f5c60b4c8bc223257ad03b22830d8c65

Download Submit
\Users\Admin\AppData\Local\Temp\is-AROJA.tmp\VSCodeUserSetup-x64-1.74.3.tmp

Filesize
2.5MB

MD5
78d348f50d4c5c9ac6fa862d132fb854

SHA1
3eae936e26d51f608b5c41002f949aca324c4a2e

SHA256
7ec482e67544f5e8d2440abdcc1addba4cc420f2d1f4e5392876c6197f41958b

SHA512
c6f1d70b8782eb032ff7d1cad5eb115aa2da5494913e8a34b25a2a85fce7093b60f3b15765a65c9060edba3dcedcf2e4f5c60b4c8bc223257ad03b22830d8c65

Download Submit
memory/1588-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1588-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1588-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1588-62-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download