Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 01:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VDownloaderSetup.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
VDownloaderSetup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
VDownloaderSetup.exe
-
Size
15.2MB
-
MD5
1a24f047cdfc86d48b521f2582106980
-
SHA1
b477d278279ccf7928b785213fd1a92064fce7a2
-
SHA256
7ec0e42285ca1761f1812e589bb988d0d8cae9044351c0bae75f4f08f127f462
-
SHA512
0ac3fad09a39961ac05a961b761753f2887dcad03a2a1f090c5ca08debcaf5ccc5f10503b1fb605a3bbfde9a42eb9b51cffa1fdac76269d7dda62fb745cbb007
-
SSDEEP
393216:8Vu+ssrcvFIKciM2U234u59Ls2I7BfjeiCDpauNB2ui4i5m83:nWrcxZM/A4ubL4jeiClPNi4i5m83
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\International\Geo\Nation VDownloaderSetup.tmp -
Executes dropped EXE 1 IoCs
pid Process 2884 VDownloaderSetup.tmp -
Loads dropped DLL 7 IoCs
pid Process 2020 VDownloaderSetup.exe 2884 VDownloaderSetup.tmp 2884 VDownloaderSetup.tmp 2884 VDownloaderSetup.tmp 2884 VDownloaderSetup.tmp 2788 RunDll32.exe 2788 RunDll32.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe 2788 RunDll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2884 VDownloaderSetup.tmp -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2884 2020 VDownloaderSetup.exe 21 PID 2020 wrote to memory of 2884 2020 VDownloaderSetup.exe 21 PID 2020 wrote to memory of 2884 2020 VDownloaderSetup.exe 21 PID 2020 wrote to memory of 2884 2020 VDownloaderSetup.exe 21 PID 2020 wrote to memory of 2884 2020 VDownloaderSetup.exe 21 PID 2020 wrote to memory of 2884 2020 VDownloaderSetup.exe 21 PID 2020 wrote to memory of 2884 2020 VDownloaderSetup.exe 21 PID 2884 wrote to memory of 2788 2884 VDownloaderSetup.tmp 29 PID 2884 wrote to memory of 2788 2884 VDownloaderSetup.tmp 29 PID 2884 wrote to memory of 2788 2884 VDownloaderSetup.tmp 29 PID 2884 wrote to memory of 2788 2884 VDownloaderSetup.tmp 29 PID 2884 wrote to memory of 2788 2884 VDownloaderSetup.tmp 29 PID 2884 wrote to memory of 2788 2884 VDownloaderSetup.tmp 29 PID 2884 wrote to memory of 2788 2884 VDownloaderSetup.tmp 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\VDownloaderSetup.exe"C:\Users\Admin\AppData\Local\Temp\VDownloaderSetup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\is-OKEMB.tmp\VDownloaderSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OKEMB.tmp\VDownloaderSetup.tmp" /SL5="$70120,15417274,141824,C:\Users\Admin\AppData\Local\Temp\VDownloaderSetup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe "C:\Users\Admin\AppData\Local\Temp\is-NUU5J.tmp\OCSetupHlp.dll",_OCPRD110RunOpenCandyDLL@16 28843⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2788
-
-