Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
VDownloaderSetup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
VDownloaderSetup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
VDownloaderSetup.exe
-
Size
15.2MB
-
MD5
1a24f047cdfc86d48b521f2582106980
-
SHA1
b477d278279ccf7928b785213fd1a92064fce7a2
-
SHA256
7ec0e42285ca1761f1812e589bb988d0d8cae9044351c0bae75f4f08f127f462
-
SHA512
0ac3fad09a39961ac05a961b761753f2887dcad03a2a1f090c5ca08debcaf5ccc5f10503b1fb605a3bbfde9a42eb9b51cffa1fdac76269d7dda62fb745cbb007
-
SSDEEP
393216:8Vu+ssrcvFIKciM2U234u59Ls2I7BfjeiCDpauNB2ui4i5m83:nWrcxZM/A4ubL4jeiClPNi4i5m83
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation VDownloaderSetup.tmp -
Executes dropped EXE 1 IoCs
pid Process 3968 VDownloaderSetup.tmp -
Loads dropped DLL 3 IoCs
pid Process 3968 VDownloaderSetup.tmp 3968 VDownloaderSetup.tmp 1536 RunDll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe 1536 RunDll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1168 wrote to memory of 3968 1168 VDownloaderSetup.exe 90 PID 1168 wrote to memory of 3968 1168 VDownloaderSetup.exe 90 PID 1168 wrote to memory of 3968 1168 VDownloaderSetup.exe 90 PID 3968 wrote to memory of 1536 3968 VDownloaderSetup.tmp 96 PID 3968 wrote to memory of 1536 3968 VDownloaderSetup.tmp 96 PID 3968 wrote to memory of 1536 3968 VDownloaderSetup.tmp 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\VDownloaderSetup.exe"C:\Users\Admin\AppData\Local\Temp\VDownloaderSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\is-DE01R.tmp\VDownloaderSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-DE01R.tmp\VDownloaderSetup.tmp" /SL5="$3022A,15417274,141824,C:\Users\Admin\AppData\Local\Temp\VDownloaderSetup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe "C:\Users\Admin\AppData\Local\Temp\is-HI7VB.tmp\OCSetupHlp.dll",_OCPRD110RunOpenCandyDLL@16 39683⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5713bfb93270414f034fa70496d5cfffc
SHA1f6b5e6a6d7ec32a1d32bbab37986da0cf1bc94c6
SHA2568f7c04c54c61b7f11d3c6016254abaab89997cb0d5198e8c7ef0df2edbca16d7
SHA512e9cfbc676e02854821cbd585d3de2b3f5cadf2c11fe306244cbba7ae066574dbfc7971f0e6a1d38a6e47af75762f608a8f14082d0e2f8d7c224c591caed00472
-
Filesize
750KB
MD5c6cef91b4abcebc8e86acb0dab99a496
SHA1d74806351749e22a8a4c11c327d53b802561ef12
SHA256c176f3957092d03b9f53e020e0711b534bef3a8e528d2dc58475a19a4eef0723
SHA512f20b7608cdfa893f3384bbcdc41d4eac79c028c4bd0f4881b0006c0323d7f806c9bea2db19adf7245abd4b06b25bde1aca8c4ee68053cd997684f75c220586e5
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4