Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/04/2024, 08:28
General
-
Target
VSCodeUserSetup-x64-1.88.1.exe
-
Size
94.9MB
-
MD5
d6b7bbcbebf6655c2535192071c3bdd3
-
SHA1
390f78056d1e38808e9f8dce2111aede641c0f6c
-
SHA256
487b08f664da5845cfa5fb63adc958b68eb2b58aaf5542d894f0a2a4bf93444c
-
SHA512
999c96f486d61828d8ad9b8f4f8670b469d3c83c0ddcd256af5d827812251b5f539536cd508675c88ab49978c63f0971639e750a5ab9ac9774296245a014493d
-
SSDEEP
1572864:JdJOViSOlLe6Euk9/0f9Y5JeLTTh7V15gb2cxDKK7mphNZIpRie5U:/ICEH/0faJeLT17lgb2CWK7+a+QU
Score
4/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.88.1.exe"C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.88.1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M7V9O.tmp\VSCodeUserSetup-x64-1.88.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-M7V9O.tmp\VSCodeUserSetup-x64-1.88.1.tmp" /SL5="$4001C,98457173,828416,C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.88.1.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD536333c1bab6e5d7847cd1929819c08f1
SHA17b1436c3257fc986cdce20a4eb035f697217ae5a
SHA25693901367dab8338de5e7e7d11a6e616fac048a7c915252f3553c154d906371ea
SHA512b218df064210c314985596cc49ef5ee6017469ccfabf955c66bf9e3ccdecf853160854ddd37b875bcb9f979d33ece93758eb7f89cbb8214cc7cbe8c1f45478dc
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
2.6MB