f0ebb54d1d40873d5df197526e3e310f315b42c94e564d5ac0039c3d6fb33098

Analysis

max time kernel
597s
max time network
436s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/09/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VisualStudioSetup.exe
Size

4.2MB
MD5

cdde2720e47087c523cb8cd48f5299fd
SHA1

d16301e7bf0043f30c67c25e34373d2c92832728
SHA256

f0ebb54d1d40873d5df197526e3e310f315b42c94e564d5ac0039c3d6fb33098
SHA512

c5bbc2d8dd394a0e16b8d11a0af3fd904540f35897912d416e99f6cd75aa37dbb092396cb81e5482f0693d29df6af28d70ce8dd53f29e43748fcc0cb4f660c31
SSDEEP

98304:BEbipXUmFlenVCxzE4GCNM8hJ/XiYhucV0crEaQoG5fbr3:9k4enVCtE4ZM8hJXphR0ViuTr3

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4788	vs_setup_bootstrapper.exe

Loads dropped DLL 21 IoCs

pid	Process
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe
4788	vs_setup_bootstrapper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualStudioSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vs_setup_bootstrapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	vs_setup_bootstrapper.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 4788	3420	VisualStudioSetup.exe	78
PID 3420 wrote to memory of 4788	3420	VisualStudioSetup.exe	78
PID 3420 wrote to memory of 4788	3420	VisualStudioSetup.exe	78
PID 4788 wrote to memory of 4040	4788	vs_setup_bootstrapper.exe	79
PID 4788 wrote to memory of 4040	4788	vs_setup_bootstrapper.exe	79
PID 4788 wrote to memory of 4040	4788	vs_setup_bootstrapper.exe	79

C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\getmac.exe
    "getmac"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelAIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20240909205003_7834fbcc546647f1b6d6c6ca14e93491.trn

Filesize
4KB

MD5
513b9824b532d120ab696cb2378ddc2d

SHA1
82282f030c9d4a8ca2826e5ed10ee7b96dd292cd

SHA256
1c69f96c939441b99547c827da5d61c6e5cd4b4a2a0e96ef73ad0d2fea4373cd

SHA512
cc570e8be636749a6e199761bf974fb2c36c1a3355c94b573213003c597c2375b91683d85a426cba71fd5495cf32928737d22fbf724fc67d91ede024bc95dae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240909205005_a88290b206304efdabaf444472993700.trn

Filesize
4KB

MD5
a0db1744fef950a35e7567d38b2b026f

SHA1
cd1606fc801f00cba5304a29e900c9227fddfb30

SHA256
49eaacd901c2bac0143ddbf61aa8415942847795ae96ac8272dd9cbd79e2c046

SHA512
4e4ef221746bc6a64c76072171902b8dc7ecb357507fd51c39d3f119ca67c254cc28776788e5fb381ead4002de7eb93edfbb4476b18b516c98f7ca0e9d7fd9ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\01ME7Y5O\dyntelconfig[1].cache

Filesize
20KB

MD5
6d0fca79faea45342ac7d8c5ca14a3a8

SHA1
c0644691358a5fecb088d953b39492083e046daf

SHA256
32353d84410361ebf591781f5d5e0ba180a0fc3d1dbcf7e2f0000720248d3e43

SHA512
fec2d4af958badd190c6f36e3dc44a22fa8be4f65bbdf01adfabbcc645c0b19ea9f8158386cafaeab8f651baff5515582bbe1b20f1b635442960f80cab8b33af

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll

Filesize
18KB

MD5
6240940009abe0240203a943741f22b2

SHA1
21d7eaa572a701d2c463f1421b1b4dbb4355e91d

SHA256
62d8143505b130e7dcd2488384c19827787f9370c132d0c05957e16c28c70447

SHA512
4360785a85aa89aa303fb5a4e15233287457b6c46fb0a96e25b89703cc305fe76d0424fc93187da9dc25596b75c33ac9cc171ae37d599b0d914a3e22b0f0f9ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll

Filesize
115KB

MD5
7ee93c9293b25b94360c0bb61a0978d3

SHA1
2cd3c71473da6f2cff01f63ea3245e0c7794d15c

SHA256
7424bdcd743c2784e4043f7c489697b6cae3c7dae17b7190967b5522dd3d9bb7

SHA512
0523a771b3685604aab6088d194be5c3555011bd9a57f622f12fba1c6749f7974fc358563a54a85932dfd5be7cf342148fc972bbbabad5d8a5f421fd2e6ca367

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll

Filesize
46KB

MD5
355c1a112bc0f859b374a4b1c811c1e7

SHA1
b9a58bb26f334d517ab777b6226fef86a67eb4dd

SHA256
cc52e19735d6152702672feb5911c8ba77f60fdc73df5ed0d601b37415f3a7ed

SHA512
f1e858f97dabeb8e9648d1eb753d6fcd9e2bab378259c02b3e031652e87c29fbabfc48d209983f7074dfc256afd42fa1d8184805534037771a71db517fe16c8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll

Filesize
581KB

MD5
b952eda0274f5fe9651312bbdbd35c36

SHA1
a1ca4f102124ffed512b2fd818ef21f29a094f95

SHA256
e8028eb8af8ccc9b78fc688c96e91eb45add8d9f72ce90c365a1eab1f812fe08

SHA512
8192b534adc3442ab23f8c040c4b67a907125ea86ee3f9e6b65f80aa731242b53e174eb394a05599b0e50f6f435f26b93c99b363adcf16724edf83917db79e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll

Filesize
307KB

MD5
484742c8c65f83e4b272692fa7badb3c

SHA1
fa16f4159547404ade16f8c1abcc8f6978da9abd

SHA256
78531f435198f0b0e0170f1b2d683e7785e5c1ad133b76b6b471a036d6e1d4ac

SHA512
1f47ef544ac5837766befebabab6d8122e3e28aef68e877794fa8ef9ca9583be011386c1eb8fbb566cea40b32b9268f3880f3f8f3c9ff8c78b0b3015d99a775c

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll

Filesize
1.4MB

MD5
27f5c28bb57287a8f0187d7eee17bda8

SHA1
5b04cd155ee665609cc10c7e8cb72951843d3a5e

SHA256
cc3219b8b031286813871debe27e4d1ed3b2d8caac612d30c8a2cfca4806f41b

SHA512
d9973d51adcf9b683a1a67844fb81c796346fbe268ad4d85b91b02dd06bb584903ca5bb9588ac64118e8893203c1bb3ddf1a6d1246032c3fd9a82b189f82ecd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll

Filesize
950KB

MD5
903f254110813906331bef23e680bb9d

SHA1
6e4adfae4281d0b5bd0d8efd8f8eb919e974bd7d

SHA256
148081b9aaaee96125f7d2f09acffb95d7ce1c50d4e7b4b3ca8f3e372e2b8425

SHA512
150f5b438199faf8922390bc2cf93684de4a134e9c82f0e608954f02c47f630c8be22afe0349bd049bb1bc57dcd0951f9cf119713087940a769e076bae00c662

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll

Filesize
62KB

MD5
2dc1dc66b267a3470add7fab88b78069

SHA1
dbe80047475b503791038ed7e47389c062c15c72

SHA256
b044863f98af8d28f4f2f5e2dccb945c57439e1575afb37110e1eec306a6c89c

SHA512
44ef73aab50dcc13ccd94c0353c366818afb27ce73772d722755b04add0c4f294c7814c84da6069d9aa6136f2a48683c25062dcddd1664e8d32fed1b38ceca21

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\System.Memory.dll

Filesize
138KB

MD5
f09441a1ee47fb3e6571a3a448e05baf

SHA1
3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde

SHA256
bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f

SHA512
0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll

Filesize
17KB

MD5
c610e828b54001574d86dd2ed730e392

SHA1
180a7baafbc820a838bbaca434032d9d33cceebe

SHA256
37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf

SHA512
441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\detection.json

Filesize
8KB

MD5
782f4beae90d11351db508f38271eb26

SHA1
f1e92aea9e2cd005c2fb6d4face0258d4f1d8b6c

SHA256
c828a2e5b4045ce36ecf5b49d33d6404c9d6f865df9b3c9623787c2332df07d9

SHA512
0a02beeca5c4e64044692b665507378e6f8b38e519a17c3ceccca1e87f85e1e2e7b3598e598fc84c962d3a5c723b28b52ee0351faaec82a846f0313f3c21e0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\vs_setup_bootstrapper.config

Filesize
622B

MD5
4ce890b25770f6eef967f215e6fd1a90

SHA1
deae571483336e1a7c74da916291a68f48998118

SHA256
78b2d683b8e1e14fa7c58061260c635ea8278aa3018c5bb6e22fdd6c089b7fd5

SHA512
b580c29440ee5ab03ae3d2b4fe7a13ae1455f9b74ece966ebb35400db7a55360a8940b8a28fcb833b4f8ba0f0167e04f1635dda0adc81407a0a04f799294ca16

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe

Filesize
404KB

MD5
e24ef04ddb8a5474314d34cbd3ffa0c2

SHA1
399b9c3336116df479793d322f8c1e884e154fff

SHA256
49fc3ec8ab51c8f05591ee0ff0d9040bed994dbc3ef9a417a188c6d69a56952f

SHA512
7e845f995cf5bc448f9accf4bc6a9c26a1354ec72b138348e0d474465a101cc77ff4f2801c1b58e48819053f80e7fdb0d0cf25664c2483314cb33b0d312d67e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config

Filesize
3KB

MD5
72f9933c6e247a13353d9725cd22c2da

SHA1
5b76599644e7c70cd5f08e5a80cec225c891a9da

SHA256
1f423b67ee6ca6a714507ab08fbd383b6d442bd98d321f0a640d533d5a516650

SHA512
afc7b5959506d197246fb482b0a2ca8f1ebfb5957234e547151d1e7a40047a2974768ccdf5c321a984685d99d4f7a1b0fbfb7fe81c40387a229808e45814a6de

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ce7bb89158154c6736e8013a5\vs_bootstrapper_d15\vs_setup_bootstrapper.json

Filesize
165B

MD5
dae30b60e540cd3509d2f3abb6d4bec6

SHA1
6ad6db8516b6cbd77b5f709e04ff964991c9ae8a

SHA256
a6e6d2fe55f6b542960b26e095c71277a05852854b2e785a6bffb55aaa59a50a

SHA512
19595061aa05f7cb8898b0b84d8967e77ffd37e8edbe2eb82bf9de12c2f5a4abf2d6616f557db95955f0f2856674193d9822e01b18fdb17a27074b78eeb0db63

Download Submit
memory/4788-132-0x0000000005780000-0x0000000005788000-memory.dmp

Filesize
32KB

Download
memory/4788-136-0x00000000058C0000-0x0000000005910000-memory.dmp

Filesize
320KB

Download
memory/4788-153-0x0000000005C60000-0x0000000005C68000-memory.dmp

Filesize
32KB

Download
memory/4788-145-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/4788-140-0x0000000073750000-0x0000000073F01000-memory.dmp

Filesize
7.7MB

Download
memory/4788-157-0x0000000006230000-0x0000000006240000-memory.dmp

Filesize
64KB

Download
memory/4788-141-0x0000000005E60000-0x0000000005F12000-memory.dmp

Filesize
712KB

Download
memory/4788-124-0x0000000005820000-0x00000000058B4000-memory.dmp

Filesize
592KB

Download
memory/4788-128-0x00000000059C0000-0x0000000005AB2000-memory.dmp

Filesize
968KB

Download
memory/4788-165-0x0000000006310000-0x0000000006332000-memory.dmp

Filesize
136KB

Download
memory/4788-166-0x0000000006480000-0x00000000067D7000-memory.dmp

Filesize
3.3MB

Download
memory/4788-167-0x0000000007530000-0x0000000007596000-memory.dmp

Filesize
408KB

Download
memory/4788-168-0x0000000007660000-0x000000000771A000-memory.dmp

Filesize
744KB

Download
memory/4788-149-0x0000000005DA0000-0x0000000005DC6000-memory.dmp

Filesize
152KB

Download
memory/4788-170-0x00000000078C0000-0x0000000007952000-memory.dmp

Filesize
584KB

Download
memory/4788-171-0x0000000007F10000-0x00000000084B6000-memory.dmp

Filesize
5.6MB

Download
memory/4788-172-0x0000000073750000-0x0000000073F01000-memory.dmp

Filesize
7.7MB

Download
memory/4788-173-0x0000000007BF0000-0x0000000007BF8000-memory.dmp

Filesize
32KB

Download
memory/4788-175-0x0000000007C10000-0x0000000007C18000-memory.dmp

Filesize
32KB

Download
memory/4788-176-0x000000000AD30000-0x000000000AD68000-memory.dmp

Filesize
224KB

Download
memory/4788-177-0x0000000007C60000-0x0000000007C6E000-memory.dmp

Filesize
56KB

Download
memory/4788-182-0x000000007375E000-0x000000007375F000-memory.dmp

Filesize
4KB

Download
memory/4788-183-0x0000000073750000-0x0000000073F01000-memory.dmp

Filesize
7.7MB

Download
memory/4788-185-0x0000000073750000-0x0000000073F01000-memory.dmp

Filesize
7.7MB

Download
memory/4788-120-0x0000000005410000-0x0000000005578000-memory.dmp

Filesize
1.4MB

Download
memory/4788-116-0x00000000007D0000-0x0000000000838000-memory.dmp

Filesize
416KB

Download
memory/4788-114-0x000000007375E000-0x000000007375F000-memory.dmp

Filesize
4KB

Download