Analysis
- max time kernel
898s - max time network
647s - platform
windows10-2004_x64 - resource
win10v2004-20250207-en - resource tags
- submitted
09/02/2025, 03:29
General
- Target Predictor7.6.3/Sounds/VisualStudioSetup.exe
- Size 4.2MB
- Sample250209-d2a8favrbl
- SHA256 2e4e7be2891916f6158f45dad8ff5300ee2f78fc7df0d00a031cd5f86693e7ac
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 21 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Predictor7.6.3\Sounds\VisualStudioSetup.exe"C:\Users\Admin\AppData\Local\Temp\Predictor7.6.3\Sounds\VisualStudioSetup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\912e6aff262bf10a826d\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\912e6aff262bf10a826d\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\Predictor7.6.3\Sounds\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp\Predictor7.6.3\Sounds"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\getmac.exe"getmac"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjBGM0ZCREItMEZEMC00NDFELUI4MjYtOTlDQjdEREM1MEUxfSIgdXNlcmlkPSJ7NTE2QjI2NTctRDQ0NS00RUU4LThDOUUtRTc4QTFBRjM1N0RCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEU0NzQ3QjYtM0Q0MS00NkM2LUIxNjktMEQyMEVGM0NCNjkwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4NjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODIxNjMwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzgzNDI0MzY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
vs_setup_bootstrapper_202502091247424729.json
20250209124814_8782349c4e9141bf9a0d50c753fe3b4b.trn
20250209124816_5ebbf90903a5455e85c3a3382e8900e7.trn
dyntelconfig[1].cache
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.C2RSignatureReader.Native.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
Newtonsoft.Json.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
detection.json
vs_setup_bootstrapper.config
vs_setup_bootstrapper.exe
vs_setup_bootstrapper.exe.config
memory/3736-153-0x0000000005C30000-0x0000000005C38000-memory.dmp
memory/3736-174-0x0000000007CD0000-0x0000000007CD8000-memory.dmp
memory/3736-165-0x0000000006110000-0x0000000006132000-memory.dmp
memory/3736-149-0x0000000005C90000-0x0000000005CB6000-memory.dmp
memory/3736-157-0x0000000006030000-0x0000000006040000-memory.dmp
memory/3736-145-0x0000000005C40000-0x0000000005C52000-memory.dmp
memory/3736-141-0x0000000005CE0000-0x0000000005D92000-memory.dmp
memory/3736-132-0x0000000005660000-0x0000000005668000-memory.dmp
memory/3736-137-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-128-0x00000000058A0000-0x0000000005992000-memory.dmp
memory/3736-124-0x0000000005700000-0x0000000005794000-memory.dmp
memory/3736-167-0x0000000007210000-0x0000000007276000-memory.dmp
memory/3736-168-0x00000000076A0000-0x0000000007732000-memory.dmp
memory/3736-169-0x0000000007CF0000-0x0000000008294000-memory.dmp
memory/3736-170-0x0000000007800000-0x00000000078BA000-memory.dmp
memory/3736-136-0x00000000057A0000-0x00000000057F0000-memory.dmp
memory/3736-172-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-166-0x0000000006380000-0x00000000066D4000-memory.dmp
memory/3736-176-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-175-0x0000000007CC0000-0x0000000007CC8000-memory.dmp
memory/3736-177-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-178-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-179-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-181-0x000000000A390000-0x000000000A39E000-memory.dmp
memory/3736-180-0x000000000BBB0000-0x000000000BBE8000-memory.dmp
memory/3736-183-0x000000007301E000-0x000000007301F000-memory.dmp
memory/3736-184-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-188-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-189-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-190-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-191-0x0000000073010000-0x00000000737C0000-memory.dmp
memory/3736-120-0x00000000052B0000-0x0000000005418000-memory.dmp
memory/3736-116-0x00000000007B0000-0x0000000000818000-memory.dmp
memory/3736-114-0x000000007301E000-0x000000007301F000-memory.dmp