Analysis
- user interaction
yes - max time kernel
143s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 02:44
General
- Target VisualStudioSetup.exe
- Size 5.4MB
- Sample260722-c8bxwaxerd
- SHA256 fb56eafbee2c4c46cf75466740d736c2eb79b8f775d6a4306755c1fed237233c
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 23 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe"C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38cacf6dcb53117a01\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\38cacf6dcb53117a01\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\getmac.exe"getmac"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202607220344511946.json" --locale en-US --activityId "d4cb27ac-67ef-4514-8f6b-cbb672a76bab" --campaign "2500:81f1745a44794d749b7f7fbac4814e9f" --pipe "4d27fb39-e25c-4972-bb20-eca78cd1ad27"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 4.8.60.55523 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
msalruntime_x86.dll
CommandLine.dll
Markdig.Wpf.dll
Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll
Microsoft.VisualStudio.Imaging.dll
Microsoft.VisualStudio.Setup.InstallerResources.dll
Microsoft.VisualStudio.Threading.dll
Microsoft.VisualStudio.Utilities.dll
Microsoft.VisualStudio.Validation.dll
Newtonsoft.Json.dll
System.Collections.Immutable.dll
setup.exe
setup.exe.config
vs_installer.version.json
20260722024624_f7c4e232be40452980e0b113f42e4723.trn
20260722024654_a2dbf4a7ddc547cba0a4386632e5ca85.trn
20260722024713_9c80255bc116401c833b0ec368360939.trn
channelManifest.json
channelManifest.json
ShippedFlights[1].cache
dyntelconfig[2].cache
RemoteSettings_Installer[1].cache
DisabledFlights[1].cache
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.C2RSignatureReader.Native.dll
Microsoft.IdentityModel.Abstractions.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Services.Common.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
Newtonsoft.Json.dll
System.Buffers.dll
System.Diagnostics.DiagnosticSource.dll
System.IO.FileSystem.AccessControl.dll
System.Memory.dll
System.Net.Http.Formatting.dll
System.Numerics.Vectors.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Security.Cryptography.ProtectedData.dll
System.Security.Principal.Windows.dll
System.Threading.Tasks.Extensions.dll
VSInstallerElevationService.Contracts.dll
detection.json
msalruntime_arm64.dll
msalruntime.dll
vs_setup_bootstrapper.config
vs_setup_bootstrapper.exe
vs_setup_bootstrapper.exe.config
vs_setup_bootstrapper.json
5dkvx5jm.json
qbohk4nn.json
memory/1924-1224-0x00000131D7D20000-0x00000131D7D3E000-memory.dmp
memory/1924-1209-0x00000131D3B60000-0x00000131D3B68000-memory.dmp
memory/1924-1292-0x00000131D2F10000-0x00000131D2F22000-memory.dmp
memory/1924-1290-0x00000131D2EB0000-0x00000131D2EBE000-memory.dmp
memory/1924-1289-0x00000131D2ED0000-0x00000131D2EE8000-memory.dmp
memory/1924-1282-0x00000131D2E80000-0x00000131D2E88000-memory.dmp
memory/1924-1266-0x00000131D2EC0000-0x00000131D2EC8000-memory.dmp
memory/1924-1265-0x00000131D2E60000-0x00000131D2E68000-memory.dmp
memory/1924-1164-0x00000131B8C60000-0x00000131B8F6A000-memory.dmp
memory/1924-1166-0x00000131D37C0000-0x00000131D3942000-memory.dmp
memory/1924-1259-0x00000131D2F80000-0x00000131D30B6000-memory.dmp
memory/1924-1170-0x00000131D36D0000-0x00000131D376E000-memory.dmp
memory/1924-1168-0x00000131D3630000-0x00000131D36D0000-memory.dmp
memory/1924-1231-0x00000131D7ED0000-0x00000131D7EE2000-memory.dmp
memory/1924-1222-0x00000131D7F70000-0x00000131D7FC0000-memory.dmp
memory/1924-1223-0x00000131D4C20000-0x00000131D4C2A000-memory.dmp
memory/1924-1174-0x00000131BADB0000-0x00000131BADEC000-memory.dmp
memory/1924-1226-0x00000131D80C0000-0x00000131D81BC000-memory.dmp
memory/1924-1176-0x00000131BADF0000-0x00000131BAE20000-memory.dmp
memory/1924-1177-0x00000131D3950000-0x00000131D3A04000-memory.dmp
memory/1924-1178-0x00000131D3770000-0x00000131D3792000-memory.dmp
memory/1924-1225-0x00000131D7E10000-0x00000131D7E2C000-memory.dmp
memory/1924-1183-0x00000131BAD70000-0x00000131BAD8A000-memory.dmp
memory/1924-1184-0x00000131D3BF0000-0x00000131D3CFA000-memory.dmp
memory/1924-1188-0x00000131D3A40000-0x00000131D3A4C000-memory.dmp
memory/1924-1186-0x00000131BAD90000-0x00000131BADA4000-memory.dmp
memory/1924-1192-0x00000131B94A0000-0x00000131B94A8000-memory.dmp
memory/1924-1190-0x00000131D3A50000-0x00000131D3A78000-memory.dmp
memory/1924-1182-0x00000131B9420000-0x00000131B942E000-memory.dmp
memory/1924-1194-0x00000131B9490000-0x00000131B94A0000-memory.dmp
memory/1924-1220-0x00000131D7DB0000-0x00000131D7E0E000-memory.dmp
memory/1924-1196-0x00000131D3AF0000-0x00000131D3AF8000-memory.dmp
memory/1924-1221-0x00000131D7CD0000-0x00000131D7CF2000-memory.dmp
memory/1924-1198-0x00000131D37A0000-0x00000131D37AE000-memory.dmp
memory/1924-1219-0x00000131D7CA0000-0x00000131D7CB2000-memory.dmp
memory/1924-1200-0x00000131D4A50000-0x00000131D4ADA000-memory.dmp
memory/1924-1218-0x00000131D7E40000-0x00000131D7EC8000-memory.dmp
memory/1924-1203-0x00000131D4C50000-0x00000131D4DBE000-memory.dmp
memory/1924-1215-0x00000131D7D50000-0x00000131D7DA4000-memory.dmp
memory/1924-1210-0x00000131D4BB0000-0x00000131D4BEE000-memory.dmp
memory/1924-1206-0x00000131D4AE0000-0x00000131D4B22000-memory.dmp
memory/1924-1207-0x00000131D3AC0000-0x00000131D3ACC000-memory.dmp
memory/1924-1208-0x00000131D4DC0000-0x00000131D4E7A000-memory.dmp
memory/1924-1211-0x00000131D3B50000-0x00000131D3B5E000-memory.dmp
memory/3020-265-0x00000000016A0000-0x00000000016A8000-memory.dmp
memory/3020-280-0x000000000E2C0000-0x000000000E2E2000-memory.dmp
memory/3020-239-0x000000000BE30000-0x000000000BE38000-memory.dmp
memory/3020-242-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-241-0x000000000BE20000-0x000000000BE2E000-memory.dmp
memory/3020-243-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-240-0x000000000C780000-0x000000000C7BE000-memory.dmp
memory/3020-237-0x000000000B610000-0x000000000B618000-memory.dmp
memory/3020-244-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-245-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-246-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-248-0x0000000072E82000-0x0000000072E83000-memory.dmp
memory/3020-236-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-249-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-234-0x00000000091C0000-0x000000000927A000-memory.dmp
memory/3020-180-0x0000000072E82000-0x0000000072E83000-memory.dmp
memory/3020-182-0x0000000000E40000-0x0000000000E94000-memory.dmp
memory/3020-233-0x0000000008C00000-0x00000000091BA000-memory.dmp
memory/3020-254-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-255-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-238-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-268-0x000000000D1A0000-0x000000000D1B2000-memory.dmp
memory/3020-250-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-279-0x000000000D1E0000-0x000000000D1EC000-memory.dmp
memory/3020-267-0x000000000DD00000-0x000000000DD50000-memory.dmp
memory/3020-231-0x00000000085A0000-0x0000000008632000-memory.dmp
memory/3020-230-0x0000000007A90000-0x0000000007AF6000-memory.dmp
memory/3020-229-0x0000000006AA0000-0x0000000006DFB000-memory.dmp
memory/3020-228-0x0000000006A70000-0x0000000006A92000-memory.dmp
memory/3020-215-0x00000000064D0000-0x00000000064F8000-memory.dmp
memory/3020-1354-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-223-0x0000000006870000-0x0000000006880000-memory.dmp
memory/3020-219-0x00000000064C0000-0x00000000064C8000-memory.dmp
memory/3020-211-0x0000000006480000-0x0000000006494000-memory.dmp
memory/3020-207-0x0000000006540000-0x00000000065F4000-memory.dmp
memory/3020-203-0x0000000072E70000-0x000000007362C000-memory.dmp
memory/3020-194-0x0000000006080000-0x000000000618A000-memory.dmp
memory/3020-198-0x0000000005E80000-0x0000000005E8A000-memory.dmp
memory/3020-202-0x0000000005FD0000-0x0000000006024000-memory.dmp
memory/3020-190-0x0000000005ED0000-0x0000000005F70000-memory.dmp
memory/3020-186-0x0000000005A50000-0x0000000005BD2000-memory.dmp
memory/5824-1258-0x0000020DE7390000-0x0000020DE73A0000-memory.dmp
memory/5996-1257-0x000002C6CC1C0000-0x000002C6CC1CE000-memory.dmp