b072cd5dfe9bcdb08250fac0647e5040ca03ebfde85bc0083c7766d1cf9930c5

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-03-2023 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Papers Please De SmoggyBox7636/Papers Please -Survarium100/redist/dx_setup.exe
Size

281KB
MD5

fd6057b33e15a553ddc5d9873723ce8f
SHA1

f90efb623b5abea70af63c470daa8674444fb1df
SHA256

111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
SHA512

d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
SSDEEP

6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

dxwsetup.exe

pid process

1576 dxwsetup.exe
Loads dropped DLL 5 IoCs

Processes:

dx_setup.exedxwsetup.exe

pid process

1324 dx_setup.exe
1576 dxwsetup.exe
1576 dxwsetup.exe
1576 dxwsetup.exe
1576 dxwsetup.exe

pid	process
1576	dxwsetup.exe

pid	process
1324	dx_setup.exe
1576	dxwsetup.exe
1576	dxwsetup.exe
1576	dxwsetup.exe
1576	dxwsetup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dx_setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dx_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dx_setup.exe

Drops file in System32 directory 7 IoCs

Processes:

dxwsetup.exe

description	ioc	process
File created	C:\Windows\SysWOW64\directx\websetup\SET1E5.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET205.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET205.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET1E5.tmp	dxwsetup.exe

Drops file in Windows directory 2 IoCs

Processes:

dxwsetup.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	dxwsetup.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

dxwsetup.exe

description	pid	process
Token: SeRestorePrivilege	1576	dxwsetup.exe
Token: SeRestorePrivilege	1576	dxwsetup.exe
Token: SeRestorePrivilege	1576	dxwsetup.exe
Token: SeRestorePrivilege	1576	dxwsetup.exe
Token: SeRestorePrivilege	1576	dxwsetup.exe
Token: SeRestorePrivilege	1576	dxwsetup.exe
Token: SeRestorePrivilege	1576	dxwsetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

dx_setup.exe

description	pid	process	target process
PID 1324 wrote to memory of 1576	1324	dx_setup.exe	dxwsetup.exe
PID 1324 wrote to memory of 1576	1324	dx_setup.exe	dxwsetup.exe
PID 1324 wrote to memory of 1576	1324	dx_setup.exe	dxwsetup.exe
PID 1324 wrote to memory of 1576	1324	dx_setup.exe	dxwsetup.exe
PID 1324 wrote to memory of 1576	1324	dx_setup.exe	dxwsetup.exe
PID 1324 wrote to memory of 1576	1324	dx_setup.exe	dxwsetup.exe
PID 1324 wrote to memory of 1576	1324	dx_setup.exe	dxwsetup.exe

C:\Users\Admin\AppData\Local\Temp\Papers Please De SmoggyBox7636\Papers Please -Survarium100\redist\dx_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Papers Please De SmoggyBox7636\Papers Please -Survarium100\redist\dx_setup.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1576

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Filesize
87KB

MD5
0a23038ea472ffc938366ef4099d6635

SHA1
6499d741776dc4a446c22ea11085842155b34176

SHA256
8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

SHA512
dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
Filesize
1.7MB

MD5
7672509436485121135c2a0e30b9e9ff

SHA1
f557022a9f42fe1303078093e389f21fb693c959

SHA256
d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

SHA512
e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Filesize
487KB

MD5
eaa6b5ee297982a6a396354814006761

SHA1
780bf9a61c080a335e8712c5544fcbf9c7bdcd72

SHA256
d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

SHA512
ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Filesize
487KB

MD5
eaa6b5ee297982a6a396354814006761

SHA1
780bf9a61c080a335e8712c5544fcbf9c7bdcd72

SHA256
d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

SHA512
ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
Filesize
477B

MD5
ad8982eaa02c7ad4d7cdcbc248caa941

SHA1
4ccd8e038d73a5361d754c7598ed238fc040d16b

SHA256
d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00

SHA512
5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup.dll
Filesize
87KB

MD5
0a23038ea472ffc938366ef4099d6635

SHA1
6499d741776dc4a446c22ea11085842155b34176

SHA256
8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

SHA512
dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll
Filesize
1.7MB

MD5
7672509436485121135c2a0e30b9e9ff

SHA1
f557022a9f42fe1303078093e389f21fb693c959

SHA256
d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

SHA512
e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Filesize
487KB

MD5
eaa6b5ee297982a6a396354814006761

SHA1
780bf9a61c080a335e8712c5544fcbf9c7bdcd72

SHA256
d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

SHA512
ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Filesize
487KB

MD5
eaa6b5ee297982a6a396354814006761

SHA1
780bf9a61c080a335e8712c5544fcbf9c7bdcd72

SHA256
d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

SHA512
ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Filesize
487KB

MD5
eaa6b5ee297982a6a396354814006761

SHA1
780bf9a61c080a335e8712c5544fcbf9c7bdcd72

SHA256
d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

SHA512
ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

Download Submit
\Windows\SysWOW64\directx\websetup\dsetup.dll
Filesize
87KB

MD5
0a23038ea472ffc938366ef4099d6635

SHA1
6499d741776dc4a446c22ea11085842155b34176

SHA256
8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

SHA512
dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

Download Submit
\Windows\SysWOW64\directx\websetup\dsetup32.dll
Filesize
1.7MB

MD5
7672509436485121135c2a0e30b9e9ff

SHA1
f557022a9f42fe1303078093e389f21fb693c959

SHA256
d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

SHA512
e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads