2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
294s
max time network
353s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Oneshot/_Redist/dxwebsetup.exe
Size

281KB
MD5

fd6057b33e15a553ddc5d9873723ce8f
SHA1

f90efb623b5abea70af63c470daa8674444fb1df
SHA256

111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
SHA512

d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
SSDEEP

6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

dxwsetup.exe

pid process

4960 dxwsetup.exe
Loads dropped DLL 2 IoCs

Processes:

dxwsetup.exe

pid process

4960 dxwsetup.exe
4960 dxwsetup.exe

pid	process
4960	dxwsetup.exe

pid	process
4960	dxwsetup.exe
4960	dxwsetup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dxwebsetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Drops file in System32 directory 7 IoCs

Processes:

dxwsetup.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET7E1A.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET7E1A.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET7DFA.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET7DFA.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe

Drops file in Windows directory 2 IoCs

Processes:

dxwsetup.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DXError.log	dxwsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dxwebsetup.exe

description	pid	process	target process
PID 4232 wrote to memory of 4960	4232	dxwebsetup.exe	dxwsetup.exe
PID 4232 wrote to memory of 4960	4232	dxwebsetup.exe	dxwsetup.exe
PID 4232 wrote to memory of 4960	4232	dxwebsetup.exe	dxwsetup.exe

C:\Users\Admin\AppData\Local\Temp\Oneshot\_Redist\dxwebsetup.exe
"C:\Users\Admin\AppData\Local\Temp\Oneshot\_Redist\dxwebsetup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4232

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Filesize
87KB

MD5
0a23038ea472ffc938366ef4099d6635

SHA1
6499d741776dc4a446c22ea11085842155b34176

SHA256
8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

SHA512
dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
Filesize
1.7MB

MD5
7672509436485121135c2a0e30b9e9ff

SHA1
f557022a9f42fe1303078093e389f21fb693c959

SHA256
d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

SHA512
e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Filesize
487KB

MD5
eaa6b5ee297982a6a396354814006761

SHA1
780bf9a61c080a335e8712c5544fcbf9c7bdcd72

SHA256
d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

SHA512
ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Filesize
487KB

MD5
eaa6b5ee297982a6a396354814006761

SHA1
780bf9a61c080a335e8712c5544fcbf9c7bdcd72

SHA256
d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee

SHA512
ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
Filesize
477B

MD5
ad8982eaa02c7ad4d7cdcbc248caa941

SHA1
4ccd8e038d73a5361d754c7598ed238fc040d16b

SHA256
d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00

SHA512
5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28

Download Submit
C:\Windows\Logs\DXError.log
Filesize
183B

MD5
caa467db6a587dbf93ee5178b34b9401

SHA1
23df245de71e8b8ce5b444715babb8109a5177d4

SHA256
9959a92c59cd8fc1d3cb5750a941aa8a497730dd3c39fba2885ccc023c3e642e

SHA512
1b0641826958abc835041f9d10b046474b8cc793737d3ff6ae0c250f52a2e0d6f8e759bf752aa646c2e4a8eb4dbaf6c0f5375f516cd08e777b84db8e5f81181a

Download Submit
C:\Windows\Logs\DXError.log
Filesize
488B

MD5
4a6d343a9917941f331dd9230db530bc

SHA1
e25990f77b16ff74956c4bafcef2b275a851cff8

SHA256
4be95845245efa63150fd602d5c7151e9daeb00044bfd5143d6abf10d64e7e7b

SHA512
760c6c79cc3621d6560977755f13fb1104856ab614c8f1a3e7017f71df994c7127566ba6afccc5c02d654c1132bb0a824beff7d8a4b0cf3591147ae38da7c3c1

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup.dll
Filesize
87KB

MD5
0a23038ea472ffc938366ef4099d6635

SHA1
6499d741776dc4a446c22ea11085842155b34176

SHA256
8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

SHA512
dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll
Filesize
1.7MB

MD5
7672509436485121135c2a0e30b9e9ff

SHA1
f557022a9f42fe1303078093e389f21fb693c959

SHA256
d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

SHA512
e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

Download Submit
\Windows\SysWOW64\directx\websetup\dsetup.dll
Filesize
87KB

MD5
0a23038ea472ffc938366ef4099d6635

SHA1
6499d741776dc4a446c22ea11085842155b34176

SHA256
8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a

SHA512
dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88

Download Submit
\Windows\SysWOW64\directx\websetup\dsetup32.dll
Filesize
1.7MB

MD5
7672509436485121135c2a0e30b9e9ff

SHA1
f557022a9f42fe1303078093e389f21fb693c959

SHA256
d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea

SHA512
e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863

Download Submit