fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe
Size 281KB
Sample240302-2lcnbsae44
SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
MD5 fd6057b33e15a553ddc5d9873723ce8f
SHA1 f90efb623b5abea70af63c470daa8674444fb1df
SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1724	dxwsetup.exe

Loads dropped DLL 5 IoCs

pid	Process
1592	dxwebsetup.exe
1724	dxwsetup.exe
1724	dxwsetup.exe
1724	dxwsetup.exe
1724	dxwsetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET99CF.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET99CF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET99F0.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET99F0.tmp	dxwsetup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	dxwsetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1724	dxwsetup.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	1724	dxwsetup.exe
Token: SeRestorePrivilege	1724	dxwsetup.exe
Token: SeRestorePrivilege	1724	dxwsetup.exe
Token: SeRestorePrivilege	1724	dxwsetup.exe
Token: SeRestorePrivilege	1724	dxwsetup.exe
Token: SeRestorePrivilege	1724	dxwsetup.exe
Token: SeRestorePrivilege	1724	dxwsetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1724	1592	dxwebsetup.exe	28
PID 1592 wrote to memory of 1724	1592	dxwebsetup.exe	28
PID 1592 wrote to memory of 1724	1592	dxwebsetup.exe	28
PID 1592 wrote to memory of 1724	1592	dxwebsetup.exe	28
PID 1592 wrote to memory of 1724	1592	dxwebsetup.exe	28
PID 1592 wrote to memory of 1724	1592	dxwebsetup.exe	28
PID 1592 wrote to memory of 1724	1592	dxwebsetup.exe	28

C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\_Redist\dxwebsetup.exe
"C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\_Redist\dxwebsetup.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Size 87KB
SHA256 8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a
MD5 0a23038ea472ffc938366ef4099d6635
SHA1 6499d741776dc4a446c22ea11085842155b34176
SHA512 dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88
SSDEEP 1536:gtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCL:gtAvG5mOEll4Roi2pVVFKJuTVtXVpS9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsetup32.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
Size 1.7MB
SHA256 d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea
MD5 7672509436485121135c2a0e30b9e9ff
SHA1 f557022a9f42fe1303078093e389f21fb693c959
SHA512 e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863
SSDEEP 49152:RjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWI:5IjmY
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 384KB
SHA256 b8c3d2b050e3541e4072d8522a63319ce53f48ce7c975d2b2f389db91df36865
MD5 95af51a930889c82630553e5d9d24f4b
SHA1 d24fe70a2152b09d1b85166443e24d2d61defdf5
SHA512 faeafbeea9c190b33b5354ec9998cb285911cecf78c69acbe11a2de253e939494e5d72b8036e849f27358d3db64a81f395f81ec3f34810a9f74db37f9edca4cd
SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzoPD+sUn7RG+hPXzNbgC1Adm2exE:6kvS4c3C7iMw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 223KB
SHA256 0d2d950d7ac0b622b3d65a616fbb09875cd1c26d01eff31f07d000a61d6706b2
MD5 69f2ccb12f81ec470df9d387b8c6bbb6
SHA1 2d8837824951e146eb9428b781936cfb605ce05b
SHA512 f93e3172b709cdb848a63a3d7909d0b43979960068e86045207d1884742e513e9613fabe1be402bcfe34fa46235e6a7d682bf9cb18fe5fbdb2dc404a7815e1e4
SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVz+:6kvS4c3C7iM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
Size 477B
SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
MD5 ad8982eaa02c7ad4d7cdcbc248caa941
SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
MD5 SHA1 SHA512

Submit Download

dxwsetup.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 487KB
SHA256 d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee
MD5 eaa6b5ee297982a6a396354814006761
SHA1 780bf9a61c080a335e8712c5544fcbf9c7bdcd72
SHA512 ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999
SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzoPD+sUn7RG+hPXzNbgC1Adm2exP:6kvS4c3C7iMw70
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 256KB
SHA256 1a529633246ee8977411af4128738ee7389d8576e100f86fbf590a336e0f8d68
MD5 938638d0da26178572066d3f62ddd15c
SHA1 9941160e7d06e97460aba020e29b42e52bec04e3
SHA512 934c943250737c737e2f268632300bb923070518f4b7fa321c6d39392fa3cfce032d5a41d54de6ad40529b96e3699fe78251d98f79b102e38a70e49e7af5e1af
SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzoI:6kvS4c3C7iMV
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 192KB
SHA256 82f87b955cbe426c3b6302bb2de938057166af6a0db02a3a191d17814fecefb8
MD5 ba4a4b82dd8bd438959b8542d66161ad
SHA1 51d91e28ace38ea7d183498edd9031dabb6f18bb
SHA512 72689ceba03390eaa0ca228d7885d15531fe57e9c4fdbe619bdd33777b3b79b7f828a81c11b60f16248cf64bff3086c41df04f25e7f13815fd2d3af971025e88
SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzy:6kvS4c3C7iMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads