hxxps://drive[.]google[.]com/drive/folders/1Pn5T0JH1ZHHZE4tZGRbNj6Mfouou99YS?usp=sharing

Resubmissions

08/06/2024, 09:40

240608-lnhpcsag3z7

08/06/2024, 09:32

240608-lhlttsbf387

Analysis

max time kernel
365s
max time network
370s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/drive/folders/1Pn5T0JH1ZHHZE4tZGRbNj6Mfouou99YS?usp=sharing
Sample240608-lnhpcsag3z

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4416	dxwsetup.exe

Loads dropped DLL 4 IoCs

pid	Process
4416	dxwsetup.exe
4416	dxwsetup.exe
4416	dxwsetup.exe
4416	dxwsetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 18 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
3	drive.google.com
119	drive.google.com
129	drive.google.com
164	drive.google.com
241	drive.google.com
4	drive.google.com
172	drive.google.com
180	drive.google.com
181	drive.google.com
203	drive.google.com
242	drive.google.com
118	drive.google.com
218	drive.google.com
75	drive.google.com
204	drive.google.com
217	drive.google.com

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_d3dx10_00_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET1C84.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET1C84.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET1C55.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_d3dx10_00_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET1C55.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xinput_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xinput_x64.cab	dxwsetup.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msdownld.tmp\AS5D6059.tmp\Apr2006_xinput_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D625D.tmp\Aug2006_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D625D.tmp\Aug2006_xinput_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D63C4.tmp\Dec2006_d3dx10_00_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D67DB.tmp\Apr2007_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D35EE.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D6182.tmp\Aug2006_xinput_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D63C4.tmp\Dec2006_d3dx10_00_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D63C4.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D66D1.tmp\Apr2007_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D5EF2.tmp\Apr2006_xinput_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D6182.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D625D.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D6579.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D67DB.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D5EF2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D35EE.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D5EF2.tmp\Apr2006_xinput_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D6059.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D6579.tmp\Dec2006_d3dx10_00_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D6579.tmp\Dec2006_d3dx10_00_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D66D1.tmp	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D68F4.tmp\Feb2005_d3dx9_24_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D6059.tmp\Apr2006_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D66D1.tmp\Apr2007_xinput_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D67DB.tmp\Apr2007_xinput_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5D35EE.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5D6182.tmp\Aug2006_xinput_x86.cab	dxwsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4416	2368	dxwebsetup.exe	128
PID 2368 wrote to memory of 4416	2368	dxwebsetup.exe	128
PID 2368 wrote to memory of 4416	2368	dxwebsetup.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1Pn5T0JH1ZHHZE4tZGRbNj6Mfouou99YS?usp=sharing
1⤵
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4876 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5900 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4956 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5588 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:2
1⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4940 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5508 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=5380 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=4956 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=5972 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6668 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=6744 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=6992 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5940 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6224 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3936

C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BusSimulator18\Binaries\Win64\BusSimulator18-Win64-Shipping.exe
"C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BusSimulator18\Binaries\Win64\BusSimulator18-Win64-Shipping.exe"
1⤵
PID:2500

C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BS18Installer.exe
"C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BS18Installer.exe"
1⤵
PID:3192

C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BS18Installer.exe
"C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BS18Installer.exe"
1⤵
PID:1612

C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BS18Installer.exe
"C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BS18Installer.exe"
1⤵
PID:2880

C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BusSimulator18.exe
"C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\Bus Simulator 18\BusSimulator18.exe"
1⤵
PID:4600

C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\_Redist\dxwebsetup.exe
"C:\Users\Admin\Downloads\Bus.Simulator-20240608T094119Z-001\Bus.Simulator\_Redist\dxwebsetup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Size 87KB
SHA256 8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a
MD5 0a23038ea472ffc938366ef4099d6635
SHA1 6499d741776dc4a446c22ea11085842155b34176
SHA512 dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88
SSDEEP 1536:gtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCL:gtAvG5mOEll4Roi2pVVFKJuTVtXVpS9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsetup32.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
Size 1.7MB
SHA256 d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea
MD5 7672509436485121135c2a0e30b9e9ff
SHA1 f557022a9f42fe1303078093e389f21fb693c959
SHA512 e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863
SSDEEP 49152:RjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWI:5IjmY
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.cif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.cif
Size 65KB
SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
MD5 b36d3f105d18e55534ad605cbf061a92
SHA1 788ef2de1dea6c8fe1d23a2e1007542f7321ed79
SHA512 35ae00da025fd578205337a018b35176095a876cd3c3cf67a3e8a8e69cd750a4ccc34ce240f11fae3418e5e93caf5082c987f0c63f9d953ed7cb8d9271e03b62
SSDEEP 768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
Size 173KB
SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
MD5 7ed554b08e5b69578f9de012822c39c9
SHA1 036d04513e134786b4758def5aff83d19bf50c6e
SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.cif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif
Size 56KB
SHA256 b062aa4b9e9c2fcbec20d0d3c04071a01a1abe08831d780e82e6be22867d1f34
MD5 386aedf86d7f2a2e3f6fc056d3c1e03f
SHA1 9a2069787b997342f44908850facce63cfab4b6a
SHA512 8544d7ce9adc2628b6160a90775973c41f44ec0123e30b05852d5513d2db401692490bf8a1a3ce4fead40c8dcc0e82f75f5e0be1b45935829242e5276b1baa7b
SSDEEP 768:eNITdgil00BU0twUZB7otN4PTH+y491I7/su6U3mI9rITogZD0+pYnrIvdgsl0KI:eEBDSYj4kiJOnitAmfdwe5q24jIxwzKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.cif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif
Size 56KB
SHA256 3ef4c33102886eae3c812b948ff3fbf70bb03dd91e772b852da3f9aaf75bdb29
MD5 0dafb23d5bd4b80c79a0f82dc2de34d0
SHA1 8159fd03f133c9cd8cfb194971a5250b9ecda0a8
SHA512 78e7fb35cab3d0ace4e4fef2868cc5f31b2254c267402779893b3f3fce90b8d784328ac19ef0d6bd37d975d557917be19d7a8a32a94ff8606afd36883ec1c9bb
SSDEEP 768:eNITdgil00BU0twUZB7otN4PTH+y491I7/su6U3mI9rITogZD0+pYnrIvdgsl0KW:eEBDSYj4kiJOnitAmfdwe5q24jIxwzKI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 487KB
SHA256 d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee
MD5 eaa6b5ee297982a6a396354814006761
SHA1 780bf9a61c080a335e8712c5544fcbf9c7bdcd72
SHA512 ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999
SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzoPD+sUn7RG+hPXzNbgC1Adm2exP:6kvS4c3C7iMw70
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxwsetup.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
Size 477B
SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
MD5 ad8982eaa02c7ad4d7cdcbc248caa941
SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
MD5 SHA1 SHA512

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 4KB
SHA256 f048abffab9c32924a639381bbf75db0826e180d072524ac06ac26b4409c4dcc
MD5 c83637ded63133f0af6f96c41113086f
SHA1 e63ce9f884b0365786e504f8863de46f021160c1
SHA512 e9018fc5660c2b997139b88ea7563700641e4853a5251f463feb4e75e2cac0750517a075bdf0751aab84a56f10ac647d389113833634d1ded8ffa202bce8d4d6
SSDEEP 96:kgiiesemRnoJhbay47+t9z1o9P4al07HG6:kv5+o5OgaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apr2006_xinput_x64.cab

Path C:\Windows\SysWOW64\directx\websetup\Apr2006_xinput_x64.cab
Size 88KB
SHA256 e63a67783ef7624559f95ab697bf8afbdab7ace31200283ef840e6b94aa16e5a
MD5 b0669f7d395078bee0087b089f0b45c5
SHA1 30506fc3dce9532ef0a8cb3973347ec9c3c9875f
SHA512 d7efcfd85b3cb6cb9b1936b701a9d7d91a6094aa08d8c933edf8493c6ad57be05a579980a404b35e9721f71b45f4cae28399fca3ff5df20a9a3138b90f86b94c
SSDEEP 1536:/0CNqg1WzKHJUq/JSlvxToeSNOUp9BttldRL9zaMNez4fbI9YKztrIrm:/hIg1cEJUxvxlSNOUpfttldRL9zkzAI5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apr2006_xinput_x86.cab

Path C:\Windows\SysWOW64\directx\websetup\Apr2006_xinput_x86.cab
Size 48KB
SHA256 3fdf63211b0dd38069a9c1df74d7bc42742de003cef72ad1486aaa92d74546fa
MD5 e207fb904e641246f3f7234db74121fc
SHA1 1be8c50c074699bdd9184714e9022b7a2f8bf928
SHA512 ed95d53bc351c98c0322753265b0a21c98df97d0e2fbbc58a6836bff374b7540b0cea21371cd4a7ead654210a42e1f9809cac6e4eae2ecf0ef2b88e220dc37f7
SSDEEP 768:rrXN+lWp5tvn2v0JeuXfYYJDyRIvwde6hecBLdKd+d4RUJ6HwyQs34VvD4:3gl6tfTVXwcWuqe6htcaJyQW4VvD4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apr2007_xinput_x64.cab

Path C:\Windows\SysWOW64\directx\websetup\Apr2007_xinput_x64.cab
Size 97KB
SHA256 86ee073c199b5080fe4f5be6ac24bb1117fea42e4bbcd828b4f0ec26c669b22c
MD5 fae84e0773a74f367124c6d871516b7b
SHA1 caf8b9d7d4af965bf445d052d1e835b680d6bbc3
SHA512 caf1381cae7417b57faef56d0023bf90c90406748f8813ab85c687ddb81e2498d2f1d5f4bc154903fd5a19836e6f245cd6f5d3927a383f1acc3bcc41b58fd09b
SSDEEP 3072:Mt5OSvuXSf2rbZu4Kmsr4eLRwPC5B9y7q:MTOBXSSpFI4/PM/ye
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apr2007_xinput_x86.cab

Path C:\Windows\SysWOW64\directx\websetup\Apr2007_xinput_x86.cab
Size 55KB
SHA256 b6c1166c57d91afeeeaa745238d0d6465ff2084f0606fd29faf1bfa9e008a6c5
MD5 b362ec93463d8b6381a864d35d38c512
SHA1 7ce47ebceda117d8b9748b5b2d3a6ae99fc239df
SHA512 cc57733912e2a296a11cd078372c3b43f1256a93ec5becd0d1b520eb210fce60938aa1caa6dbbca03292a05495b5ecd212ee5f77e3ebabb11ef31f1975b2d09e
SSDEEP 1536:BcnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZKn4:4wb+2eZonQwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aug2006_xinput_x64.cab

Path C:\Windows\SysWOW64\directx\websetup\Aug2006_xinput_x64.cab
Size 88KB
SHA256 c26633d38e0a91b9be70382e916a83d50e219609f7e05cfb2d27dfafbe480b43
MD5 a9d582e44e46e36f37edb7cbc761179d
SHA1 ed1bef64385e94ce89afa704d38408e23b31fa79
SHA512 20011bfb547dedce8e6fceda22c3a3a83db140e8a20844f3b0e8741b4474c1fea73d84708b801e83eae3cd2d8a2d6c851c3f7cd0154c0382a78bc2c2df6b01e5
SSDEEP 1536:5lQFOMW9t2gGQtmxC4LbB8GXjgvW/j44krD+W2MLdk6v5yO1Ha6DB/4RPjz6ITda:rIOMWm+tmnbXjVkWW1lgO166cjz6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aug2006_xinput_x86.cab

Path C:\Windows\SysWOW64\directx\websetup\Aug2006_xinput_x86.cab
Size 48KB
SHA256 6dd7c0abe37d3df7aa6db7bb352260f4a15dc965ff9d30aa32fe9595c1a18300
MD5 16b968ca0c435ee45e77a84c2d0364a9
SHA1 90b17a60a34f6335787a6b2d489cbcd3a4ea98c8
SHA512 3bbbfdf8b5673641ec066c3fb52e6b0d5ce0bc6ed6bff17ab4ac3fa69a8628b09e5ec8322fc39d2a206974b54d297caaff9410197e26d090fe74f963cd535045
SSDEEP 768:OuG396sAA1wXXvVFc2755DkphtVmUkt/lnkvH0odpl/q1nk:vwQsAhFcSmpJ3kt/xcd7ek
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dec2006_d3dx10_00_x86.cab

Path C:\Windows\SysWOW64\directx\websetup\Dec2006_d3dx10_00_x86.cab
Size 190KB
SHA256 02daa8b5ac3752f76c3bfd9a505ebf22b1b4b41e44eb92ce2799033b2330d186
MD5 75c33157d8a1b123d01b2eac91573c98
SHA1 e3e65896ce0520413979c0143c3aa9bd3a6a27d3
SHA512 f0f1f1dea5938e1c7ff2adf7c8d421c2e68e6d3a8cdf18d0f2f3fe1c6837a4f37b367d2d974c35832d1d85a619948dd0f250c7d6dc4ae39f618f5a2893eac7dd
SSDEEP 3072:x4mJ4SadBGg8IZrdosr2nqOwY7l43gRDlcGgp6VMslgVwxikcBmEi21wx8MqX+dN:xJJ4VWgzZptAqOf6wRD5g0VlgVwxL21I
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.cab

Path C:\Windows\SysWOW64\directx\websetup\dxupdate.cab
Size 98KB
SHA256 6e39b3fdb6722ea8aa0dc8f46ae0d8bd6496dd0f5f56bac618a0a7dd22d6cfb2
MD5 4afd7f5c0574a0efd163740ecb142011
SHA1 3ebca5343804fe94d50026da91647442da084302
SHA512 6f974acec7d6c1b6a423b28810b0840e77a9f9c1f9632c5cba875bd895e076c7e03112285635cf633c2fa9a4d4e2f4a57437ae8df88a7882184ff6685ee15f3f
SSDEEP 3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 137B
SHA256 34eda9073fd30d317a6a35e1989dbd74f400121faaa9b1f4c7da138f8686b243
MD5 e16ac2a22fdfb293c815c945eab28310
SHA1 66831191df79f5c3990436921b08dc2171b0ca57
SHA512 08480390b059545acb8ca1038c5060693a938c987a1ea1057e6f03951a7db0dee8d97d1540f646f8d249d38e54ea43fb49b01610801deaaacfbe29f4361cbe93
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 22B
SHA256 e1c85577fee77b7535af5918de16479d5b38f08d7aadbf1b3613d275c7797920
MD5 cc85d7649546d3c0b1607f761b73fec2
SHA1 1a1a10b819f321b91b47d7dd73668406a15992db
SHA512 34c4427ac1c6d84861d84bf699f215e1cc271c3214b39d3acbe0d4dfdb8eae6c4e7c340068ece3899ed5a4146508dac48e92ff2cfc9f4691dd1ea487cf3ffdcc
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 111B
SHA256 9ee5f6b1a1202f3bbf64e7fbdd13963fadb2bf299630c17b1397ab2aa15d6731
MD5 24701b46dccc4ac0b74d23bf457b15a8
SHA1 2d82c069cc6e05fd6d0bcb7665171ffaf136f8ea
SHA512 4ee56e6cee09bd3e01f9574b01210402acf90f5efb2ff697dcff4eb8f26016462f9d7b1927aa8e34b8a2b3c8eccd7ae148a7c65a07cce663fe27a750249a1be5
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 243B
SHA256 219d6ee0de269b7637795edeb062d02a8e11c0fe3e99a888a1e399dc39326323
MD5 be4b4e08b075aa9a1f879f6bd773ca76
SHA1 e66f02cea53e8e615d78c0effd3cce2ac26bd9b7
SHA512 8b54601f96e7e908f0e82f21730d755158449fce07acc04adf32e6d466f481b302a66c56aefd158dd934429e52486376d4804d002a8337c617a9a001294246a1
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 384B
SHA256 e941ec82e23d8cff199e997f3bd563400fb07d0f7b86c702b8a88d204d4d9f7f
MD5 dff54547a2403616d2702d844d7dfee4
SHA1 3b20eff70f94888bd75fab2a991c189c41f387f9
SHA512 f5e4d6f72b36bd11a24d7a558608082dcc0ba320be2dfabf962b4de691195ab6141dadac13caf952a3b2017d0efa5288f70d11a140db761866539bfdf23dec7c
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 525B
SHA256 08c5c78b02c6e8c65b2de09ce8bc6e5439652493061323327dd690ef2d1ebe87
MD5 7a5e4b6d5503507290247f28bcb75a9a
SHA1 52ca91283734f5d49e4ea197aec2051b94eb291d
SHA512 6e6b8a552aefa9deabd2c461d483474a5fecd9fd3eecd2108bf2b9b184de0939c4c4ef1ec75e7228c6349e9a2c3e1db74d65d6cd9e1c1188627db0c6a7fe53c5
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 666B
SHA256 a7755c5caf4fc735f6a7d964162057e8fb10528dcd9367a6633d989e90abc117
MD5 2044cce267a03939cca48148345eda9a
SHA1 730839f971ff42c7412ca7dd9c4020339a737d26
SHA512 df71fe7b7d8f50a0d335e0d0a204a5f9e640567e21d992a3c6d757907f2ef391c580ab452d1eb351816b50388d6e1a8fd5ff03098452652833af0a3d56960968
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 807B
SHA256 a581a74906e1a33fe2d3b5546d184fb8884ed6fbb0b0bccae695f93653f540b4
MD5 af983ce670890c8c32b08aabf36e724e
SHA1 7003166c74cf01deb731ce38edb0e28fa1f5576d
SHA512 631d179e62ae4c801794a32bd6b4b7d0937e6eb312ccb4220b542463b79bb687c59cf5757f5ffb4ea1f32ce5e6d9a2d2bf725d037cacb800a1acdf950bdb56cd
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 846B
SHA256 89114fe7ac4f11b3374e82e4711d6919861a0fe29b2126799b4d601f5f735990
MD5 a96f75664b536592627cdb480722ea1b
SHA1 4f051a963c4f31dec9e06a290a590e32d9ee86ec
SHA512 2c81cee637b36e1438480e9625ea297af1591eef23376a0cbc5a1f4fd8530bb4468f739b631fb8fb3a503253e88394bcec0b7e89ca4ddd187679c413e89f3b3d
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 bc142220dfeccb55b3e303756adbcb12d5a7c0a6d6a03ed02efcdda716cc75d2
MD5 a3faba0e2d7af7bf0551f566f9a9c944
SHA1 91dd9549b0bb614c9d80aa0d1234037f5690714f
SHA512 29d044784b94180265253d3cdae8b425a30a0afdefeb56c9cd95191d75dc2d7d5875d8cb54c5b3565b9d5fba8e877d4189890757caf9456fcdd306bc7469ecef
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 557bf88c627a19ea86c83d5a92029f648a9dcbb2af894c27e3465c02be4c4713
MD5 e67e47a9b3d99bddaa3cbe9f14ff0a9e
SHA1 e8a39580cec1b814e8eff8f7f8fc9e5c2313c0ba
SHA512 2a39146c53fd96b9a752b6e1f6cfa04e71626ceb8314d1198bdf99ea72cea177ffa88c5ceeea62c0ec67a45d7e6155317cf0f0a99c13fb403c9b5734fb363186
MD5 SHA1 SHA512

Submit Download

filelist.dat

Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
Size 1KB
SHA256 646e983d302e862166620596a5b7d90e5d6db97f0c5459253f633e0da30149a2
MD5 6fa8e6866270e57847607ee4f052a7c4
SHA1 040eb9937e24965feeb276621bc6c0b8c9fa3e01
SHA512 cfb060a7f8941543fbf2def7b724f4ec3874861fea087ff8741aa1d44985b9a8c7fdc43d3603034b4e65c71fabe042c16501f9586b8463e25650e59bd44c0afe
MD5 SHA1 SHA512

Submit Download

Dec2006_d3dx10_00_x64.cab

Path C:\Windows\msdownld.tmp\AS5D6579.tmp\Dec2006_d3dx10_00_x64.cab
Size 210KB
SHA256 f9bd5bb083bd55d1d2a690bc66d6d9da0b1a8b49f09e811e788c030669121118
MD5 681407075e9b19e5ef2218832f6fad71
SHA1 e4f4d292a36cd9a3034007ef9d2005694307eb52
SHA512 e983e7dd3f40510816ff3ae836600a186dba827b484b0c346c20e43e229189a86d4cb5cf219c1fc35b77ab0668866446f6e9206b279931c927d4ed66ad3625f1
SSDEEP 3072:SGo145qtWQt9fL4bBHlKqDfaqaGm3+vqm9/Xx0b6POnzED/RIxeqTk0T:SGo145qtbt1LaeB36/xc6PkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads