Overview
overview
7Static
static
3Microsoft ...up.dll
windows7-x64
4Microsoft ...up.dll
windows10-2004-x64
4Microsoft ...32.dll
windows7-x64
4Microsoft ...32.dll
windows10-2004-x64
4Microsoft ...te.dll
windows7-x64
3Microsoft ...te.dll
windows10-2004-x64
3Microsoft ...up.exe
windows7-x64
7Microsoft ...up.exe
windows10-2004-x64
7Microsoft ...ll.bat
windows7-x64
7Microsoft ...ll.bat
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
3Microsoft ...86.exe
windows10-2004-x64
3Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-08-2024 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft DirectX/dsetup.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Microsoft DirectX/dsetup.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Microsoft DirectX/dsetup32.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Microsoft DirectX/dsetup32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Microsoft DirectX/dxupdate.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Microsoft DirectX/dxupdate.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Microsoft DirectX/dxwsetup.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Microsoft DirectX/dxwsetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Microsoft Visual C++/install_all.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Microsoft Visual C++/install_all.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Microsoft Visual C++/vcredist2005_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Microsoft Visual C++/vcredist2005_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Microsoft Visual C++/vcredist2005_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Microsoft Visual C++/vcredist2005_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Microsoft Visual C++/vcredist2008_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Microsoft Visual C++/vcredist2008_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Microsoft Visual C++/vcredist2008_x86.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Microsoft Visual C++/vcredist2008_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Microsoft Visual C++/vcredist2010_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Microsoft Visual C++/vcredist2010_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Microsoft Visual C++/vcredist2010_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Microsoft Visual C++/vcredist2010_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Microsoft Visual C++/vcredist2012_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
Microsoft Visual C++/vcredist2012_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Microsoft Visual C++/vcredist2012_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Microsoft Visual C++/vcredist2012_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Microsoft Visual C++/vcredist2013_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Microsoft Visual C++/vcredist2013_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Microsoft Visual C++/vcredist2013_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Microsoft Visual C++/vcredist2013_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Microsoft Visual C++/vcredist2015_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
Microsoft Visual C++/vcredist2015_x64.exe
Resource
win10v2004-20240802-en
General
-
Target
Microsoft DirectX/dxwsetup.exe
-
Size
515KB
-
MD5
ac3a5f7be8cd13a863b50ab5fe00b71c
-
SHA1
eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9
-
SHA256
8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
-
SHA512
c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba
-
SSDEEP
3072:diqLKVd9Aqq3Z/yKxAG2ur4IhUNJ4g3nO9hpRH0gQSpHt+akOC8BTDmsikzWX+us:DFAKJr4IWNJ4MOrpRBQS3kydI+xyS
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
dxwsetup.exepid process 1072 dxwsetup.exe 1072 dxwsetup.exe -
Drops file in System32 directory 7 IoCs
Processes:
dxwsetup.exedescription ioc process File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET3841.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET3841.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET3840.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET3840.tmp dxwsetup.exe -
Drops file in Windows directory 2 IoCs
Processes:
dxwsetup.exedescription ioc process File opened for modification C:\Windows\Logs\DirectX.log dxwsetup.exe File opened for modification C:\Windows\INF\setupapi.app.log dxwsetup.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dxwsetup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxwsetup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dxwsetup.exepid process 1072 dxwsetup.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
dxwsetup.exedescription pid process Token: SeRestorePrivilege 1072 dxwsetup.exe Token: SeRestorePrivilege 1072 dxwsetup.exe Token: SeRestorePrivilege 1072 dxwsetup.exe Token: SeRestorePrivilege 1072 dxwsetup.exe Token: SeRestorePrivilege 1072 dxwsetup.exe Token: SeRestorePrivilege 1072 dxwsetup.exe Token: SeRestorePrivilege 1072 dxwsetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft DirectX\dxwsetup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft DirectX\dxwsetup.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\directx\websetup\dsetup.dllFilesize
93KB
MD5984cad22fa542a08c5d22941b888d8dc
SHA13e3522e7f3af329f2235b0f0850d664d5377b3cd
SHA25657bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
SHA5128ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef
-
\Windows\SysWOW64\directx\websetup\dsetup32.dllFilesize
1.5MB
MD5a5412a144f63d639b47fcc1ba68cb029
SHA181bd5f1c99b22c0266f3f59959dfb4ea023be47e
SHA2568a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
SHA5122679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405