Overview

overview

7

Static

static

3

Dxpserver.zip

windows10-2004-x64

1

Dxpserver.zip

windows11-ltsc_2024-x64

1

DWWIN.exe

windows10-2004-x64

1

DisplaySwitch.exe

windows10-2004-x64

3

DmNotifica...er.exe

windows10-2004-x64

1

DmOmaCpMo.exe

windows10-2004-x64

1

DpiScaling.exe

windows10-2004-x64

7

DsmUserTask.exe

windows10-2004-x64

3

Dxpserver.exe

windows10-2004-x64

6

Eap3Host.exe

windows10-2004-x64

1

EaseOfAcce...og.exe

windows10-2004-x64

1

dispdiag.exe

windows10-2004-x64

1

djoin.exe

windows10-2004-x64

1

dllhost.exe

windows10-2004-x64

1

dllhst3g.exe

windows10-2004-x64

1

dmcertinst.exe

windows10-2004-x64

1

dmcfghost.exe

windows10-2004-x64

1

dmclient.exe

windows10-2004-x64

1

dnscacheugc.exe

windows10-2004-x64

4

doskey.exe

windows10-2004-x64

1

dpapimig.exe

windows10-2004-x64

1

dpnsvr.dll

windows10-2004-x64

1

driverquery.exe

windows10-2004-x64

1

drvinst.exe

windows10-2004-x64

1

dsregcmd.exe

windows10-2004-x64

1

dstokenclean.exe

windows10-2004-x64

5

dtdump.exe

windows10-2004-x64

1

dusmtask.exe

windows10-2004-x64

1

dvdplay.exe

windows10-2004-x64

6

dwm.exe

windows10-2004-x64

7

dxdiag.exe

windows10-2004-x64

7

dxgiadaptercache.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Dxpserver.zip
  • Size 1.7MB
  • Sample261026-t5mnmsfs41
  • SHA256 0f821c080208c1ab1c63acf0edd944bf701769be2ce3325d4a33cb2b60d77e7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target
      Dxpserver.zip
    • Size 1.7MB
    • SHA256 0f821c080208c1ab1c63acf0edd944bf701769be2ce3325d4a33cb2b60d77e7b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      DWWIN.EXE
    • Size 256KB
    • SHA256 cdd16f625ff62b92320fd498a2299f304f120d816fc0bded37cc1d1022a4e6b8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      DisplaySwitch.exe
    • Size 1.8MB
    • SHA256 775296b6dd6bfbb3684d272a70606f40c2311a5c144f1328b37117e3b3ff074c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    persistenceprivilege_escalation
    behavioral4
    • Target
      DmNotificationBroker.exe
    • Size 52KB
    • SHA256 712d1e37910db9fb3f97edd21aedd77ca7bd3abccffa1520ac5b26911c29401c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      DmOmaCpMo.exe
    • Size 60KB
    • SHA256 5b386f630cd540b80becbe9248cfd37a7e8c6fda6f5dc3615f1e7ddb43e39218
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      DpiScaling.exe
    • Size 100KB
    • SHA256 58012ed021e4e99afd7c5efb2fdbf433fafe2c8c51ef0676e1ab72b59e709eaa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral7
    • Target
      DsmUserTask.exe
    • Size 56KB
    • SHA256 4ca522be6a9e4a4bc93ff4a6f78045a52dd0fb3fa7f72f9271be6fccd31d6c2d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral8
    • Target
      Dxpserver.exe
    • Size 304KB
    • SHA256 4c5908c1181ae4f0157a8cee9a9520c9cbf20dcd190e5cc456ccc03a2346a181
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral9
    • Target
      Eap3Host.exe
    • Size 40KB
    • SHA256 e58c1daa4c67607b527b4e406cf99f2dcc3e087022e8f9b6fbc88532a7b9f2ef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      EaseOfAccessDialog.exe
    • Size 312KB
    • SHA256 42b6b172831b0b0cc1457af7902a646821914c5a8c335eccfe9dc62c44704d1a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      dispdiag.exe
    • Size 188KB
    • SHA256 0129ab3ad337352d1d58a6145d2a110499ff88c8a482348653f2066dcfb0f74a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      djoin.exe
    • Size 104KB
    • SHA256 0f2ee312586ccb31ecfd06e0285e38e8c50dad06b8de8bc078a8dc00791b09da
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      dllhost.exe
    • Size 91KB
    • SHA256 abee3c2607c26494f903f9b59a7063ae106d7d33701d69db3864e42e9b019c7c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14
    • Target
      dllhst3g.exe
    • Size 72KB
    • SHA256 2e39f126213e217f4c39c19033676324a35741738af8f11f6c855559c7b23392
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15
    • Target
      dmcertinst.exe
    • Size 200KB
    • SHA256 48061474071b8de5d86091dfdfbfd16c3b8040f2bc7560bcbe0e0676f986c4e3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      dmcfghost.exe
    • Size 64KB
    • SHA256 992fb4bc28025a397dfb14ea2087090410dc626ff73de9dd915b20fd3f6b90c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      dmclient.exe
    • Size 168KB
    • SHA256 258fd0b17d63a0bec87c5480b6e7ec5b881cc118945418d822b7996258cee0de
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      dnscacheugc.exe
    • Size 60KB
    • SHA256 95133819c8decb2e56345fdd04b89ef7cbb441a0aa43f75aa47607d55d754339
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    behavioral19
    • Target
      doskey.exe
    • Size 44KB
    • SHA256 7e593969455a03083089f4e917a899e785dd7c527068861a877073cc67b2a0e8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      dpapimig.exe
    • Size 100KB
    • SHA256 251a68841ba51e8919640c3b61438644de266c14698966464028f13115a497f6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      dpnsvr.exe
    • Size 36KB
    • SHA256 7bacf93d7efd1870cc8def5876998ab4d58e58091be80185fcd1497e85ff7b63
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      driverquery.exe
    • Size 104KB
    • SHA256 84b5a5ebdc2cf3f4e76ecb4c76de2fe082efa48ca0e7897aab4780c033008f9d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      drvinst.exe
    • Size 440KB
    • SHA256 4bb26477cd3d17318a787f5d13d7dfb7dd190c10ca254b908f672afe14bac339
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      dsregcmd.exe
    • Size 472KB
    • SHA256 78cfafc3329fe00c75151d8a5b8f4f8876971501c8b79f97d0e4e03d0f609d57
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      dstokenclean.exe
    • Size 40KB
    • SHA256 caae9bab010d01176fdddaee82ff9272bcc04adceee3eb16c3ff62bea7ab29f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10

    • Drops file in System32 directory

    behavioral26
    • Target
      dtdump.exe
    • Size 160KB
    • SHA256 1b52612eb8471aa496cd8c59b1aed3b3c863093e0cc88b06f8cd22531fdef58e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      dusmtask.exe
    • Size 76KB
    • SHA256 a966a0c5c014615c5bbd52648a0e0ce6774b6e70139a3522c9aa89d208ba4a1c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      dvdplay.exe
    • Size 40KB
    • SHA256 ca692f9c3d22fac77a84d1155ae4b757664cc50386310c59a6d827ee5b58cca1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral29
    • Target
      dwm.exe
    • Size 132KB
    • SHA256 7fb9981c58663f7687e5404369cd5434ce7e043c1b805cc8512961d2fc5f1cf8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasion

    • Executes a file named after a Windows system binary

      The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

      defense_evasion
    behavioral30
    • Target
      dxdiag.exe
    • Size 332KB
    • SHA256 0601f86c74871d1cf03dd1e5df8a546eacd981680f9eef49b528adda72e05a47
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral31
    • Target
      dxgiadaptercache.exe
    • Size 128KB
    • SHA256 c9b99973f798e05abbe650d5cf6ecc009ede69ca15155ee046fb8b9f4355616d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

persistenceprivilege_escalation
Score
3/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
7/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
6/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
4/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
5/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

discovery
Score
6/10

behavioral30

defense_evasion
Score
7/10

behavioral31

discoverypersistenceprivilege_escalation
Score
7/10

behavioral32

Score
1/10