File name: | 68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129 |
Full analysis: | https://app.any.run/tasks/a66514d1-7270-4863-a145-9d5a385b82b5 |
Verdict: | Malicious activity |
Analysis date: | August 25, 2019, 10:30:05 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | 9D8A5FB8429597DFC925274EA7ED1C25 |
SHA1: | 40C5AD81C21F5D678CDF419E7045A0A2EC5B10C5 |
SHA256: | 68CF6C08769ADF549ACF37145297CD1E1BECBAF66AE8AFEF8B57C56C8BD8F129 |
SSDEEP: | 6144:q7EqSIHT9TVDE0qnj7VKHHdSJs4VmPJmkvsLOsf+WHu3:Jxo/DE0qj7VKndS1mP587O3 |
.exe | | | UPX compressed Win32 Executable (39.3) |
---|---|---|
.exe | | | Win32 EXE Yoda's Crypter (38.6) |
.dll | | | Win32 Dynamic Link Library (generic) (9.5) |
.exe | | | Win32 Executable (generic) (6.5) |
.exe | | | Generic Win/DOS Executable (2.9) |
ProductVersion: | 9.29.1974.0 |
---|---|
ProductName: | Microsoft® Windows® Operating System |
OriginalFileName: | dxwebsetup.exe |
LegalCopyright: | Copyright (c) Microsoft Corporation. All rights reserved. |
InternalName: | DXWebSetup |
FileVersion: | 9.29.1974.0 |
FileDescription: | DirectX 9.0 Web setup |
CompanyName: | Microsoft Corporation |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 6.0.2600.0 |
FileVersionNumber: | 6.0.2600.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 5.1 |
OSVersion: | 5.1 |
EntryPoint: | 0x4f730 |
UninitializedDataSize: | 49152 |
InitializedDataSize: | 8192 |
CodeSize: | 274432 |
LinkerVersion: | 7 |
PEType: | PE32 |
TimeStamp: | 2001:08:18 03:42:57+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 18-Aug-2001 01:42:57 |
Detected languages: |
|
CompanyName: | Microsoft Corporation |
FileDescription: | DirectX 9.0 Web setup |
FileVersion: | 9.29.1974.0 |
InternalName: | DXWebSetup |
LegalCopyright: | Copyright (c) Microsoft Corporation. All rights reserved. |
OriginalFilename: | dxwebsetup.exe |
ProductName: | Microsoft® Windows® Operating System |
ProductVersion: | 9.29.1974.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000C8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 18-Aug-2001 01:42:57 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x0000C000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x0000D000 | 0x00043000 | 0x00042A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.74664 |
.rsrc | 0x00050000 | 0x00002000 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.01205 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.48753 | 884 | Latin 1 / Western European | English - United States | RT_VERSION |
2 | 3.53793 | 296 | Latin 1 / Western European | English - United States | RT_ICON |
63 | 6.53718 | 140 | Latin 1 / Western European | English - United States | RT_STRING |
76 | 7.7496 | 1312 | Latin 1 / Western European | English - United States | RT_STRING |
77 | 7.72595 | 1484 | Latin 1 / Western European | English - United States | RT_STRING |
80 | 7.73844 | 1200 | Latin 1 / Western European | English - United States | RT_STRING |
83 | 7.62199 | 1098 | Latin 1 / Western European | English - United States | RT_STRING |
85 | 7.44135 | 974 | Latin 1 / Western European | English - United States | RT_STRING |
2001 | 7.58936 | 716 | Latin 1 / Western European | English - United States | RT_DIALOG |
2002 | 7.26854 | 394 | Latin 1 / Western European | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.DLL |
USER32.dll |
VERSION.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2904 | "C:\Users\admin\AppData\Local\Temp\68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe" | C:\Users\admin\AppData\Local\Temp\68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: DirectX 9.0 Web setup Exit code: 3221226540 Version: 9.29.1974.0 | ||||
3640 | "C:\Users\admin\AppData\Local\Temp\68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe" | C:\Users\admin\AppData\Local\Temp\68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: DirectX 9.0 Web setup Version: 9.29.1974.0 | ||||
2740 | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe | 68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: DirectX Setup Version: 4.9.0.0904 | ||||
3352 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2408 | C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (3640) 68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce |
Operation: | write | Name: | wextract_cleanup0 |
Value: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\" | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus |
Operation: | write | Name: | setupapi.app.log |
Value: 4096 | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASMANCS |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2740) dxwsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dxwsetup_RASMANCS |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2740 | dxwsetup.exe | C:\Windows\system32\directx\websetup\SET9F13.tmp | — | |
MD5:— | SHA256:— | |||
2740 | dxwsetup.exe | C:\Windows\system32\directx\websetup\SET9F14.tmp | — | |
MD5:— | SHA256:— | |||
2740 | dxwsetup.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\dxupdate[1].cab | — | |
MD5:— | SHA256:— | |||
2740 | dxwsetup.exe | C:\Windows\msdownld.tmp\AS16D064.tmp\dxupdate.cab | — | |
MD5:— | SHA256:— | |||
2740 | dxwsetup.exe | C:\Windows\Logs\DirectX.log | text | |
MD5:2CE1A5D83B6F2BC98A63B0B65B92FEC6 | SHA256:DE8F5A3A07D7C2B0BCD21AA02FA7290C26ACE0D9850E44643ED10A594178C7AE | |||
2740 | dxwsetup.exe | C:\Windows\INF\setupapi.app.log | text | |
MD5:FCB2E400E1B660887F4A66FE2A33A8F3 | SHA256:93CFEB1A26738DF9B7F30C85F99546D603B986016F4FCDC551C4CD356AFD76D3 | |||
2740 | dxwsetup.exe | C:\Windows\system32\DirectX\WebSetup\filelist.dat | text | |
MD5:5B97E1CA76253156C8637EF81D9EF8B4 | SHA256:E8F5B059DB83BCF2D37FDC01423DDD49A0878F419842267D564BB5FD31D8F1BC | |||
3640 | 68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf | ini | |
MD5:AD8982EAA02C7AD4D7CDCBC248CAA941 | SHA256:D63C35E9B43EB0F28FFC28F61C9C9A306DA9C9DE3386770A7EB19FAA44DBFC00 | |||
3640 | 68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll | executable | |
MD5:984CAD22FA542A08C5D22941B888D8DC | SHA256:57BC22850BB8E0BCC511A9B54CD3DA18EEC61F3088940C07D63B9B74E7FE2308 | |||
3640 | 68cf6c08769adf549acf37145297cd1e1becbaf66ae8afef8b57c56c8bd8f129.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll | executable | |
MD5:A5412A144F63D639B47FCC1BA68CB029 | SHA256:8A011DA043A4B81E2B3D41A332E0FF23A65D546BD7636E8BC74885E8746927D6 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Apr2006_xact_x86.cab | unknown | compressed | 130 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Jun2006_xact_x86.cab | unknown | compressed | 131 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Feb2006_xact_x86.cab | unknown | compressed | 130 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Jun2007_xact_x86.cab | unknown | compressed | 150 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/dxupdate.cab | unknown | compressed | 94.8 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Apr2007_xact_x86.cab | unknown | compressed | 148 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Mar2008_xact_x86.cab | unknown | compressed | 92.5 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Nov2007_xact_x86.cab | unknown | compressed | 145 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Feb2007_xact_x86.cab | unknown | compressed | 145 Kb | whitelisted |
2740 | dxwsetup.exe | GET | 200 | 2.18.233.19:80 | http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Apr2006_xinput_x86.cab | unknown | compressed | 45.9 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2740 | dxwsetup.exe | 2.18.233.19:80 | download.microsoft.com | Akamai International B.V. | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
download.microsoft.com |
| whitelisted |
Process | Message |
---|---|
dxwsetup.exe | DLL_PROCESS_ATTACH |
dxwsetup.exe | DLL_PROCESS_ATTACH |
dxwsetup.exe | Invalid parameter passed to C runtime function.
|
dxwsetup.exe | Invalid parameter passed to C runtime function.
|
dxwsetup.exe | DLL_PROCESS_DETACH |
dxwsetup.exe | DLL_PROCESS_DETACH |
dxwsetup.exe | DLL_PROCESS_ATTACH |
dxwsetup.exe | DLL_PROCESS_ATTACH |