File name:

Instalador DXSafe Middleware - 1.0.21.exe

Full analysis: https://app.any.run/tasks/a74ff03a-e709-40ce-898f-7983eb8d460d
Verdict: Malicious activity
Analysis date: July 03, 2024, 15:50:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C84FC553BA019DFF614D55232F7EBA65

SHA1:

90FC0263F940FBFFC585FAE59FBD1AEF4F4153FA

SHA256:

8A616E00F62D08D1AF1597512756BA965780D1D1700D65064CFA37F5AD9C1340

SSDEEP:

196608:AshQljJk7lVBCTsJxNDK0C2Y+lyhFcMw2Ol7N2:Ashk9k5HCoJx5K0LDOFcv2OlZ2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3200)
      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3164)
      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)

    • Creates a writable file in the system directory

      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3200)
      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3164)
      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)

    • Reads the Internet Settings

      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)

    • Reads the Windows owner or organization settings

      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)

  • INFO

    • Checks supported languages

      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3200)
      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)
      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3164)
      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 3208)
      • DXSafeAdmin.exe (PID: 3156)
      • DXSafeAdmin.exe (PID: 2488)

    • Reads the computer name

      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 3208)
      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)
      • DXSafeAdmin.exe (PID: 3156)
      • DXSafeAdmin.exe (PID: 2488)

    • Create files in a temporary directory

      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3200)
      • Instalador DXSafe Middleware - 1.0.21.exe (PID: 3164)

    • Reads CPU info

      • DXSafeAdmin.exe (PID: 2488)
      • DXSafeAdmin.exe (PID: 3156)

    • Reads Environment values

      • DXSafeAdmin.exe (PID: 2488)
      • DXSafeAdmin.exe (PID: 3156)

    • Reads product name

      • DXSafeAdmin.exe (PID: 3156)
      • DXSafeAdmin.exe (PID: 2488)

    • Creates files in the program directory

      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)

    • Creates a software uninstall entry

      • Instalador DXSafe Middleware - 1.0.21.tmp (PID: 980)

    • Manual execution by a user

      • DXSafeAdmin.exe (PID: 2488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 156672
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.21.0
ProductVersionNumber: 1.0.21.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Dexon Tecnologias Digitais LTDA
FileDescription: DXSafe Middleware Setup
FileVersion: 1.0.21.0
LegalCopyright: Dexon Tecnologias Digitais LTDA
OriginalFileName:
ProductName: DXSafe Middleware
ProductVersion: 1.0.21
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start instalador dxsafe middleware - 1.0.21.exe instalador dxsafe middleware - 1.0.21.tmp no specs instalador dxsafe middleware - 1.0.21.exe instalador dxsafe middleware - 1.0.21.tmp dxsafeadmin.exe dxsafeadmin.exe

Process information

PID
CMD
Path
Indicators
Parent process
980"C:\Users\admin\AppData\Local\Temp\is-V2BUM.tmp\Instalador DXSafe Middleware - 1.0.21.tmp" /SL5="$5010A,15348303,899072,C:\Users\admin\AppData\Local\Temp\Instalador DXSafe Middleware - 1.0.21.exe" /SPAWNWND=$F0168 /NOTIFYWND=$6015A C:\Users\admin\AppData\Local\Temp\is-V2BUM.tmp\Instalador DXSafe Middleware - 1.0.21.tmp
Instalador DXSafe Middleware - 1.0.21.exe
User:
admin
Company:
Dexon Tecnologias Digitais LTDA
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-v2bum.tmp\instalador dxsafe middleware - 1.0.21.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2488"C:\Program Files\DXSafe Middleware\DXSafeAdmin.exe" C:\Program Files\DXSafe Middleware\DXSafeAdmin.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\dxsafe middleware\dxsafeadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\winspool.drv
3156"C:\Program Files\DXSafe Middleware\DXSafeAdmin.exe" INSTALL_PROVIDERC:\Program Files\DXSafe Middleware\DXSafeAdmin.exe
Instalador DXSafe Middleware - 1.0.21.tmp
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\program files\dxsafe middleware\dxsafeadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\winspool.drv
3164"C:\Users\admin\AppData\Local\Temp\Instalador DXSafe Middleware - 1.0.21.exe" /SPAWNWND=$F0168 /NOTIFYWND=$6015A C:\Users\admin\AppData\Local\Temp\Instalador DXSafe Middleware - 1.0.21.exe
Instalador DXSafe Middleware - 1.0.21.tmp
User:
admin
Company:
Dexon Tecnologias Digitais LTDA
Integrity Level:
HIGH
Description:
DXSafe Middleware Setup
Version:
1.0.21.0
Modules
Images
c:\users\admin\appdata\local\temp\instalador dxsafe middleware - 1.0.21.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3200"C:\Users\admin\AppData\Local\Temp\Instalador DXSafe Middleware - 1.0.21.exe" C:\Users\admin\AppData\Local\Temp\Instalador DXSafe Middleware - 1.0.21.exe
explorer.exe
User:
admin
Company:
Dexon Tecnologias Digitais LTDA
Integrity Level:
MEDIUM
Description:
DXSafe Middleware Setup
Version:
1.0.21.0
Modules
Images
c:\users\admin\appdata\local\temp\instalador dxsafe middleware - 1.0.21.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3208"C:\Users\admin\AppData\Local\Temp\is-DVSI0.tmp\Instalador DXSafe Middleware - 1.0.21.tmp" /SL5="$6015A,15348303,899072,C:\Users\admin\AppData\Local\Temp\Instalador DXSafe Middleware - 1.0.21.exe" C:\Users\admin\AppData\Local\Temp\is-DVSI0.tmp\Instalador DXSafe Middleware - 1.0.21.tmp—Instalador DXSafe Middleware - 1.0.21.exe
User:
admin
Company:
Dexon Tecnologias Digitais LTDA
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dvsi0.tmp\instalador dxsafe middleware - 1.0.21.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
5 165
Read events
5 110
Write events
55
Delete events
0

Modification events

(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
D40300003EFEAEB960CDDA01
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
E75CD12051CB63C03D22872FFBF26B8241D5DA7F42710CD83F6CD57922559747
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\DXSafe Middleware\DXSafeAdmin.exe
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
553EB1CB3303CA2CE4ECA136E8AA83B4D2D54CB80E4ADF54ECF477EEF9DD3D46
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Dexon\DXSafe
Operation:writeName:AppPath
Value:
C:\Program Files\DXSafe Middleware
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Dexon\DXSafe
Operation:writeName:VersionInstall
Value:
1.0.21
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Dexon\DXSafe
Operation:writeName:SYS_ShowMenuAux
Value:
0
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8135958A-27DD-4BBA-9637-DCFC7EEF5FF0}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.1.2
(PID) Process:(980) Instalador DXSafe Middleware - 1.0.21.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8135958A-27DD-4BBA-9637-DCFC7EEF5FF0}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\DXSafe Middleware
Executable files
20
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Program Files\DXSafe Middleware\is-AVUMU.tmpimage
MD5:0F974778C38EBEFA382981CD42E45E27
SHA256:F6DE8CD8882E31CA68304629922C6D574DEC5D3AF15E1C758ED31E895C994EFE
3164Instalador DXSafe Middleware - 1.0.21.exeC:\Users\admin\AppData\Local\Temp\is-V2BUM.tmp\Instalador DXSafe Middleware - 1.0.21.tmpexecutable
MD5:3F7CF730E1604D1465A3366FBCEE3B18
SHA256:A903DBBBEC5CA0CAC3BD5FD6DD71F23A6554DE8070351571198685E36B281391
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Program Files\DXSafe Middleware\Icone_Atalho_DXSafe.icoimage
MD5:0F974778C38EBEFA382981CD42E45E27
SHA256:F6DE8CD8882E31CA68304629922C6D574DEC5D3AF15E1C758ED31E895C994EFE
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Program Files\DXSafe Middleware\unins000.exeexecutable
MD5:E051E9BAD416D8F01511D3DEF29D99E4
SHA256:209D80F6FB25D027B0CDB867D697EC932E99F394CC8ADFED15E293B13DD960A3
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Windows\System32\DXSafeKSP.dllexecutable
MD5:B24731D364C7D767A76615DDB0140AA2
SHA256:77986DD9E9E3E9A988A04797BD406446A3E4B87C7F73DA590FCAAFFDB9F011DE
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Windows\system32\is-NOR99.tmpexecutable
MD5:B24731D364C7D767A76615DDB0140AA2
SHA256:77986DD9E9E3E9A988A04797BD406446A3E4B87C7F73DA590FCAAFFDB9F011DE
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Program Files\DXSafe Middleware\is-BA2UJ.tmpexecutable
MD5:115D196F7B547FAFB6A671F0692A19E0
SHA256:322F9B2E19FDC6411515C11FFB02BA1DC280E284A37694A2F58D93B27BC13E60
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Windows\system32\is-F4LFH.tmpexecutable
MD5:E2853BD08A1A4FA742B6974D05FB5FF1
SHA256:B0AFB0574A53D5145EF9070CF19E547199CC9E504263A9E04A7D7E5BD6AFF28E
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Windows\system32\is-II2DV.tmpexecutable
MD5:5CB3E92323B58946BE82C622207650E2
SHA256:1B0151513C18708AA082043B1A14487605BE4A4443FBD42A4E97AE0DC2DDE108
980Instalador DXSafe Middleware - 1.0.21.tmpC:\Windows\System32\DexonCrypto32.dllexecutable
MD5:80AE4DDF43F776CA1CFBA6DD4234860B
SHA256:89924220CC816FD33F4B9674DA800DA5083FF2A3811495D39EF81BE6A9AD86BA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
12
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
217.20.57.21:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.211.9.92:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
2488
DXSafeAdmin.exe
POST
200
201.20.154.205:80
http://service-webinfo.dexon.ind.br/request.php
unknown
—
—
unknown
3156
DXSafeAdmin.exe
POST
—
201.20.154.205:80
http://service-webinfo.dexon.ind.br/request.php
unknown
—
—
unknown
1060
svchost.exe
GET
304
217.20.57.39:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f69642324cc87bd
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
217.20.57.21:80
ctldl.windowsupdate.com
—
US
unknown
1372
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.211.9.92:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3156
DXSafeAdmin.exe
201.20.154.205:80
service-webinfo.dexon.ind.br
Defferrari Informatica Ltda.
BR
unknown
1060
svchost.exe
217.20.57.39:80
ctldl.windowsupdate.com
—
US
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ctldl.windowsupdate.com
  • 217.20.57.21
  • 217.20.57.37
  • 217.20.57.19
  • 217.20.57.27
  • 217.20.57.24
  • 217.20.57.36
  • 217.20.57.40
  • 217.20.57.39
  • 217.20.57.35
  • 217.20.57.25
  • 217.20.57.22
  • 217.20.57.43
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 23.211.9.92
whitelisted
service-webinfo.dexon.ind.br
  • 201.20.154.205
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Instalador DXSafe Middleware - 1.0.21.exe