bc99080acc10eeb1c8379719c86c652221f3f6d1bff104a2ca32d6326154c636

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/09/2022, 13:21

Target

XMouseButtonControlSetup.2.19.2.exe
Size

2.6MB
MD5

1303890f3577db2f931323d10aad43d0
SHA1

782cd048deaad6b13da71fd2f4e3596e145bb188
SHA256

bc99080acc10eeb1c8379719c86c652221f3f6d1bff104a2ca32d6326154c636
SHA512

92db9b2d83c02337ff793c2ae2258bbd7c7a8c34e0f7149fd13c48310ac1637ffbe01dfc0d3b26c8b04877456bd6b168af94d4dbe5161dcc61e2a5580b559157
SSDEEP

49152:8W14xRLQGdJFJlAJLHo1Ztg0QRqUUyZOPb4R1onpLC70jQnh8zpZMzIJ/nJ1NM:8WsdJPlAdH8ZOsUUXT4oRh8hUpkIJ/n+

Score

7^/10

Loads dropped DLL 3 IoCs

pid	Process
1680	XMouseButtonControlSetup.2.19.2.exe
1680	XMouseButtonControlSetup.2.19.2.exe
1680	XMouseButtonControlSetup.2.19.2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.19.2.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.19.2.exe"
1⤵
- Loads dropped DLL
PID:1680

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nstDC2F.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nstDC2F.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nstDC2F.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
memory/1680-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download