Overview

overview

7

Static

static

3

XMouse_But....5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    28s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2024 20:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XMouse_Button_Control_V2.20.5.exe

  • Size

    2.9MB

  • MD5

    2e9725bc1d71ad1b8006dfc5a2510f88

  • SHA1

    6e1f7d12881696944bf5e030a7d131b969de0c6c

  • SHA256

    2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

  • SHA512

    62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39

  • SSDEEP

    49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 33 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XMouse_Button_Control_V2.20.5.exe
    "C:\Users\Admin\AppData\Local\Temp\XMouse_Button_Control_V2.20.5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    PID:4888
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff90e6646f8,0x7ff90e664708,0x7ff90e664718
      2⤵
        PID:3216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11318675828251278874,13822375527632050839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        2⤵
          PID:3508
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11318675828251278874,13822375527632050839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
            PID:4916
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11318675828251278874,13822375527632050839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
            2⤵
              PID:3084
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11318675828251278874,13822375527632050839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:4360
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11318675828251278874,13822375527632050839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                2⤵
                  PID:464
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11318675828251278874,13822375527632050839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                  2⤵
                    PID:3892
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11318675828251278874,13822375527632050839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
                    2⤵
                      PID:1724
                  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
                    "C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:4680
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:4800
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:2236

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll
                        Filesize

                        364KB

                        MD5

                        80d5f32b3fc515402b9e1fe958dedf81

                        SHA1

                        a80ffd7907e0de2ee4e13c592b888fe00551b7e0

                        SHA256

                        0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

                        SHA512

                        1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

                        Download Submit

                      • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
                        Filesize

                        1.7MB

                        MD5

                        bb632bc4c4414303c783a0153f6609f7

                        SHA1

                        eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

                        SHA256

                        7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

                        SHA512

                        15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

                        Download Submit

                      • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll
                        Filesize

                        1.0MB

                        MD5

                        d62a4279ebba19c9bf0037d4f7cbf0bc

                        SHA1

                        5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

                        SHA256

                        c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

                        SHA512

                        6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                        Filesize

                        152B

                        MD5

                        a499254d6b5d91f97eb7a86e5f8ca573

                        SHA1

                        03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

                        SHA256

                        fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

                        SHA512

                        d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                        Filesize

                        152B

                        MD5

                        bafce9e4c53a0cb85310891b6b21791b

                        SHA1

                        5d70027cc137a7cbb38f5801b15fd97b05e89ee2

                        SHA256

                        71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

                        SHA512

                        c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                        Filesize

                        5KB

                        MD5

                        914385137de20b82240e9cd02a9aa195

                        SHA1

                        3bebe680297693d012061687b096ed6acfeec970

                        SHA256

                        5b52dd36e93eead9727818585117e223017758baceaa6d0aa74583db94ab898b

                        SHA512

                        86425d814575d7882fc769b3bf2b2dd144748fc5aad0be59e359f64d05565e874bdaf5e5e18a3484960da9c6ffea552ffbd62e2d25257f4a150b943ea326b3da

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                        Filesize

                        6KB

                        MD5

                        c0e37f67622dc9f2caa039566ed3e6c6

                        SHA1

                        784121c189d095cb608326b976d395e24c6051df

                        SHA256

                        75f92e8fe89fc53bf23dfe3954ca2a199476bd4abe82b218d0b0e590733eead0

                        SHA512

                        e271c1edc853890777a43f9e0f11cb3d8372a5ae752a2a635459fc6a5618e2b904746c5eede442429e789cebd39904003a946e856875a1c8eb3c1420cdf94009

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                        Filesize

                        16B

                        MD5

                        6752a1d65b201c13b62ea44016eb221f

                        SHA1

                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                        SHA256

                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                        SHA512

                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                        Filesize

                        10KB

                        MD5

                        6fe1f38a20d80b00af0bdf0655d7c371

                        SHA1

                        332d043e94e8b7138d0f9a84aa0eccbdc98b8eb9

                        SHA256

                        45588e4ad51ac3af5773a6ab26a1cb1b8018b5316556a84269516bff56a92d68

                        SHA512

                        86bee1d936bd6a15ffd9f3fcc41d9d2ebcf96d57a4af633e372593101f4498acfeda1a519eb7817d0dd4d5ac8e283eb86e46027fa78962ca0faba870239af43f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\nsnBF99.tmp\InstallOptions.dll
                        Filesize

                        14KB

                        MD5

                        d753362649aecd60ff434adf171a4e7f

                        SHA1

                        3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                        SHA256

                        8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                        SHA512

                        41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\nsnBF99.tmp\ShellExecAsUser.dll
                        Filesize

                        7KB

                        MD5

                        86a81b9ab7de83aa01024593a03d1872

                        SHA1

                        8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

                        SHA256

                        27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

                        SHA512

                        cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\nsnBF99.tmp\System.dll
                        Filesize

                        10KB

                        MD5

                        56a321bd011112ec5d8a32b2f6fd3231

                        SHA1

                        df20e3a35a1636de64df5290ae5e4e7572447f78

                        SHA256

                        bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                        SHA512

                        5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\nsnBF99.tmp\ioSpecial.ini
                        Filesize

                        710B

                        MD5

                        4c299a7d1acd8487a3de3f8f174d113c

                        SHA1

                        a597ba1efc371d896b02dfeb831ff53d29b7d2ff

                        SHA256

                        ce11c20e314a24212650d9a5e91f9b43b78a42eb18de1c3a2281d91f88b8e266

                        SHA512

                        7a998ee5dd0697c6a91c84c0904475277f4aebb02630e16ec3df8afe06660965ca6d7c5930526449b7461a7cf449c452bbf5b81818f3cb32b3ea31ad68587e9f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\nsnBF99.tmp\ioSpecial.ini
                        Filesize

                        739B

                        MD5

                        31ff6abed80ba53b5cdbe0f994ec5f2c

                        SHA1

                        1cda7c79806cfcb7d0de13926e27ee41688aa664

                        SHA256

                        ca7177d3281837c6e91ca6150849ac353a500d6a2fa305e797cc8368a4ab96ce

                        SHA512

                        18c72779b6b71fa91d0e035a1fc4ebf8aea90d76d385fff4f9f0100697f6c45daaf97beb81ef2adeec2801e0348710829b8c35f0dd468bfe98fdc7f399473c41

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\nsnBF99.tmp\nsDialogs.dll
                        Filesize

                        9KB

                        MD5

                        f832e4279c8ff9029b94027803e10e1b

                        SHA1

                        134ff09f9c70999da35e73f57b70522dc817e681

                        SHA256

                        4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

                        SHA512

                        bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

                        Download Submit