2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

Analysis

max time kernel
132s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03-08-2024 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMouse_Button_Control_V2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1192	Process not Found
1152	XMouseButtonControl.exe

Loads dropped DLL 9 IoCs

pid	Process
1976	XMouse_Button_Control_V2.20.5.exe
1976	XMouse_Button_Control_V2.20.5.exe
1976	XMouse_Button_Control_V2.20.5.exe
1976	XMouse_Button_Control_V2.20.5.exe
1976	XMouse_Button_Control_V2.20.5.exe
1976	XMouse_Button_Control_V2.20.5.exe
1976	XMouse_Button_Control_V2.20.5.exe
1152	XMouseButtonControl.exe
1152	XMouseButtonControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XMouseButtonControl = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe /notportable /delay"	XMouse_Button_Control_V2.20.5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\ChangeLog.txt	XMouse_Button_Control_V2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\X-Mouse Button Control User Guide.pdf	XMouse_Button_Control_V2.20.5.exe
File opened for modification	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\changelog.txt	XMouse_Button_Control_V2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe	XMouse_Button_Control_V2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe	XMouse_Button_Control_V2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll	XMouse_Button_Control_V2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll	XMouse_Button_Control_V2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\License.txt	XMouse_Button_Control_V2.20.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouse_Button_Control_V2.20.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000019444-133.dat	nsis_installer_1
behavioral1/files/0x0007000000019444-133.dat	nsis_installer_2

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop	XMouse_Button_Control_V2.20.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	XMouse_Button_Control_V2.20.5.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4478DEE1-51A0-11EF-9EEF-FA57F1690589} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000349e51d7d858451bb04faa4e7ac80903e7d7d452ca2e2145559b299276150878000000000e8000000002000020000000771ec84bdc9d8bad9a8d6eeb2f47bd71e9e6a2f8bad3c72b13194e30be1501d920000000a645868442d0f1022705c16786dc8c277235aafe7220afac0b7d680ed23139b740000000fafeea6c392705c8f94f1f92976a6e03a14d6fd2e129d3c48677141c4a88aa3f87bb41d5f0cc3bbbf9dd7e70605c0788f4be36ab0fb43fdfc1c103bd5e875599	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101af61aade5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000ecdd37e7262c73d200e796143a5e0560d5f985d43a778aabb9e1f824095fedde000000000e80000000020000200000009354ef4c27bd2254763f418bdd9bc491606d129083fa5c7e6c1d1f82b794609e90000000111ee11ec8b5575b40bda25f78d3dde830800c3d1624958c5fa9f85ca1c028245d6bd8f27ae3190f17bb9176642047b3857a499171ed7119a51063cfcc4bdd9ed0e9c26591d1759cb705ceb4d4f83753f4172e6d85081c9999f62aef9e4d4464ac7268315d8141be4a14413ab5b2ba41bd0882cfbd76636b2351888403ad8a24ef96cb36a0172452162354a6ce2283a6400000008d591ec43ac02bb580b31d471594c3f94ef84ad65be513f050daca2bb974b2f47ec647391ca1ff1b35ff265409c2e584b82349d376dbc61c69223e095038f4e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428855294"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /profile:\"%1\""	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp\ = "X-Mouse Button Control Language Pack"	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /install:\"%1\""	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\ = "open"	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\ = "X-Mouse Button Control Settings"	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs\ = "X-Mouse Button Control Application or Window Profile"	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\ = "open"	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\ = "X-Mouse Button Control Language Pack"	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\ = "open"	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\ = "X-Mouse Button Control Application or Window Profile"	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /import:\"%1\""	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouse_Button_Control_V2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp\ = "X-Mouse Button Control Settings"	XMouse_Button_Control_V2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell	XMouse_Button_Control_V2.20.5.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1352	iexplore.exe
1152	XMouseButtonControl.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1152	XMouseButtonControl.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1352	iexplore.exe
1352	iexplore.exe
1152	XMouseButtonControl.exe
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1152	XMouseButtonControl.exe
1152	XMouseButtonControl.exe
1152	XMouseButtonControl.exe
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1332	1352	iexplore.exe	32
PID 1352 wrote to memory of 1332	1352	iexplore.exe	32
PID 1352 wrote to memory of 1332	1352	iexplore.exe	32
PID 1352 wrote to memory of 1332	1352	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\XMouse_Button_Control_V2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouse_Button_Control_V2.20.5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
PID:1976

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1332

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

Filesize
364KB

MD5
80d5f32b3fc515402b9e1fe958dedf81

SHA1
a80ffd7907e0de2ee4e13c592b888fe00551b7e0

SHA256
0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

SHA512
1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

Download Submit
C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

Filesize
1.0MB

MD5
d62a4279ebba19c9bf0037d4f7cbf0bc

SHA1
5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

SHA256
c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

SHA512
6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

Filesize
959B

MD5
d5e98140c51869fc462c8975620faa78

SHA1
07e032e020b72c3f192f0628a2593a19a70f069e

SHA256
5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

SHA512
9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f81e9b586f3b77523d365ac1a7358d6e

SHA1
f2c7f02222acda71ce1a7a826432db508c6bba91

SHA256
86bfdf7229af6f06dc031b377a86efea57e8a83a1965dd3ccb9a4ff05eb7dcbe

SHA512
4b88ff339d485207f6732f64107afda017d6539c8b3047f12b57282b64ee4112a019fb993ebb0a0eb36e1a1a0be03bda2a8d02d69af04883f60b06c010aa919e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

Filesize
192B

MD5
b61e1aae263dcebfc5524169bfa34a75

SHA1
0abdce1bacc10b6c0ffbb188194012fda40fabc6

SHA256
dd19e5088918f284d825be1a11397978262821781cde638a977788c2740d6408

SHA512
65ca6296aae5a06accc8f2d958aa6f6bbf09de373eb81df52b63f58b05c8e12bc35947441666067f97b2c9662ef8fc15b9e6290797a53acb34a0f2f5bf463b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc532e32db07ff5991493e89ff2f5de3

SHA1
7111a71b1892cabd2cc211a77a7a5b7d7f9f5796

SHA256
62b081f71d2a804ce110dbeea9f945ae3c2a262ebf78d5d3a75d3a2873863a54

SHA512
e5f52f6bc8db9a5814d18ccc98553bee46a7543c23c55e8e67e7f2123c4eccb4124fb83c90e04574e71085ad657bad47778161ed419e96fdc1fe015fcecfa6e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
427d08f477e307fa6d786b3abc504d60

SHA1
f11cf2fb3ad5b27c688707b29457957cc4e8ceab

SHA256
ae8882cc2a811f0d1c68c8c4bbee0f25aa8fc08b658d2b8496e95ad91cbd8830

SHA512
077723516c67721d83c453a1339e79135886214074d39c5d2c373bce7e2bda6119de95b4305eacb9c476f1703e34f7713ee626ec5dc91a5bf619302300832a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ff5859737d29f2775d4578a86876b79

SHA1
f966c2ab1ad873a1dafca1af66adbfc78bccbd9e

SHA256
bce5b035d6d6b86cdc6ceee4a2e1224bc571e267667c590986b07a06081ad962

SHA512
8e3b47fe4ce82a76b1cbdd7ec48288f109b862424aa3fa2c6c76bc022702ef06a6753399326aad6de0fa2a92f5acfc96d91180ccc5988095c48f8967ca7efd64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d2917c85fa575aa098279bf83c1d711

SHA1
c60a5de39efad6aad77ed7206b040b5275779ad3

SHA256
87b4240f4fd7e91edd18ac21a005897ec50b2c77fdee158c6b620354e125ccda

SHA512
aabceab6cef61a94d32e5d715cee989e6f57da7027f219c99bc1927736d09ddd50a13e9679250e90841ba1b776fb58db4fed0811de1dea95f8cfccedeaad06f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6778b3b710d145493bda5d28691cb596

SHA1
448f02471f193f5ef64eccbf91b1f7d20b806f04

SHA256
8fa4e44d5e760ec2725c03295beae11c6679ef77d355d26c916c6b2bcf1348a2

SHA512
c75785583884d31f630f01d4a2d723df6735b0bd77246ad96577a6950e967ec1b43aec2375ea4375bc2e3f17fc110743d73aa15b204c552757853af820b6ba56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db3558e9d9094d7e749a3fba42dc0c2e

SHA1
a8fe4db3f72a76f8631e9b65830817cef81c3f68

SHA256
43f7ee64b4ffc33ca9803733a8abd1af0ac03e9221a5a969ee3fe69b7395498e

SHA512
84108956622c8a74481c28937056df1ee11a477c2c782d910e58e85d2572a6aef79a51d2f2fcc1829640504ac64e64cd633f5193ce451431aa9b7ab28a6c7d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c7cd233b5ce9264f843b69c616fd437

SHA1
4735cc10c61761628fd0d6894628fffbf8c4667a

SHA256
9ef15687104a60c16d83be97af60ab16a092b02b59f392e8319bbd34ef6ad89d

SHA512
ed3855940b72cc3f85d37c8bf1d225383e001137f0e000af7173eb7692c63d378ab737f0a8712abb35e2c1d0170b04a5a28afe9cfb7e44971ef8c825dc646808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fce9b4438bb429f14b8e1761667d6e8

SHA1
dd1691235bdd9ee39ef4357c517b8543fb0a62f6

SHA256
3fb999b1e8df57320498d616e409f5da5e7f4f69f37d540ba50843eae650fb6d

SHA512
baae4801de4dc4dd6b00c4c738fc134ed7b710d238c6b40ee2354b7023fccce73904cf5121f6c33ec07d98996a88d45c2e6eeb6c4c16daab3157b2076c85adbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d75194c79b446ab8876410968e22c4

SHA1
7e18a97e1669bce06486b99213e6cb2aa09b0576

SHA256
dd9811282eb19ab3576246e072278510cc389ea71a5c159765f9c5d2f7ee9228

SHA512
9355349d899351bc7102d952c8292a9afe6426cf486395f90e49f00a665e05508d0941d264c5e7859fae2af716c80f1839160fe304498c6309d6c21040b3318e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40154af93abdb4f8c6f7efa2a837fc7d

SHA1
979047e9e2a1e4c1df4f7bff9d2fa0ccdbc976bc

SHA256
6abc36aba1cfdfe8cb8a03d4593ca0d3c3b23da6b167d3321cb1f6bd789137ae

SHA512
afce6a391da70bf37dd151c81a9f50ad199eb71608f542fb7573f5119e7d9f102bf8869c02e599baf0785f6598d613b4d1f4a0ccbe0438ea0e9c622da2a21b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3664ff5e914885b3ce6ed23a3e04f2e

SHA1
37d373d4ee6a5b5aade5de81e89484269cf8c73a

SHA256
0606a4cb49b9b77787711aa78f0d6e1a0c55246f13cb622683ec8c346f50c569

SHA512
393f0ad8deef995173394fdf85bb738f202877cdcf70f973cbd3451c0c719d66b3b3155b26bc2ffff9018a2c1d06e0bebcf3d5282676cab9fac98fe4a823cc49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
845f906d886df38921ed52e8a7acb9f9

SHA1
ba2c08eb7a15fdc494f3cb2022134cb4fcca95b0

SHA256
9ee9b84b919e21120a0e1ceff700143157f21ae8554f983ca3f734778cac518d

SHA512
cf56a9470789abb1c5e500ee570431b36235ea435d8fd2a6ffb526e3b80902206af77e668f59a887b68247d20f6c5e3abf1496a8e899d9a23779dc36857e3b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
316f156a1b5fe7f0feb801e0be2e2cb5

SHA1
b6bd61ab199ebb04d4f82b61c171370b333e75a1

SHA256
38c4d5d80c14af2fd403981f5a8f3e16ced2c0be5eba687d616c203816b07b51

SHA512
0fd8f1b8fe1b6613923a2f6c1113407a4dc4b948119c89342678252b63a4f892bfb56f7d7b90ff6e2bb0d8ae2278339a2c90ead907d2f2764b4db8f3ce93442c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb48cdb008561d8aeae71b60ca44010

SHA1
13e7100cffd90cd56efdd90332d0fd03bbaa9af2

SHA256
76dc02411da1c5731b055e8383fd86f80438ffc179dedf93b04cd9b6721b6c8c

SHA512
ee0014a5ea19083b494aaf7a37b8ddc2b01f337b493ffc71a9c04e9e4d8f89a6f492bbc605f9b5c8b1d3f3f08ccf537a209574f23ed2f8d131ae4c574de863eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
382d5b8cc387f4171d67db9ef3009da4

SHA1
86268c1a25f45cc4179dc1beb64df0d29a7ef58c

SHA256
338a0285d3685950635c9ae6a1a9fff591de2b91b82b0d287e30b8b12537f8f0

SHA512
c5698f856496dd30b660493d84b45baff41e0d1e29f9a9bb6c0576144c608e830a7eed8a42e07d84ef431b5d8229dfeedd960a50d10df9678bb6865f600d6200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5f19360d70a63c269221d3714cd4a99

SHA1
c39035b436ab18ab60353d4d167c81c3c710a9ba

SHA256
d9d1a3de449c2621cc70d805a45d5ad132fe1e099d680cdf82309402ece38888

SHA512
4159a1d2ef4531cf0ad8b12c937b9576ed08635241a44c9ce28d2add92516d79a469f4abc619aa42012d3669ee837feecac0a6b02f8468696e99157c55ce451a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c301f9e36a014ed28ede3104a1e7028

SHA1
407621311b2e5505b7e29fb8af1848f46c99545d

SHA256
cda9f98e6186bd77ddcdeb0983935820f48f8dd9698032378a2215c5fd175e6d

SHA512
facd909b0b4dd6fdde1adde0a4bc4728ba448952ab32f8c1eca633eff683aa326d28fb90b95bb2fbfe43e2ce75d0d0b0d4cd0747f0091deb562331e7b6d286a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
552d50769f9ddd5f406bc28928260a4f

SHA1
3f5b5084613d262d09889d65bb110489b2374701

SHA256
60ea6d10ec83bd94eafe082ea9232f34ab43d62445849bc9ac74187d568e99fa

SHA512
4afcfb35cef699ec75c71e453e2a78cd4fc7369cec1eefc7fc4398e5882f1ae720fe6188a2968323d41757b34f8da2475cce8fcf4884b20849b19c1e6c57e33e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a84a9f6f77e7bce91b6f2cb4508a4e2

SHA1
0d0892f9a5c8488958998665c77d28f0069e7af7

SHA256
188ece9c09efb947f29c0fbb302bbe640a6a0042e1c642e34a15d3dc4993aa48

SHA512
aaf77aa9c18c5cfa5e65aa77996b67240a7b57a97130d94a7b881add8a3a5ee753652e6b3e44ea8a0bca38414c6b8f4e89f9ff540c3ce68884fda5e1831bbcda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd21ae9bb60ad6e402428cecf99d5558

SHA1
aa150b6f942337194b1d396627ba6ad7147a651b

SHA256
551baca110d6570f2e85558e7c3ff3f5a1757177ddbaccfed1d0623b4e5dc617

SHA512
880a5e0077205eccedc3f5054eff56c0c0119fbf7df608f0ad999421c14f1bd8e4e8031c77a061e2f667e4da9addbcbec74e612a1ca037839ca3010a1e0f9d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6b115efd8e8502be1f09c45bb9d45ab

SHA1
b8fe567bcded05154a8a465f58c16f1ec221e281

SHA256
b8f8874e8d6b67b6c8c31b20740c5f9f5b621b87012c96fd19decb005c843ba2

SHA512
deb6bf27a0d943ac31691f38f3ffb8a1a8dd5d12585ed4618e6d69cadc92ae13cfef5d18fdbdb0f542ce6ec647da605d876c92d045db32aafc316108df84c4ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eec571b050a445f9dbc661d519644e4d

SHA1
9182f751ad74544fa13860aa5ce41e3aab3d612f

SHA256
4f49f77c0b5aa8d5cf3e7933c93839aa07c0ff8bc03f802d526ecee013988585

SHA512
3453533467670084807f750381a6a03b492681ef2a2f12ef58e65718a3dce174e27773fb478d23885a17c6788642f21465a9039d6a799f012d143ed3d4331b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0453d75c39a8ab0f77ded9efb8abd5e

SHA1
34d978248bd78f3aba987c323ab08feb67d3a404

SHA256
f3d963ccd7f24107f8871984c0d7bd5857b4afcf44cf7c833d907cfb1c3f88f9

SHA512
ec141dff20403a6a35811c151dd33459b780058a37f9a432ea63cd64c4af2958741435f1686a47e6f6329124c79b7d31eccaf4e97138a3339c4cc1c3679ceb30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b4fdc1b234c976873a310605a39f720

SHA1
f6cd68f55397ceddcf24f7097f62fd71d932ad20

SHA256
9acc8af5404df70e2536624683245aefafee7cf8accc0806e2838b82df783fd1

SHA512
1b498910b89cc2f68bb409ebac95cb72db3b8c247866259630b94b79d1ad4532f6eb7d4bd374c9487f3547f5e93309f8562d3aec2c81082fe4aafa2b676b81c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55d869de963d7637b18e3b1a32f2f3d4

SHA1
df566f19dda0e9f636288d91dcc33b3147aaecfd

SHA256
d9fb643d32793dddfddd3944b782322f9364e832c11e7d4c9e6c5a4feab33fca

SHA512
c2b08e279de928b1946de7c6cf6047d0388bffd73f45db42495aa8e9faa2e74088a1a399abc1104fc60cb9fb50c097774332511bf34374c4746a80fd973a4936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
893b273bac4d3dbe5a8b8c09fb540515

SHA1
a47728a52fc9389b6b4ef790c8b5807f70022c74

SHA256
a82cffb023e2e0c70fbe15751180861a9598a4e9371f053bf902ec7280347dfb

SHA512
19a8353cdd57028a8634fac6d4ac3f5b52c8f28ab919eac4db31998d6f95551dc4edf864b1a91904217e7952ce42e4d674172b4242d701befa6f14e5c058fb0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt\imagestore.dat

Filesize
3KB

MD5
461a8ce981a6b2dcc049efc63f4a36fc

SHA1
58fe3de998c0e20a3a3ddea35c859df1538b2774

SHA256
ea6a50ff8d4ac474250d1e110cc16e355c4fb03c94c599e57dc712f4b0130eea

SHA512
1f1369c362551f902351f41b3e646026610c2d37901a32ee05d7b16684787ec67df24574ed2d1b564ea3200b780b519fc9dae1e063528a6249ce901c5c3216a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\f[1].txt

Filesize
186KB

MD5
f4bcc168e40c5a518fbc6c2a566c26c5

SHA1
e3ae470b69804fd20830630e01b6e4c7bb39fbea

SHA256
2a8cb44022f31f61803f38df520e0e4c72935cdc22ef30069a584217ee8849eb

SHA512
eff8c82c8f41c355f4297873e13cdd8243e36e7617fc07ecc1e47356ff02b3242ce4e541406dc3edfe45e74644d4af187181d50cc671623641baab9d2fbb9412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\xmbc[1].ico

Filesize
3KB

MD5
1279bf31d9659ad2017369ec1b90473c

SHA1
0f21c5a8266c36af7909118899e1fa07590f2df8

SHA256
74e3162830413f502277c221381f07b34d77a155f5cbeca379e1a4ffc29af116

SHA512
18ab594628c7873c56a85cc748585a3422f06d3f3ad70e5d33e86bed8bb9595d43513960731db89820d89b2ed950b48d6b891dbda768164f968ab06f5a86c277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ED0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EE2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst87B.tmp\ioSpecial.ini

Filesize
708B

MD5
a391f8968d1d6176e599edb955ef0e0a

SHA1
5da15d35eac02486c0dc9332a77ba2791e4d3370

SHA256
d7fc812234bb6bf1bc89cc8d1424ba75981bd306c5c10978614afc63a3baa4b1

SHA512
246b07060840d7a919a407c3cdfa74f0764e7be4db31c4a3d40e9014cf450f5bad2d1521e8a82e242c4f8d5d225dc3660d83e4feb9f5c41b32018cac28cc25db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst87B.tmp\ioSpecial.ini

Filesize
725B

MD5
fc4fde6491c4df4c20884185a1f2e5b1

SHA1
27b4a24aa18aa0c2f1928c49b1ca7c32b5652a8d

SHA256
64c745074eaf113da5831ed1789c609d9044090e0e8cd3a7518ebca3d59c802e

SHA512
1b34d149f4f5854086dd70025219f08b046645796f93c2cea2dc433ed1f7dd2322955658de52a6efdffd623e325f1f8693e3a3dfd72926f6d18a95c817695cf7

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

Filesize
1.7MB

MD5
bb632bc4c4414303c783a0153f6609f7

SHA1
eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

SHA256
7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

SHA512
15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe

Filesize
74KB

MD5
bfffc38fff05079b15a5317e279dc7a9

SHA1
0c18db954f11646d65d0300e58fefcd9ff7634de

SHA256
c4e59737ffd988ef4bc7a62e3316a470b1b09a9889f65908110fba3d7b1c6500

SHA512
d30220e024ac242285ea757006e7da3874e5f889951de226d48c372a6a8701b76d4a917134ecc1e72c6c3a8d43444762288e7134a25d837e9f43d972675c81d6

Download Submit
\Users\Admin\AppData\Local\Temp\nst87B.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nst87B.tmp\ShellExecAsUser.dll

Filesize
7KB

MD5
86a81b9ab7de83aa01024593a03d1872

SHA1
8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

SHA256
27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

SHA512
cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

Download Submit
\Users\Admin\AppData\Local\Temp\nst87B.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nst87B.tmp\nsDialogs.dll

Filesize
9KB

MD5
f832e4279c8ff9029b94027803e10e1b

SHA1
134ff09f9c70999da35e73f57b70522dc817e681

SHA256
4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

SHA512
bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

Download Submit
memory/1976-232-0x0000000002A00000-0x0000000002A02000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads