Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    73s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/08/2024, 02:08

General

  • Target

    XMouseButtonControlSetup.2.20.5.exe

  • Size

    2.9MB

  • MD5

    2e9725bc1d71ad1b8006dfc5a2510f88

  • SHA1

    6e1f7d12881696944bf5e030a7d131b969de0c6c

  • SHA256

    2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

  • SHA512

    62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39

  • SSDEEP

    49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Malware Config

Signatures

  • Detected pubg phishing page
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
    "C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    PID:5076
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:64
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:4036
  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
    "C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1032
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4544
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2780
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:2992
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5008
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4932
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1392
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:1792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

    Filesize

    364KB

    MD5

    80d5f32b3fc515402b9e1fe958dedf81

    SHA1

    a80ffd7907e0de2ee4e13c592b888fe00551b7e0

    SHA256

    0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

    SHA512

    1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

    Filesize

    1.7MB

    MD5

    bb632bc4c4414303c783a0153f6609f7

    SHA1

    eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

    SHA256

    7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

    SHA512

    15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

    Filesize

    1.0MB

    MD5

    d62a4279ebba19c9bf0037d4f7cbf0bc

    SHA1

    5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

    SHA256

    c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

    SHA512

    6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml

    Filesize

    74KB

    MD5

    d4fc49dc14f63895d997fa4940f24378

    SHA1

    3efb1437a7c5e46034147cbbc8db017c69d02c31

    SHA256

    853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

    SHA512

    cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AHDF3J57\f[1].txt

    Filesize

    186KB

    MD5

    e883cf491746456007b530e56199b523

    SHA1

    ddbff65c34ee27f1095bad5392cb9345b1d3f9de

    SHA256

    c1edf8e3907c777d8199c5b0c65d753d5c5bfdf954a7745836395f215453415e

    SHA512

    51e9317ea0e602fefb92940c539149d945d96075dbcca246de0f9b728e6ea5aaaffdcfbf6eb3922d940c2e7b445802a4a2dc96f6f8a2e654c882f4646b16d91a

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ITC6F7XX\yfHRfIYbZCll3drT8gfkqU4JLjCcK3Jw7L6xolIZ-qI[1].js

    Filesize

    53KB

    MD5

    6d1985137fba5d27e62a922e8c5a46b2

    SHA1

    4e9da3d2a6ea50774bca525e810492316a079424

    SHA256

    c9f1d17c861b642965dddad3f207e4a94e092e309c2b7270ecbeb1a25219faa2

    SHA512

    c2c3fe1b18d51aa1df564328cb1fa8cb70625a8eaae467617a58e6dc13fee602851c3d2b24e311291dcd56514ef771735c7c59c64510c14369f3cb867245efda

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\MR8L0C3I\dvps.highrez.co[1].xml

    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GI3E9IBQ\favicon[1].ico

    Filesize

    758B

    MD5

    84cc977d0eb148166481b01d8418e375

    SHA1

    00e2461bcd67d7ba511db230415000aefbd30d2d

    SHA256

    bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

    SHA512

    f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\TDWLA2UE\favicon[1].png

    Filesize

    7KB

    MD5

    9e3fe8db4c9f34d785a3064c7123a480

    SHA1

    0f77f9aa982c19665c642fa9b56b9b20c44983b6

    SHA256

    4d755ac02a070a1b4bb1b6f1c88ab493440109a8ac1e314aaced92f94cdc98e9

    SHA512

    20d8b416bd34f3d80a77305c6fcd597e9c2d92ab1db3f46ec5ac84f5cc6fb55dfcdccd03ffdc5d5de146d0add6d19064662ac3c83a852f3be8b8f650998828d1

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XT2JA7TF\xmbc[1].ico

    Filesize

    3KB

    MD5

    1279bf31d9659ad2017369ec1b90473c

    SHA1

    0f21c5a8266c36af7909118899e1fa07590f2df8

    SHA256

    74e3162830413f502277c221381f07b34d77a155f5cbeca379e1a4ffc29af116

    SHA512

    18ab594628c7873c56a85cc748585a3422f06d3f3ad70e5d33e86bed8bb9595d43513960731db89820d89b2ed950b48d6b891dbda768164f968ab06f5a86c277

  • C:\Users\Admin\AppData\Local\Temp\nsr641B.tmp\ioSpecial.ini

    Filesize

    696B

    MD5

    eeac01d9513bb9aee8b772b74e3e874b

    SHA1

    056868e884a6895d3bbc52d126e78a36c9cd9731

    SHA256

    269ba55bc8c64b2660f7647ca0968e07f00a0f0bba01734a8095372b329f163e

    SHA512

    fd0841dce76e4ab0f18c51cefe500747ac2bd6cb7fddd888ad83c3a437eb7f109deb460b13ad2cc4e6552d5b3ccdc18ffda48f74607afdca6e52a760ba029437

  • C:\Users\Admin\AppData\Local\Temp\nsr641B.tmp\ioSpecial.ini

    Filesize

    709B

    MD5

    a0aca211985ed867129f52be966f1e6c

    SHA1

    50270bfd98ab7b0838749ff5e225ae6a360d0590

    SHA256

    77ceaff5f1cbb556c03ee96fcbbcf7519bec9d0348114d214e284a0b1808b3e2

    SHA512

    90ea0b2a69423eedc95c62f81288682804a2cd75dd58374e288fdb0d5eee73883f72d2d8f7c7ee6497799e413936204f7d7622872adac8242de1156027ca5864

  • C:\Users\Admin\AppData\Local\Temp\nsr641B.tmp\ioSpecial.ini

    Filesize

    765B

    MD5

    b1b8446238209abb0af7dbd4fa06a762

    SHA1

    d3e48ed59c4caf83c7e10e23cdc8c4ba22ce8aa6

    SHA256

    bc1f075d56c8e92a502c7ecd2ba7a5709641b4015ad46220f96489788a88f8c7

    SHA512

    0fc04f7db76620a98885753a9674e2e3964853303e67526397b7f1ac93700b2f36416206c2c23115108c12c86f5e203a58bad628fbc7f209b003ea275316780b

  • C:\Users\Admin\AppData\Local\Temp\nsr641B.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    f832e4279c8ff9029b94027803e10e1b

    SHA1

    134ff09f9c70999da35e73f57b70522dc817e681

    SHA256

    4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

    SHA512

    bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

  • \Users\Admin\AppData\Local\Temp\nsr641B.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    d753362649aecd60ff434adf171a4e7f

    SHA1

    3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

    SHA256

    8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

    SHA512

    41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

  • \Users\Admin\AppData\Local\Temp\nsr641B.tmp\ShellExecAsUser.dll

    Filesize

    7KB

    MD5

    86a81b9ab7de83aa01024593a03d1872

    SHA1

    8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

    SHA256

    27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

    SHA512

    cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

  • \Users\Admin\AppData\Local\Temp\nsr641B.tmp\System.dll

    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

  • memory/64-275-0x000001DC347F0000-0x000001DC347F2000-memory.dmp

    Filesize

    8KB

  • memory/64-256-0x000001DC37620000-0x000001DC37630000-memory.dmp

    Filesize

    64KB

  • memory/64-527-0x000001DC3DFF0000-0x000001DC3DFF1000-memory.dmp

    Filesize

    4KB

  • memory/64-528-0x000001DC3E400000-0x000001DC3E401000-memory.dmp

    Filesize

    4KB

  • memory/64-240-0x000001DC37520000-0x000001DC37530000-memory.dmp

    Filesize

    64KB

  • memory/2780-312-0x000001BC5A100000-0x000001BC5A200000-memory.dmp

    Filesize

    1024KB

  • memory/2992-388-0x0000022874F30000-0x0000022874F50000-memory.dmp

    Filesize

    128KB

  • memory/2992-607-0x00000228774A0000-0x00000228775A0000-memory.dmp

    Filesize

    1024KB

  • memory/2992-490-0x0000022876C20000-0x0000022876D20000-memory.dmp

    Filesize

    1024KB

  • memory/2992-395-0x00000228757A0000-0x00000228757A2000-memory.dmp

    Filesize

    8KB

  • memory/2992-517-0x0000022877200000-0x0000022877300000-memory.dmp

    Filesize

    1024KB

  • memory/2992-391-0x0000022875580000-0x0000022875582000-memory.dmp

    Filesize

    8KB

  • memory/2992-393-0x00000228755A0000-0x00000228755A2000-memory.dmp

    Filesize

    8KB

  • memory/2992-386-0x0000022874F70000-0x0000022874F90000-memory.dmp

    Filesize

    128KB

  • memory/2992-565-0x00000228774A0000-0x00000228775A0000-memory.dmp

    Filesize

    1024KB

  • memory/2992-455-0x0000022876040000-0x0000022876140000-memory.dmp

    Filesize

    1024KB

  • memory/2992-650-0x00000228643C0000-0x00000228643D0000-memory.dmp

    Filesize

    64KB

  • memory/2992-658-0x00000228643C0000-0x00000228643D0000-memory.dmp

    Filesize

    64KB

  • memory/2992-662-0x00000228643C0000-0x00000228643D0000-memory.dmp

    Filesize

    64KB

  • memory/2992-663-0x00000228643C0000-0x00000228643D0000-memory.dmp

    Filesize

    64KB

  • memory/2992-661-0x00000228643C0000-0x00000228643D0000-memory.dmp

    Filesize

    64KB

  • memory/2992-653-0x00000228643C0000-0x00000228643D0000-memory.dmp

    Filesize

    64KB

  • memory/2992-387-0x0000022874F70000-0x0000022874F90000-memory.dmp

    Filesize

    128KB

  • memory/2992-372-0x00000228646F0000-0x00000228646F2000-memory.dmp

    Filesize

    8KB

  • memory/2992-375-0x0000022874E10000-0x0000022874E12000-memory.dmp

    Filesize

    8KB

  • memory/2992-377-0x0000022874ED0000-0x0000022874ED2000-memory.dmp

    Filesize

    8KB