2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

Analysis

max time kernel
134s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1208	Process not Found
2684	XMouseButtonControl.exe

Loads dropped DLL 9 IoCs

pid	Process
2708	XMouseButtonControlSetup.2.20.5.exe
2708	XMouseButtonControlSetup.2.20.5.exe
2708	XMouseButtonControlSetup.2.20.5.exe
2708	XMouseButtonControlSetup.2.20.5.exe
2708	XMouseButtonControlSetup.2.20.5.exe
2708	XMouseButtonControlSetup.2.20.5.exe
2708	XMouseButtonControlSetup.2.20.5.exe
2684	XMouseButtonControl.exe
2684	XMouseButtonControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XMouseButtonControl = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe /notportable /delay"	XMouseButtonControlSetup.2.20.5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\changelog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\License.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\ChangeLog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\X-Mouse Button Control User Guide.pdf	XMouseButtonControlSetup.2.20.5.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouseButtonControlSetup.2.20.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00080000000175d0-133.dat	nsis_installer_1
behavioral1/files/0x00080000000175d0-133.dat	nsis_installer_2

Office loads VBA resources, possible macro or embedded object present

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Control Panel\Desktop	XMouseButtonControlSetup.2.20.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	XMouseButtonControlSetup.2.20.5.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C563B51-5D60-11EF-861D-F64010A3169C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000cb7a27bc5312dce8d720db1534a46915dc37b7b6ebb9b224b784d96bc4d27c8b000000000e80000000020000200000009339a24fb9d4fd7fcc8969d3b7c3c8ad7963afdd70b7a6cb5a45a0b8606d14fa200000001e2c8d318b08c179b49f72002b76c2f954dbb9a3f0eba4088db4637d75c3c24640000000748b0565883b2019c7ca3b213b65fcd77974ba88b640a2088211097150af83264c0ef171a448514702fe6a84527986d09512c6d4ab71b3369e1e4744f89fca9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430147232"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05960226df1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000cfb2f60d661fe7f3b5dab86912eeee9a972be31150730a770ccf15f493406ad9000000000e8000000002000020000000f1e128f086c574a2e87b14ccc19789be8a21f3b65b883a3ecfa88553e70da75d900000005d8c35828538ad6d77c34a3d00fb8a38b33a6ce30482448b0491d9fd43ea299e69e5f24df319b1b20cf048f3a589a964894dec5b6c122be8a6ac071a9b26dacbe28d8baedacb900a85e4b78e1857fd0dd093b4d406e0487cefbbddb0c4cc5224bd76a8a927ec42ef285c9fcdfd13487ffb47c1a63624c65a45bccd5080a37bd3839ab9f88655dae9e453a08d94f7100a400000004d7b4529f696ecc07e6216da3e8d7779ba37f5909550a0ba269189902f66b5169cd038474491f883c04db2b532643c33f4a8f9fefc4115519671ebf92843bad5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /import:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /profile:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /install:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2708	WINWORD.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2096	iexplore.exe
2684	XMouseButtonControl.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2684	XMouseButtonControl.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2684	XMouseButtonControl.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2684	XMouseButtonControl.exe
2684	XMouseButtonControl.exe
2684	XMouseButtonControl.exe
2708	WINWORD.EXE
2708	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2320	2096	iexplore.exe	32
PID 2096 wrote to memory of 2320	2096	iexplore.exe	32
PID 2096 wrote to memory of 2320	2096	iexplore.exe	32
PID 2096 wrote to memory of 2320	2096	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
PID:2708

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\MergeGroup.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

Filesize
1.0MB

MD5
d62a4279ebba19c9bf0037d4f7cbf0bc

SHA1
5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

SHA256
c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

SHA512
6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

Filesize
959B

MD5
d5e98140c51869fc462c8975620faa78

SHA1
07e032e020b72c3f192f0628a2593a19a70f069e

SHA256
5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

SHA512
9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
92995df394ea340c28e3a4899bf6ccec

SHA1
e52811360aaf033e73258d119192c01f1f896ade

SHA256
413c95c0de14876388d9364d06d317cae78f695cbcfd4c441c7d395de296dc85

SHA512
3e17ad3ac62da095f8ee41d49879b8a241499ff72aec22bfde2cb944fe6e7d0250a42254c176f0b065c1dc2a20fb25847031e639d04d4b4d0c4b27c2229ce8c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

Filesize
192B

MD5
f401fa50556bb47b5ba236a2b4ce0345

SHA1
5154d8b5a322fe181f081e4c09c3b4ea31e2fbc0

SHA256
6977c4fb8924bec93104b8233e83fdd6a863cb0dcb10570f7bfee2f351d14d7f

SHA512
780291c123506848d78a7a62bb98c0a4bd4505d064020e2dba3b77f4c0b5c4c328a365a62bfa060c34165813e328ffe9acd987ae355bf539f0c07251aa9a13fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a185ea5db395a22605eded81fca5919a

SHA1
c6bcd306de9f76e2456cd5fde71f70f4ded82657

SHA256
1819426e3d5b8679d4b8e6d9a748b7d7c9fc6599f42a62418cd41ab8db96ab64

SHA512
1901c71179749e61ee7d74c7c528e395b9b606ee65d411b7964e3cdb604a94b06e17bf51e08cd5b6555cfbe96ba457e85f467bb6132aaaaaf6278ff9479ce6d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
066c076243acf64c65f97ad8b67c40ce

SHA1
65c500c93408a735a767f6d47cc804a7ef1f0536

SHA256
a03cc095ae3caf0ef697005de1345789dd48f7c958315a5fe085a6d7d58e7f2b

SHA512
d01e0b075e0141cf22c2cc22174a41e37ec3d378f68d1c958e70a158f4a4303b4eac956066dd0baa90fb09debfb2caaab86a519031f2c949a04dfa902e62f3dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef727749e3a57ce4d47acbd15acb5b04

SHA1
ccf6a6a1c9310eb3391ef32078acde07eea433a7

SHA256
87a9ee4431324198e930eaee7d84d4c12994fda0784cf0194aa9ce37ea279bb4

SHA512
081dcce53d034236efcbf6a65c746d9c5ce1eb39411b2ba10b4de01ff57513daa4e289318a080677efefa776674ff015eef4c681e0e8181177f94bc149baa799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
181975bd069b77aa8e5b2f9d9f8e25af

SHA1
cedaddbdb1c429ff297b194d840e49bde21b2e7e

SHA256
9030185e73e045f3f1981c2c19904036a36481d5bf5fdbe059c672d3971b4a55

SHA512
a039f8d9e4d4d00d4de4b78a8cb0f6598c633e7987047b2a3358a40ae61103f9bf241c9c2c3b2505d93827e1c2723848357a20dfdb6aa5159c8fdd1fdeee4f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02c19104c3f76ed813ab5d624467f2a4

SHA1
8cb268afa5ca3309c089b5630b9aba44c4a88dc0

SHA256
71b001dcdc9988777d63de349c2972edb45aa7a670a381fd8f0417d61bd9419d

SHA512
ee487634b6a41a96860fe74708e7256783612e3161fe7f6cd39141b9148b2264b6dd73164edc774c51fe0988083bf8f9a28384ae8be8378523a7285332eb05b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d7e36d4c310f6ea89a15d14a4e7a014

SHA1
887250be2fd965e7e4e06b84b974884318eaa58f

SHA256
dce95add63cf8a3f33237d001dc6d3ef37d6c8822b0c413526bdd804ffc2b0d4

SHA512
37d8ef0782945ef7a0ca0e135ce8cdd10be881585eb0122e6d2bedbc7edd8cf3d4886177efd20c357fd832727a08d446756d97af6299d367e63cb3ed4d217e3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fb5f9f0f9bc4fcb866181a22de66e7f

SHA1
23ff0602900f6538e62cf36696cc7005b90aeb9a

SHA256
42e219031f2a4389612bd1dc36dac947a630eb0f0b49afec5fdfc869c1bb7183

SHA512
a09ecaeaf8dc32aa91f83f66f85544437fbcea765a4964376727b6d7929858c7192b026054941cd6ff900f88fdbfa826cd1bb44a2b096e35f1313e2f2d0c1096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
959f7dbc367c4e628db70686c9a03a66

SHA1
b39c52d9b10c17c56cb354163ddd787a34f1fb3a

SHA256
9fb59fa00d11675869e3326ac9ba885fe2e9cfd39ae56288af00f5b70afa3bdb

SHA512
53b6b57b66999e1a7b60dd9c03ceeb744522923471ae1b4887833e8ff07064ee653ffc3e71b8a7727b2c353b640b896175cad3a36f345d05db6177f017e7bb84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c789ebbb98d9d6259d8ff9e21e59050

SHA1
ede4c328debb426cbb44e005e2dba3764d924f2c

SHA256
1087b9eaaa3b3b678bf3d441af4c869450f81da27e70d33664ab31e6d703a515

SHA512
10ccc39f8fd239694bbceda9f07e6e3313a4493eb7f1156ae604a2e0c6adbcd222a533aff62e68cc14958f22a832290b842b5d099b2c5b00c63ed6c1ef0e1163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34b4da8a07c39769775c47e0589fc71

SHA1
01e44e9420803862d183d556ae4468a0d5b2a90d

SHA256
3134d90e4eec8090655b0d2b3a81e8cd34d1a108553081f1dc5a60e8a7466e13

SHA512
c6ac6096239d3ae53dd3ce326a796b9759fc464f78cffae903704cc2e41c1c70ccb9809745ad4236773d9d83d880435e2c6e1f963c80fefc173c2d739286ecc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77650dfd46230fdf50ac5ad1211420f7

SHA1
d572373d6484cb8c294bd1d602e281be4886cd14

SHA256
8fa22a850850000c29bbc2e9e671a16d93a08cf232ef5f9c6a57d9ed6d1e5d4a

SHA512
2439acb4153201cdb408de38ee033168d8d20b28e55893f6981a53d6b23bcc76c0422ae797df758f0f5f0a4727c4c2b323e3fda43ee1fafc66b8855f041aa7e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dbfbd408628d6afb360618ea4fe68ba

SHA1
cae10de609e989bc718f6bb2b721e3f93ae81938

SHA256
09ab87487ec85c4dbacfc8c0b6164e57b3222f5fb024d50c9dfc21a4e028d92d

SHA512
ed2f4f501f9404fcec32ad50d2ff8dc1451bca822e5add8bb1887452c087963546a661f12af94451544f2987a458ed748526ffb6dcaaed2f078f17a5e31d094b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a89619eecdf2052d153093046eb5bd2

SHA1
2d67c19fb6d7e9a323bfe505c7c400c0725a69bd

SHA256
bc8403342bac07a874e4f90f617fe9ee91ec1ffade6498d44c6281100354414e

SHA512
5c58eab30e312892b1c5bd10abb61b7b3b402213529d3b85a890cfd56243a144bf424368c455d2a399bf450bba846e6eea71ca3d4059c03e56d7de965bfe9916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40591cf2f0d6e55cedee9f4942ae3ca8

SHA1
fa71df9ece9e62e66011e90f2c4aedcdfb392bfc

SHA256
e214503ced91708b4d32429fd983d354caa9f839b5fba7701ad75cf9cbd24978

SHA512
9b9cf549bd948d67dfcf366cacc04d1fdb2dd3c4b0cf1e7f3f8963fac3888f49a3df8632929fcadb21fcee828560c37a1570d25c5ce8a88ba1eae2ccbf37b2ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99fc1d2b4acc1199d5b37a3d61d59fc8

SHA1
bd8032c9803060572263348e65fa738a0bf2b521

SHA256
7daf40afb97d17a0e7fb837582734fc988c38eecb67f52e93eb2300487d4aae1

SHA512
49ae5b491abe1208b44771178f3faf997311a68223fe3a1f8cae56eb8705ad68c9ddafbea78c90ad68b5961dec89db276b0fdf3540e85bce58b42e4621ce75f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbc0f592ccfab3e372b2cd96e8eff684

SHA1
eee39d16fb1752e2dd45e8962ff8137cefca904c

SHA256
0df236838adcbf07122bad3346893120fb2a2393405bb5c56e2fb590ec2ff1c8

SHA512
8328ea4d4e475b853d926fb40fade16e0d204092d001b2fe4b17dfb016af84c2d9f64520ad1902b37d2140cf69bbca759209c3ebbd4cb7acf683ff400b35570a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f9eaefaf6308067e7e3969aa920407f

SHA1
786e7aa347792696342ef0908156f16f1467f8d0

SHA256
2f83af40f6b1fed4c8f31b09b88f8282c488ae16b6dbe54948e691dbec91ed25

SHA512
56f5ebe0aaaecbd79b8874021f8524d42080027a998f38d0af85965c492fe45b96645cc83caee319bb129ae10acc84689b102949707f0238300b6676a06d8bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa983ab105a484150e1cf39983d4646f

SHA1
c00254636311b57e8fe58a9144b2dd6211ae7bec

SHA256
8461451e06d3f9890e8ef9db2cac9d72e2e447f0a439b6b05b14351e2c41756e

SHA512
4eacf8d7714f46e5f5bbc98a4424c620d0302a79f3efc54a2886bce040e60c3aadb5f9a69e9f05dfb9c81575fd1272f1f2c00e65ee4502e35e0998e85159d8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f669c27b0bd37b584ccbec0e973f15f

SHA1
3af6deeb6919261ee924d4ebb2346e04ac36da80

SHA256
103a8df63cd280c18ede284603e28c7fe9a4ec93e44fc89ab8ce83eecc6b86a4

SHA512
5866f8fc4d1a8500a521f98ca7566c11c6aae505f03455e03990ae527e8472c6197248a96da94723ccfc347ff3e191f1f092744bee3d08ed786de023736cfc5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1c668d0b9b6703e043df36bfab332a2

SHA1
f126682f492766a3cc98dee7d8a52f85b8aa192d

SHA256
bb449b380766a22f9f9df078a0cb1ecd39e24a738532d63e1908835e94c3b69e

SHA512
60fc6d67dd77f2b53b1ad403742dcc6d810bfcfd6b7b88e784e10fe2f5f81634cf1a1bbac570b3914168c51a4843428426517891c81b30e563ede7370fefddec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
201c6417a6f5a9a90489c198edaee824

SHA1
f465fdd2d8760a1d2acf7fa3bcc1cd26c1b93ccc

SHA256
f1b3ee4349ad552c93877c3b0a981fb4c7b07bb9428aa4be64e7b41f381ef741

SHA512
6f4181c1cdd5a500b7c8bcbdbc07bf7b2ca1fff8d3b4e49fb72ed802d29772370858aa1baf9201055d037dda37c0b8df92711f8cb3f9179f00f4707c1efde1ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82c0074428e5abb986e623a1ed630ce5

SHA1
db00f87bba26c78e5c2aa1f02e4790a2237cfa85

SHA256
04d8a547966e5000b56f3b7d96fae47c085da196350d5f06ca01e45b376af082

SHA512
9d491ffbfab52db8e7e2756d963d701f4e7d508f28b4a69eadab1f95fe22ada40d625e5378cf54ccf8c11efdaf632e040402409dfb766012b46cb2cf9f90bfef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fb7b6b0686ee88d2b9d860a1db1f7ba

SHA1
087153ff93f1070ab9d0c108d0e5dace71674ff5

SHA256
c687fbd47ec4e73935cbccc749720fdbef0f7bea2322790ff920f554b717c96f

SHA512
c5f4d7c276d5c1c09b10437379c1e8e011bab4b19fcf99c2a64b8e70fe1fa26e5a15f7f4e1df8c0f76696c8d2e1d627010e400dd9aba495560e8d2ae0e44c916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ffafe82d80e8dfeaa3c66894099064e

SHA1
054dd0fdab53e0235c034151c749598e571b25ff

SHA256
b6305847225856e86929881dacb12234f937df7f2a0cb07b9c7401f327984c69

SHA512
48fc174cfa056ca0869c905259972ae0c50a230831b3180a2b321ff2557283e782a732551ae959d35a074b74704394e00245bc8da91224474d7f800c482bc981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
887990ff40864dd9b6a75aeac4745037

SHA1
1eeab28b9cf83cade0cc895bfe64edf61970c5d4

SHA256
745a721d50004c6005976f398d8777056dfffb384bd57cc3717d777a89c23182

SHA512
b5fb1483c33c2b8fe508248899dbdccd0fe3c07c162048f1758bd45390c6c23fb0a038c043be3aaaa7f0ca9e52d039112891c8600b7a4dd49b99781f6634cdd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\c2sxdb0\imagestore.dat

Filesize
3KB

MD5
c16de105a36446db2df17704d9889dcc

SHA1
13e4c5d71eb2e90bd8093e6d8258fb05dc088c8c

SHA256
cb883ac6e9be9d702d26da17dac1eb01fae1c38aa0971ae23948b05700d58556

SHA512
1a1af0f5c7c825cca16152e4308dc7991cc39c192b4be07776bc1e889e9fa61d1820842c566a8770f9639817dfaf3dfc9bd6d7db38270d60067ece391da60a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UK8J8K8\f[1].txt

Filesize
186KB

MD5
34edd9692ea0ae8d532118c7f6dfe108

SHA1
e27f30297de3c5745221e547e9e9ea9c1681114e

SHA256
79bd1a1b3e5f4671fd9a5576955588d7efcc24385a6f2c7d2e5177d0e8854a03

SHA512
0916c1ac6168273c85cb203666d712fa7c70bbc078a19915a9b348bcf2fd7c035079bd0c2764a23fd024f06ed0bd5193279a218bf2a858f338bd077aee7630de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3H1FOMV1\xmbc[1].ico

Filesize
3KB

MD5
1279bf31d9659ad2017369ec1b90473c

SHA1
0f21c5a8266c36af7909118899e1fa07590f2df8

SHA256
74e3162830413f502277c221381f07b34d77a155f5cbeca379e1a4ffc29af116

SHA512
18ab594628c7873c56a85cc748585a3422f06d3f3ad70e5d33e86bed8bb9595d43513960731db89820d89b2ed950b48d6b891dbda768164f968ab06f5a86c277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab477C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar479E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso1882.tmp\ioSpecial.ini

Filesize
709B

MD5
ec9cbb8eb51bb6cb023c4a714555a5cc

SHA1
c1497330b6c69a0b13a80c43114088632ea5056c

SHA256
66c16715a9dec7e7c3afda68c10e06265823800b0c5ae4fddc7f1f1c6a7e132f

SHA512
f18c0eac41fbe35ce10fecd7846f8196f939b9f573847a058df1fb47286a969bc7d76932756e99a302df2af473eb0b126d88cdb2f1a8d6a651f797249b4c0c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso1882.tmp\ioSpecial.ini

Filesize
726B

MD5
b50223afc9796e624affd0b3c6920eb8

SHA1
0643e938c1171853f93f7efee5e843385e69e52e

SHA256
d17c1d2cfdea78bf7e979d40c2cac844725aa31a40598d4e09320d80bfb2ae85

SHA512
0e70bad0172b8a302d016a9f523110cf652ddca26caf3c5745e8ad0cb71c12aa5a0dde7640b2425ecf0313696a3cdd918aae1ec588756c591e6dff597ff92fa2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
7d794322d6170c99c2634aedbad6eb70

SHA1
34ed9f410dfdf38218a70c07e2aec77fd617fe9b

SHA256
bdb773faefc9fae853000c2099bb9be3aa02ebc0747374bee164742d43913c35

SHA512
984a5a6b94ae2390f44dea0b7b7432b641b2b3e8367de665dd9dc46baadadcf0ff9052d0e950b26df1b7a593dddcc9d53d2c41bf574308297394320ca46b3bd7

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

Filesize
364KB

MD5
80d5f32b3fc515402b9e1fe958dedf81

SHA1
a80ffd7907e0de2ee4e13c592b888fe00551b7e0

SHA256
0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

SHA512
1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

Filesize
1.7MB

MD5
bb632bc4c4414303c783a0153f6609f7

SHA1
eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

SHA256
7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

SHA512
15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe

Filesize
74KB

MD5
bfffc38fff05079b15a5317e279dc7a9

SHA1
0c18db954f11646d65d0300e58fefcd9ff7634de

SHA256
c4e59737ffd988ef4bc7a62e3316a470b1b09a9889f65908110fba3d7b1c6500

SHA512
d30220e024ac242285ea757006e7da3874e5f889951de226d48c372a6a8701b76d4a917134ecc1e72c6c3a8d43444762288e7134a25d837e9f43d972675c81d6

Download Submit
\Users\Admin\AppData\Local\Temp\nso1882.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nso1882.tmp\ShellExecAsUser.dll

Filesize
7KB

MD5
86a81b9ab7de83aa01024593a03d1872

SHA1
8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

SHA256
27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

SHA512
cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

Download Submit
\Users\Admin\AppData\Local\Temp\nso1882.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nso1882.tmp\nsDialogs.dll

Filesize
9KB

MD5
f832e4279c8ff9029b94027803e10e1b

SHA1
134ff09f9c70999da35e73f57b70522dc817e681

SHA256
4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

SHA512
bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

Download Submit
memory/2708-232-0x0000000002D10000-0x0000000002D12000-memory.dmp

Filesize
8KB

Download
memory/2708-1240-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2708-832-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads