2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1920	XMouseButtonControlSetup.2.20.5.exe
1920	XMouseButtonControlSetup.2.20.5.exe
1920	XMouseButtonControlSetup.2.20.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouseButtonControlSetup.2.20.5.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{E2856B15-A196-4C82-BDA1-C75D273DF989}	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows	chess.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{E2856B15-A196-4C82-BDA1-C75D273DF989}\LastPlayed = "2"	chess.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{E2856B15-A196-4C82-BDA1-C75D273DF989}\LastPlayed = "7"	chess.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
636	chess.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
636	chess.exe

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1920

C:\Program Files\Microsoft Games\chess\chess.exe
"C:\Program Files\Microsoft Games\chess\chess.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\GameStatistics\{E2856B15-A196-4C82-BDA1-C75D273DF989}\{E2856B15-A196-4C82-BDA1-C75D273DF989}.gamestats

Filesize
12KB

MD5
d29c3d48948b47ff0856788c7f1067a9

SHA1
40d1d7542b0ae7e963cd77f4faa31787d13c3eca

SHA256
ab13a464752639064f53148f4b6a5960b36193e655f0cc8ed70cdf87a2b5fbf1

SHA512
439fe41b99c9fc9b9e1a28405e646d040426e797f94259e93721b14d3a5fed44f1d524f86bdb649339d9c6ad3251bb077943821d602b55ed1a03e61a63762000

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso85F4.tmp\ioSpecial.ini

Filesize
726B

MD5
3af51a6ab939849019687b5051de5b45

SHA1
d48b3869b8d0e2a0d9ffd177ebb5d5be034fd4ed

SHA256
17d3261dc1ab5e4d9fe0a562070510613b68474968617b6e0a6248c46466b046

SHA512
5f6fd305e9254cecc03bf52b51de5bcd2c18b82ed18600cd16e5515312d5487d110c9d1c089041f27435cbdfc9219c07575890ca3d30e79cefa6c45fcc6d241e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso85F4.tmp\ioSpecial.ini

Filesize
765B

MD5
e5f8722da3c5df6bd44243444334b6d3

SHA1
639784d4ad7c416ee4cd90390f2e1917f71f3f2e

SHA256
eeaa56f569c656f71707e8f0c137fd9d776ce88013895edde46ef02d48a5e8d6

SHA512
0915ae7e63a0ec795e0109608c9d76f2270ba48de34510d2e42a74ad3db2bfffe34ee63c113325f64c0b9c81a36cc651aac2333914bdc22e4f39d901f26f38e6

Download Submit
\Users\Admin\AppData\Local\Temp\nso85F4.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nso85F4.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
memory/636-106-0x0000000002190000-0x000000000219A000-memory.dmp

Filesize
40KB

Download
memory/636-94-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/636-108-0x0000000002190000-0x000000000219A000-memory.dmp

Filesize
40KB

Download
memory/636-95-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/636-107-0x0000000002190000-0x000000000219A000-memory.dmp

Filesize
40KB

Download
memory/636-109-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/636-110-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/636-111-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/636-195-0x0000000008380000-0x0000000008780000-memory.dmp

Filesize
4.0MB

Download
memory/636-194-0x0000000008380000-0x0000000008780000-memory.dmp

Filesize
4.0MB

Download
memory/636-196-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/636-251-0x0000000008380000-0x0000000008780000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing