2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2640	XMouseButtonControlSetup.2.20.5.exe
2640	XMouseButtonControlSetup.2.20.5.exe
2640	XMouseButtonControlSetup.2.20.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouseButtonControlSetup.2.20.5.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{E2856B15-A196-4C82-BDA1-C75D273DF989}	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings	chess.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software	chess.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{E2856B15-A196-4C82-BDA1-C75D273DF989}\LastPlayed = "2"	chess.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{E2856B15-A196-4C82-BDA1-C75D273DF989}\LastPlayed = "7"	chess.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1908	chess.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1908	chess.exe

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2640

C:\Program Files\Microsoft Games\chess\chess.exe
"C:\Program Files\Microsoft Games\chess\chess.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\GameStatistics\{E2856B15-A196-4C82-BDA1-C75D273DF989}\{E2856B15-A196-4C82-BDA1-C75D273DF989}.gamestats

Filesize
12KB

MD5
d29c3d48948b47ff0856788c7f1067a9

SHA1
40d1d7542b0ae7e963cd77f4faa31787d13c3eca

SHA256
ab13a464752639064f53148f4b6a5960b36193e655f0cc8ed70cdf87a2b5fbf1

SHA512
439fe41b99c9fc9b9e1a28405e646d040426e797f94259e93721b14d3a5fed44f1d524f86bdb649339d9c6ad3251bb077943821d602b55ed1a03e61a63762000

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseED4E.tmp\ioSpecial.ini

Filesize
726B

MD5
bc0b7752c494874542fbb3b4fb170a18

SHA1
1d3c804f461dfc87158d197fc5c988dcdc8310b8

SHA256
dbaa1781777bfcb29ddc8ab55d532fea86db2cdcabcaefcd0dd66f8e883830eb

SHA512
a4c8bcd47dd77d8216c1fb219ebc50a6cdf1f84313ccd258a3eabe4d1508c89c7004c9f4cecfbf35a5894389a11d884dd3fe5cd9a4772db2d4bc3f47776fc746

Download Submit
\Users\Admin\AppData\Local\Temp\nseED4E.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nseED4E.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
memory/1908-110-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/1908-113-0x0000000002570000-0x000000000257A000-memory.dmp

Filesize
40KB

Download
memory/1908-106-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download
memory/1908-109-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download
memory/1908-107-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download
memory/1908-108-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download
memory/1908-95-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/1908-111-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/1908-112-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/1908-94-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/1908-158-0x0000000004260000-0x000000000426A000-memory.dmp

Filesize
40KB

Download
memory/1908-197-0x0000000008640000-0x0000000008A40000-memory.dmp

Filesize
4.0MB

Download
memory/1908-198-0x0000000008640000-0x0000000008A40000-memory.dmp

Filesize
4.0MB

Download
memory/1908-199-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download
memory/1908-200-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/1908-201-0x0000000002570000-0x000000000257A000-memory.dmp

Filesize
40KB

Download
memory/1908-202-0x0000000002570000-0x000000000257A000-memory.dmp

Filesize
40KB

Download
memory/1908-223-0x0000000004260000-0x000000000426A000-memory.dmp

Filesize
40KB

Download
memory/1908-257-0x0000000008640000-0x0000000008A40000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing