2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1252	Process not Found
1000	XMouseButtonControl.exe
2512	XMouseButtonControl.exe

Loads dropped DLL 14 IoCs

pid	Process
1924	XMouseButtonControlSetup.2.20.5.exe
1924	XMouseButtonControlSetup.2.20.5.exe
1924	XMouseButtonControlSetup.2.20.5.exe
1924	XMouseButtonControlSetup.2.20.5.exe
1924	XMouseButtonControlSetup.2.20.5.exe
1924	XMouseButtonControlSetup.2.20.5.exe
1924	XMouseButtonControlSetup.2.20.5.exe
1000	XMouseButtonControl.exe
1000	XMouseButtonControl.exe
1252	Process not Found
1252	Process not Found
1252	Process not Found
2512	XMouseButtonControl.exe
2512	XMouseButtonControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XMouseButtonControl = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe /notportable /delay"	XMouseButtonControlSetup.2.20.5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\X-Mouse Button Control User Guide.pdf	XMouseButtonControlSetup.2.20.5.exe
File opened for modification	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\changelog.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\License.txt	XMouseButtonControlSetup.2.20.5.exe
File created	C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\ChangeLog.txt	XMouseButtonControlSetup.2.20.5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouseButtonControlSetup.2.20.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000500000001926c-133.dat	nsis_installer_1
behavioral1/files/0x000500000001926c-133.dat	nsis_installer_2

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop	XMouseButtonControlSetup.2.20.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	XMouseButtonControlSetup.2.20.5.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432515565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04ee05af706db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80ABB0C1-72EA-11EF-B12A-E61828AB23DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\highrez.co.uk\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000011030b3089888df9c94de2be592ada95b314f5f9bba941e7eaa5e12260aa4953000000000e800000000200002000000063a808911c06d9f4fc7e27d1b05edf0a43802b03c9a0ebbf6b40ac6a18e7ea4d20000000999d7943228aad717ec0d11885db3483e0341296fbff98f3285548ced8231c4e40000000de3a2eeb2069a2a4b48c31988aa8861cedbe0b3b816d23131a8ed8a32eeee6ad4a15ccfc67a1ca94c6cad6c48a009fd316c6a929abaf6b32d4608be44cfcfe11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000000bc969db0b66830190801ff7e3bd5656a2ae6ae6ce94e44d48f7293f445bbba2000000000e800000000200002000000021cbdc4b47051bd1181cf545b9845e85dea65fe2c2e279bfca46a6283f40c435900000007bfad0dee005194e6c5c134819ad4fcf22e4de887a6c33b29f3d233f8de5b9067d6727c61514c502fe14237d9cc888627f608709ce945b8caabf2345fef3a7d45e527087fe214cad9a60e4a9ef19daceae549d09b27394fa87118f0dad8470a993a928252ed1020c8df73d7fc43bbcdd21af199c3ad9df14c467de9f75bca6013d632bd0c2abab879709fd47e559dd1340000000d5d5618785bf3539427d92243a46afa333ce8ed348e3b9489f15b0f1187b6813a16c8bb77dd858fa592ed50b850b04745aed53e01f6015263f7c3ed83bca0e9d	iexplore.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /install:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /profile:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcp	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\ = "X-Mouse Button Control Settings"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbclp\ = "X-Mouse Button Control Language Pack"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\shell	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Language Pack\shell\open	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmbcs\ = "X-Mouse Button Control Application or Window Profile"	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Settings	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\open\command\ = "\"C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe\" /import:\"%1\""	XMouseButtonControlSetup.2.20.5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\shell\ = "open"	XMouseButtonControlSetup.2.20.5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\X-Mouse Button Control Application or Window Profile\DefaultIcon\ = "C:\\Program Files\\Highresolution Enterprises\\X-Mouse Button Control\\XMouseButtonControl.exe,0"	XMouseButtonControlSetup.2.20.5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1000	XMouseButtonControl.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1312	iexplore.exe
1000	XMouseButtonControl.exe
1000	XMouseButtonControl.exe
1000	XMouseButtonControl.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1000	XMouseButtonControl.exe
1000	XMouseButtonControl.exe
1000	XMouseButtonControl.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1000	XMouseButtonControl.exe
1312	iexplore.exe
1312	iexplore.exe
920	IEXPLORE.EXE
920	IEXPLORE.EXE
1000	XMouseButtonControl.exe
1000	XMouseButtonControl.exe
1000	XMouseButtonControl.exe
920	IEXPLORE.EXE
920	IEXPLORE.EXE
2512	XMouseButtonControl.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 920	1312	iexplore.exe	33
PID 1312 wrote to memory of 920	1312	iexplore.exe	33
PID 1312 wrote to memory of 920	1312	iexplore.exe	33
PID 1312 wrote to memory of 920	1312	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
PID:1924

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:920

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1000

C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
"C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /notportable
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
796230b8dab52fd5637eb8c57a2aec81

SHA1
4b3c8387b768bd3ab7624db5fb23eeb617b7949b

SHA256
e4e0c459f7fe6394a9c791aa8d568ad4eac34fb01959bd870b6c62e191a34358

SHA512
8f2f339a3c027c5ffd89700c27f3838fdf67d60702822801c6e9219628eba8f4b5db702b917cf77a1f671d0ed02eef20867b5a7a90ef0a9bf1baad640456d10d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
537ac09d0b0eb6d95d05b5a26a69db1e

SHA1
92a10acdd5b4d250db8a2dc27fc281a694411a31

SHA256
025c48183c29211a2e946a8353f2f6eb06901988f7a3a0d0416d15251b362a33

SHA512
978bc875e888a3ff3cbb92e205d50e155811a0fbd9e685949835d9e7586f58852d3825cafe68c7583c510dffd5ba0305071e30299ec5818cea95baeff0833901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8357ed8810583854dd47112cd77e3df7

SHA1
c7238fa650a40189642aef22791111871ec45a37

SHA256
04f947536994bcdabea18b0a2311e82f7693771f39846a5cc91556d9becc9a50

SHA512
fd7d3033c91754c6e1b58b0d3f5735ded06a3cacdb9da4c084a3142a1cbee3713a4fe31e2411ce3fbc9f911a3ea7a7f7923d5fbaaefe766bc216b3fc6fc1b88b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae252b565eef9cb1ebc1051db730e9e1

SHA1
733cdd7e64c8622c6bd89e81a3c1e242b981a695

SHA256
2203b34fe5e4831bddbd626ab19af8d604f04adc89634cc9a936829f6bcf6555

SHA512
f02b90a92bae26cbe14d20b679efabd94b84846054bd61124c3f99612ec6ee7065f222a567c60cca388e7d040c4f9a6aeae01237818baa036ad476448b8940b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4c00a6285060c6ef2541c98818789a4

SHA1
74858f7032432f0a6336394fd79a5149ccc1937a

SHA256
72d244f8dfb88ead008320e3a809297d8ccef3055f4915535b6d8cc60736c47c

SHA512
48043fd6cc6140c20ea219265e440b7ff16e3ed16f182e1b1abd184bdff6365771146bb44880d2fe07d1c4be18f31a3b12f86f29efe209ac05103530d97b3435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fac2a65c5925fbfd0e2e59ac1ca27612

SHA1
6a34c72496b2a40048f1030b991e9542c03734d7

SHA256
29407a3d6e1d63ada53854d2ee334a6c155b867a40bc1f6adefef1869b8e6f26

SHA512
e4e46bca956a5fa3d7c72514f612d11c71da03acc5b353de9223485d094b11d0faa10004b2750e2e0984518962e8e35762eb1d774fe0786d66cc7947213b9286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ac12b728eb251ccd893a29c2d187a72

SHA1
24a9af00b65f1c4ab6d55e6c1150df72f4b3020f

SHA256
3158a665013c16051f09e8f6523745bf6adfa9ca7afb4df47cf26f5643c9017a

SHA512
988f5833878c59a2be649f470358038f0223c76abdd0c2c0f98af3a86932c4aae68e484927688800044b46b2a4dc36240095567bfe777584f5fa9f63d597f404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cc64968fa7858aab3646fb3ade25813

SHA1
a65b11ddb86ed2efa49095dbbddca04ae91c2740

SHA256
6404e9b7ef87c5e1475ede5f80076feae1709d450f586cb062930adc482ccf39

SHA512
d9e75051ac0461526c0bf8dc1b7bd69d22b48ebe31f87c39a155cf2b182cd963b03b0dc7f51813b6fd40f9f2c66784ad073bf2058a01bfa51cec60b8f6588cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced63f1f3ecbbfcdadd5d3344e109322

SHA1
f530d742371d1d928cc192e94b06fa7a6b6015a2

SHA256
bd671a5ab0073e87a6eeec16de1c9d11d902541b963f4546921d61549f9c0896

SHA512
21ac361ceb536d09216d5ce005be1ee3bf1c0683758fccb5a6f59e1cb82abf49d1b16255367775fca6d13320eb3f3f4d90de3d71ad80a806f87cad6de9ea20c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdb2bafebf304f5bfb08f06b637afc15

SHA1
e49e0416970154729eef0bcb34ae87e4c959f8ee

SHA256
bfbc46ebc665667008aa31c5bf2602ac353d9f01d22b87007e7f55327b792b8a

SHA512
9d7b8a1c0f349d82af84825da1de2e8e7e8eb17a802a23a0e3c7586e3811b5072ca9ae5fc6067bdcde7f47a7dddd97ce168d8a846cd063fac0486f1ed59a5a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42e082855f0fc1dc909aebb7eb36bab3

SHA1
36e0fcfdd73205858dd181bbd1494829f5817969

SHA256
4237f9c729199821c3eca1bc13bb4b99b46d341a22f62db01e62d4f274430e16

SHA512
efe64b85e06668d35a02b78578ea5599051c259c08196bb1625f27a33ac7d317d2c7e02b5aafeab593254d80db2f1b05cdc8c046514be316fa499f3a9f62bce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9910878b7658b1cc4a33fcfec9553e27

SHA1
a6d170b0ef67971fc59978e469cb3b9c7910660b

SHA256
5e9095b22eea7d6b09f552cc3b59aef9d94f148030be3821f55955c218dfac77

SHA512
9764f4c7c321963d7be896ca5748bf723024622d330782d47a1b6855df5c58de90d83672ded52b610aed6954e8143c81059661de6f868b5bd7ca43ca069c67d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65542a924d419a14f039b67942d3ee8a

SHA1
d59038227e371e0b0e1de7c90126532c821fd4a5

SHA256
09ff95105132852dc3905e73f747200a45f88c7d335bc9578abf723479fcaef1

SHA512
67c81a06d4974f105d67aa8aee88bdc805849b7ec6650a9493f5ee0687181e65fcaa3464e84df9bef23e854dedfda1ecfc2a0fe592b41700d2f7649c41603830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c913891e3e1dad83bea8606e9b119946

SHA1
22dfdf46f23b37a2b40b0c03232696bd17a16809

SHA256
199eba420a738bba07d90497b3f8c829efbf91072a89b8c4b822a0e71a70b08e

SHA512
cf73c4ca515fd70d30e22c52dec57e73d94220d77e16746cfa33e8d788b8251544b468df2262eaefdeca33335087d774700525f53f52fb542b534855ec5951f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2b68b83ff309478991c15b8821abdd

SHA1
d39bc6b3b500b3bf0becce23f002de8e5cb1e742

SHA256
0d04b3bab7b407b251d2f4114fe45dd949b76b90ea793a405d5278c456e61d75

SHA512
a196179429bfa16ec268aadf6e39bbf63675f3ce54cbece12a4d647f1ba6c57f814f345118c8bc544c4d3a0ca936542261dee7a1c416be6285b19910fbb469e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c19a26832217d26c070291f80560328

SHA1
fe096d5e8b2aef70c1411a4b776fbae7f953df3f

SHA256
7b7c80d962c7c9656a95057f2d533b854a1782b4d173a8b189857b8997c002b8

SHA512
69584569e8fbb7561abdfdc172a5ce6918a8430d9ee71f9f2bb29b85f3c75d90ce5899a4f9b79e73186441f3a6ae7eb0a213fdf02f6c55d4a30d7cf6627494d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d0f13f1789c670b82431a1276c3d674

SHA1
f73479cbc41c844a4a5447154ff4a13fcdb45d10

SHA256
9e3042e4ff4d8e71d5241431e86ce455930e3492e2c0b28c44096dcab1635be8

SHA512
f874beb1ef13a1eb3b2d58a3190ac6c4debc0824737d8d135292331d520c9265dc39f6169d9f6bd59988bad68c57d76d3da78713f6b5de1ef40a23b57579dee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70aada33200bfa2afb74c1b3bd013114

SHA1
bd6f93961ee0b6157ac02a04f89c76269fb35bb5

SHA256
c1ae7bd3ccace8b6927dd33af09ed9d6794b07d3562f3915137480ba3d9d1e71

SHA512
4a0c842d7a0a07daebf311b8dac7f00997bdf87dfeeaec10f3b2492c693d891cc0129cfd0b0d54e20cfc775cab94d54c4832a548df0093f03707c84597f9a042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
427e0a48dbd44b547fd8abc262bf7f5c

SHA1
417998e89bb53267bd509f14095101feadc63241

SHA256
5bd11a9b524ff3e8674d1a7b4a37c94dbc734b99ef50fc34850040aec152e4e5

SHA512
5a20ef7d23e27ecfe8ab67dfff2dc81bb62697c043444d58402ca4dfc8ed91cf6a061b3d64f7d46075046bbcd856d6e86d9eab2f8df2b8a6312b0d59b63c2f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9db206b8baeadaa6d972ddbfa1f2730b

SHA1
f63456e8f11d406cf7befedb635b43f546dbbee0

SHA256
f406e6eafee0586d22544117435589359c0b353ae1e2928221a123b12fcee15b

SHA512
ad7a3375996dc6a415db6765b0f741d1253a48ff6cde2ae2ba098888a69fa2b5bff8c1a7e6b82e0ee021cc86239b44069565133f43a0f34cf5d7b45ee886c32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9158b5efc3576428c44cc5807c33605e

SHA1
a3bceab401b848062169563cf579d91dcc19c347

SHA256
34758f3356df5076fb254c9fb93f73254ecf6eeb8a732d2cdb085d283f3b0a8c

SHA512
a56d093216025b0adccf2f70502108c7334d5c63e8e2851df56f3d9f62b060a648397b8c80ea9a98bd86d53df5613d4c391a045a3c16468bad6737bf90c11f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23ca490651a90ed1224c9bdb12e18939

SHA1
fe19716378c88a32e4e8d7ae20b606dd941b2479

SHA256
dee316e3ce863904bde82b00eb5d2fcfe7daaecf8e859cb8d465cc20eab3b8f0

SHA512
63efb149222e4a091b2c3be2c1f22004937bdd58487686a0ee849476dc4d44d531e2ec1b29ff8ff237dff66a1fc26f9697490cacb01216bc324859800816966a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\bl977i7\imagestore.dat

Filesize
3KB

MD5
734ac6b2a6dcc6e059d5784e015a23f3

SHA1
cbfa65e3e9dc81be3fcc3cff36722d33d9eaf1e6

SHA256
22589278ea4940943b93fddc1780737f028c06245c05575de5c266940922dd5f

SHA512
680e5464f0d6d8c9831090ba7c5b8b3cd6997e09c6fa4c7c2abf85a114d4a5e3f15901089dab5fc17a7ceafa1ba258e37f6911e07ea2d8b26edfb9b5fc9ce344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\xmbc[1].ico

Filesize
3KB

MD5
1279bf31d9659ad2017369ec1b90473c

SHA1
0f21c5a8266c36af7909118899e1fa07590f2df8

SHA256
74e3162830413f502277c221381f07b34d77a155f5cbeca379e1a4ffc29af116

SHA512
18ab594628c7873c56a85cc748585a3422f06d3f3ad70e5d33e86bed8bb9595d43513960731db89820d89b2ed950b48d6b891dbda768164f968ab06f5a86c277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QS2MOPHD\f[1].txt

Filesize
182KB

MD5
3d4b1366fd12a56f33bb50e8426112bb

SHA1
b8ae8be571595eb052beba25f2c53f96506f1564

SHA256
bc150d1c0f9964f7ba4bf8ab8efb8ebebdb7d8e1cb4aea96b43dc7ced54d1e9c

SHA512
8fc7515b7d43c0d101898b8eba08c5fd67ffaee70435271025fc5f9acab2a1ccc1ab665dd07cfdd5cc7b7c89759fc3263c6070a38d49277cdc21b9b2f5269311

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD20.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA6AD.tmp\ioSpecial.ini

Filesize
765B

MD5
12854b98b3bf370397d58db7eaa4f1ee

SHA1
a6494f29ae88955b231cc21fc7141f3fc5ace1c4

SHA256
1231b0e1e8eb1851e91029e83e3f430e4cfe2bc453923b5085f50b9adc69991d

SHA512
8b8b6a8f1ffd9ba53c95defa32801e9be1b83d7137915d62b3757e7d07a3075d34209d020ffaef9429fd1787d457b20eed243ca759368c10c470a8fba5fc98b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA6AD.tmp\ioSpecial.ini

Filesize
709B

MD5
25eace7c6de9cc29fa721e0441163345

SHA1
4c7a62256a243bbdce84d772db8fdfeeb9a8c634

SHA256
885dee8cbc0426cde24e8b7f80626a864016df65e7f6554695ef10de285da39e

SHA512
f657a82ad033d4143f3ddb705a29b49deed96f1e85cc7fdee5af56c5a89544ccf8c2ff3ff2e1b928e7a5cd8823793dc9e79d0b98925d6ecbef182cb9a65e68e1

Download Submit
C:\Users\Admin\AppData\Roaming\Highresolution Enterprises\XMouseButtonControl\XMouseButtonControl.log

Filesize
2KB

MD5
f540b6a5dddbd66a875a6ce38913937b

SHA1
8c3d03d8ace4c8eb4ec53166fc2defa24686f83e

SHA256
4aa9ee6306902ff0f8cba2f210b1828d62e32e28a54014b106a9c940a2755914

SHA512
06654380a36a6cb9fff56f8953ffc4a63e4a38ae59990ebfdefb5bd242bbef4da25a4725aa39b865dd5a6e3af098c3e4219262a0a8e151e0694fdbccbca00b3e

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

Filesize
364KB

MD5
80d5f32b3fc515402b9e1fe958dedf81

SHA1
a80ffd7907e0de2ee4e13c592b888fe00551b7e0

SHA256
0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

SHA512
1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

Filesize
1.7MB

MD5
bb632bc4c4414303c783a0153f6609f7

SHA1
eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

SHA256
7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

SHA512
15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

Filesize
1.0MB

MD5
d62a4279ebba19c9bf0037d4f7cbf0bc

SHA1
5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

SHA256
c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

SHA512
6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

Download Submit
\Program Files\Highresolution Enterprises\X-Mouse Button Control\uninstaller.exe

Filesize
74KB

MD5
bfffc38fff05079b15a5317e279dc7a9

SHA1
0c18db954f11646d65d0300e58fefcd9ff7634de

SHA256
c4e59737ffd988ef4bc7a62e3316a470b1b09a9889f65908110fba3d7b1c6500

SHA512
d30220e024ac242285ea757006e7da3874e5f889951de226d48c372a6a8701b76d4a917134ecc1e72c6c3a8d43444762288e7134a25d837e9f43d972675c81d6

Download Submit
\Users\Admin\AppData\Local\Temp\nstA6AD.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nstA6AD.tmp\ShellExecAsUser.dll

Filesize
7KB

MD5
86a81b9ab7de83aa01024593a03d1872

SHA1
8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

SHA256
27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

SHA512
cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

Download Submit
\Users\Admin\AppData\Local\Temp\nstA6AD.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nstA6AD.tmp\nsDialogs.dll

Filesize
9KB

MD5
f832e4279c8ff9029b94027803e10e1b

SHA1
134ff09f9c70999da35e73f57b70522dc817e681

SHA256
4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

SHA512
bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

Download Submit
memory/1924-232-0x00000000029D0000-0x00000000029D2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads