Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    97s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/01/2025, 23:32

General

  • Target

    XMouseButtonControlSetup.2.20.5.exe

  • Size

    2.9MB

  • MD5

    2e9725bc1d71ad1b8006dfc5a2510f88

  • SHA1

    6e1f7d12881696944bf5e030a7d131b969de0c6c

  • SHA256

    2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

  • SHA512

    62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39

  • SSDEEP

    49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies registry class 34 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
    "C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    PID:1788
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.highrez.co.uk/scripts/postinstall.asp?package=XMouse&major=2&minor=20&build=5&revision=0&platform=x64
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff79c43cb8,0x7fff79c43cc8,0x7fff79c43cd8
      2⤵
        PID:2032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,16604906678150984882,5124632782135538532,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
        2⤵
          PID:3052
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,16604906678150984882,5124632782135538532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1100
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,16604906678150984882,5124632782135538532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
          2⤵
            PID:2376
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16604906678150984882,5124632782135538532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
            2⤵
              PID:3344
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16604906678150984882,5124632782135538532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
              2⤵
                PID:3404
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16604906678150984882,5124632782135538532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                2⤵
                  PID:3328
              • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
                "C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe" /Installed /notportable
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2292
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:3912
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:2188
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:3424

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\BugTrapU-x64.dll

                    Filesize

                    364KB

                    MD5

                    80d5f32b3fc515402b9e1fe958dedf81

                    SHA1

                    a80ffd7907e0de2ee4e13c592b888fe00551b7e0

                    SHA256

                    0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a

                    SHA512

                    1589246cd480326ca22c2acb1129a3a90edf13b75031343061f0f4ed51580dfb890862162a65957be9026381bb24475fec6ddcb86692c5961a24b18461e5f1f0

                  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe

                    Filesize

                    1.7MB

                    MD5

                    bb632bc4c4414303c783a0153f6609f7

                    SHA1

                    eb16bf0d8ce0af4d72dff415741fd0d7aac3020e

                    SHA256

                    7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8

                    SHA512

                    15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5

                  • C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonHook.dll

                    Filesize

                    1.0MB

                    MD5

                    d62a4279ebba19c9bf0037d4f7cbf0bc

                    SHA1

                    5257d9505cca6b75fe55dfdaf2ea83a7d2d28170

                    SHA256

                    c845e808dc035329a7c95c846413a7afb9976f09872ba3c05dfa5f492156eef0

                    SHA512

                    6895a12cddc41bf516279b1235fca238b0b3b0cef2cc25abe14a9160ed23f5bde3d476f885d674537febc7de7eb58b0824d96153c626e1563a5a8a1887fb5323

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15d82b5f-695c-4324-94ee-b19fd7aa184f.tmp

                    Filesize

                    10KB

                    MD5

                    db56b4fb73e82d52a234e37db4a9ce02

                    SHA1

                    20285d305d688336c0012f4a2569d500ba46934e

                    SHA256

                    b67f3f489dbfac699db8dd3f2c8d238da229c0ae194b7c1f7d9e3797a478c0c0

                    SHA512

                    19652bfeffbccc18194d4eea0c409b5a33824f575d7d4f3c9995eab92abf20208b01e54e41d7502fd77503629d77b218670800946f06436e56c29563f452001b

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    7bed1eca5620a49f52232fd55246d09a

                    SHA1

                    e429d9d401099a1917a6fb31ab2cf65fcee22030

                    SHA256

                    49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

                    SHA512

                    afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    5431d6602455a6db6e087223dd47f600

                    SHA1

                    27255756dfecd4e0afe4f1185e7708a3d07dea6e

                    SHA256

                    7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

                    SHA512

                    868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                    Filesize

                    168B

                    MD5

                    e8626176ad0510548f00a4d0e91742ad

                    SHA1

                    94358afafd77d2347ca4d6e49216f131aa972982

                    SHA256

                    60229318a2be462ccc47cd855e9b2d3f5cf8b63266bd40852e633f138d90c79a

                    SHA512

                    3dffc7d719daf55ce142d8ba6230ad343f6c1a2c4a7d8abdb5d7a739573e702d6b5ccab31bbc6266761161e9288508396e0a8358331c90b13cf22145d5ad2238

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                    Filesize

                    1KB

                    MD5

                    72bb4c5ed9362fadc21f2d9ee17860fe

                    SHA1

                    e2af2506ea37bab8921fc225570c7defceba0d39

                    SHA256

                    458723f9e8568a4825d51052cfde599d120d79cd88251fb152251d1afc861bdf

                    SHA512

                    080bfce0dcdc0ed50610599a1f2d9ce86c614ce231defe7084adffb6d3780de5723a17f294fdef386a9f492875ec34b885564d5174c3ff552fdb671ff75d6bb2

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    5KB

                    MD5

                    3b12f7888c20053c6f24dbeaf23ee0b6

                    SHA1

                    13f7411286f47ae568f311257c623c1f4e9fd011

                    SHA256

                    7f72f78c078ffa45c2e90627a425ac02a92a386d2babaddab9a4daca93c35382

                    SHA512

                    14996c5fe05bff2d9ff47ae9f23725f1f1ebcca814691e6867f44a23033da6aaa9008cd35b07dd1e888d0a5dbb61f1c1e844763efafff316d387922691e131a3

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    6KB

                    MD5

                    cffef6d657ca9632394e97d5a1f3c034

                    SHA1

                    200d0f72eb05a3d9dff0c57553740a13e8d3debe

                    SHA256

                    349c6244948aa0c0f3cf8f22f864774bbaec9b5e03f8e5f0b98022799f30cd9c

                    SHA512

                    a7005117e691228c1deb9f98d9e221feaac522bd61ae6d5b4dc0462e39c4ec1fff891cbfc3f8d40b3b22671f16f65f32a3df786b2a65d0d38079b80d34545097

                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                    Filesize

                    11KB

                    MD5

                    92095a4d40ee48858f6117e28e215d2a

                    SHA1

                    9262b2efec32d1b4c060943bf1d169d0598d0f13

                    SHA256

                    966e56578bc85b432463ee92d318ec0d134b8a2d3255e57d7b743c8d2abe3555

                    SHA512

                    276fb9fa249d2979971cd4b5e05194b92b9ba87fb52062bd4abb54f81edad91f177ed4a16134d2319891b499194bfc2baae4875632d66d25a8b6c272c8e61d5f

                  • C:\Users\Admin\AppData\Local\Temp\nsf9433.tmp\InstallOptions.dll

                    Filesize

                    14KB

                    MD5

                    d753362649aecd60ff434adf171a4e7f

                    SHA1

                    3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                    SHA256

                    8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                    SHA512

                    41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                  • C:\Users\Admin\AppData\Local\Temp\nsf9433.tmp\ShellExecAsUser.dll

                    Filesize

                    7KB

                    MD5

                    86a81b9ab7de83aa01024593a03d1872

                    SHA1

                    8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be

                    SHA256

                    27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115

                    SHA512

                    cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac

                  • C:\Users\Admin\AppData\Local\Temp\nsf9433.tmp\System.dll

                    Filesize

                    10KB

                    MD5

                    56a321bd011112ec5d8a32b2f6fd3231

                    SHA1

                    df20e3a35a1636de64df5290ae5e4e7572447f78

                    SHA256

                    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                    SHA512

                    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

                  • C:\Users\Admin\AppData\Local\Temp\nsf9433.tmp\ioSpecial.ini

                    Filesize

                    709B

                    MD5

                    6a116434f871b8babf11053d3e37d53f

                    SHA1

                    ae174ecfe427ebfd2c7caf5a954acfea4f81e20b

                    SHA256

                    bf2a32cc2328bd0464c21f322c9571ff3de6e2aeb40990d5dde01cf737c9b1ec

                    SHA512

                    92e4284c929f65dc3faeb0fda91ed5d804729350bc390a9249376bc07d5a1ae9ae1462e3379facfd1926ad3499bdc0c2e57b81d0c5845156928d1aac19ed69da

                  • C:\Users\Admin\AppData\Local\Temp\nsf9433.tmp\ioSpecial.ini

                    Filesize

                    726B

                    MD5

                    e9b8ee83c7bd1f17f084cc187cf6946a

                    SHA1

                    d50b025577589530d621a79cc0ee82883e770344

                    SHA256

                    23364f1eeb42a8bbb373e02b57fa6a3626903de49f21116239705c3afea58f02

                    SHA512

                    bcfda14eed0ccf93ccb568b93b77a31860faf78455b6cd6ca0e5783c7386cdf8be3cdda68a1f77df354b27a3fa9efbf3471af2878e14b3bd49f6fc1b12816dc2

                  • C:\Users\Admin\AppData\Local\Temp\nsf9433.tmp\nsDialogs.dll

                    Filesize

                    9KB

                    MD5

                    f832e4279c8ff9029b94027803e10e1b

                    SHA1

                    134ff09f9c70999da35e73f57b70522dc817e681

                    SHA256

                    4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

                    SHA512

                    bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d