Analysis
-
max time kernel
104s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
16/02/2023, 21:43
General
-
Target
EveryonePiano2.1.5.29_setup.exe
-
Size
5.5MB
-
MD5
aada3e22e8a48bf5a69e8bb31dcf9553
-
SHA1
5cb5330b66aeea600b055a57e51fdf1de01edac1
-
SHA256
42ffdf8098897e4c6eb30bd3b66696d20353fdf882eb2aab7575d17af049471c
-
SHA512
229e3b7b2f3355574289b1aa71279648fb8a56a0b370efa21ee91ea2bb23ce0125a5856efd63b40719f619b7615b29ee99c21f522c5e78f81904b7ee2efdee85
-
SSDEEP
98304:iutulTWTfATE1eLCNc8V/cgCzaqp0HZd4iEXxnETN827MvrqQBKUEyE779s2pqQ:bEWT3suNRGUqeHLwxnET2bzqcE7Js2ph
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 8 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 7 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EveryonePiano2.1.5.29_setup.exe"C:\Users\Admin\AppData\Local\Temp\EveryonePiano2.1.5.29_setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KT2IN.tmp\EveryonePiano2.1.5.29_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KT2IN.tmp\EveryonePiano2.1.5.29_setup.tmp" /SL5="$80122,5416816,66048,C:\Users\Admin\AppData\Local\Temp\EveryonePiano2.1.5.29_setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\EveryonePiano\EveryonePiano.exe"C:\Program Files (x86)\EveryonePiano\EveryonePiano.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x54c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD581fcbc4a1f722d92162184c492c32ca0
SHA1c54ca14dafd2d3ad9eed67bb39891c07ddddb2e8
SHA256f22c5c98d3e29c90ec21305b5ddaedd8cca8dc0a73d181d4c59082bb2a694182
SHA5126c22464a05fcff5dc05b31a02792638ae7c13bc92fcc09764cb69ad7282782e1fe98a80527fbcbd9cb662f6a5bb17c8469bd74905f83a25c3afca808c96d5149
-
Filesize
5.0MB
MD581fcbc4a1f722d92162184c492c32ca0
SHA1c54ca14dafd2d3ad9eed67bb39891c07ddddb2e8
SHA256f22c5c98d3e29c90ec21305b5ddaedd8cca8dc0a73d181d4c59082bb2a694182
SHA5126c22464a05fcff5dc05b31a02792638ae7c13bc92fcc09764cb69ad7282782e1fe98a80527fbcbd9cb662f6a5bb17c8469bd74905f83a25c3afca808c96d5149
-
Filesize
28KB
MD5c9fdb2f9957210bab2d02e15b7cd7b00
SHA1515673cf4008f8e65b7fc70e8504d93098b70958
SHA256cef63618274fb3e2010f841f7ded1e30bf5890d6162947ed675b5dcff5bbd140
SHA5127faf11fdcd5e08aee992abe3fc000b176bbd7f54957e07e2b3a994acd7576198d237b800bbd118ece0bd73d06a11116e0d3747ad2d6eff866d200de2c214fcc3
-
Filesize
1.5MB
MD58a4a66a96e48489b261e91d649f2bc8c
SHA126b0c824b0b8c710fad8e59fe781bd8499ae62b9
SHA256821d73a1629721d2d20b0d3a497b70da24cad6c94553be9cbe18db7eaa93c670
SHA512f9fed348f207377755520d7a121ec1240289aa611de31855474a1332ab432ca8d3ca00403614ae24d57390d3de24c3aaaa4e46cefbfc1c5d91730ce95ff5c3dc
-
Filesize
681KB
MD55ca8ae960cca54b8c2ce478bf4e63db8
SHA18409d79a25839e1c1074669885a34c48772f604f
SHA256efd44c917d341cf22639bf880b3cb6e3f416cf7b2e98464123e45e97bbeb7ae4
SHA5123fdd2dcabaef9cd625566ae540f2ecd3b13f8a90767c076450c875b7d757365f530bed06d152cd6ee5434d3b0ec198e3976c85f8f8bd4751a99c4f3a561cd117
-
Filesize
681KB
MD55ca8ae960cca54b8c2ce478bf4e63db8
SHA18409d79a25839e1c1074669885a34c48772f604f
SHA256efd44c917d341cf22639bf880b3cb6e3f416cf7b2e98464123e45e97bbeb7ae4
SHA5123fdd2dcabaef9cd625566ae540f2ecd3b13f8a90767c076450c875b7d757365f530bed06d152cd6ee5434d3b0ec198e3976c85f8f8bd4751a99c4f3a561cd117
-
Filesize
5.0MB
MD581fcbc4a1f722d92162184c492c32ca0
SHA1c54ca14dafd2d3ad9eed67bb39891c07ddddb2e8
SHA256f22c5c98d3e29c90ec21305b5ddaedd8cca8dc0a73d181d4c59082bb2a694182
SHA5126c22464a05fcff5dc05b31a02792638ae7c13bc92fcc09764cb69ad7282782e1fe98a80527fbcbd9cb662f6a5bb17c8469bd74905f83a25c3afca808c96d5149
-
Filesize
5.0MB
MD581fcbc4a1f722d92162184c492c32ca0
SHA1c54ca14dafd2d3ad9eed67bb39891c07ddddb2e8
SHA256f22c5c98d3e29c90ec21305b5ddaedd8cca8dc0a73d181d4c59082bb2a694182
SHA5126c22464a05fcff5dc05b31a02792638ae7c13bc92fcc09764cb69ad7282782e1fe98a80527fbcbd9cb662f6a5bb17c8469bd74905f83a25c3afca808c96d5149
-
Filesize
5.0MB
MD581fcbc4a1f722d92162184c492c32ca0
SHA1c54ca14dafd2d3ad9eed67bb39891c07ddddb2e8
SHA256f22c5c98d3e29c90ec21305b5ddaedd8cca8dc0a73d181d4c59082bb2a694182
SHA5126c22464a05fcff5dc05b31a02792638ae7c13bc92fcc09764cb69ad7282782e1fe98a80527fbcbd9cb662f6a5bb17c8469bd74905f83a25c3afca808c96d5149
-
Filesize
691KB
MD5142d32116f6f4959d854d97d5e150a0b
SHA1875a48a1d3c78428dcd7a5026da6f1d7cd94cd8e
SHA256c8d0179f32c813c7de7ab9a27aff65a5fc3ba08cc362173f3b41101ed3389f6c
SHA512952cae14db0fdf47cb7a6b45023a7a3b543353110dd37206ef3d28e48ba6282d582c12fb09767be76d6460eda1f867c93fc0c33aedaf8d97f998720101b3edbe
-
Filesize
1.5MB
MD58a4a66a96e48489b261e91d649f2bc8c
SHA126b0c824b0b8c710fad8e59fe781bd8499ae62b9
SHA256821d73a1629721d2d20b0d3a497b70da24cad6c94553be9cbe18db7eaa93c670
SHA512f9fed348f207377755520d7a121ec1240289aa611de31855474a1332ab432ca8d3ca00403614ae24d57390d3de24c3aaaa4e46cefbfc1c5d91730ce95ff5c3dc
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
681KB
MD55ca8ae960cca54b8c2ce478bf4e63db8
SHA18409d79a25839e1c1074669885a34c48772f604f
SHA256efd44c917d341cf22639bf880b3cb6e3f416cf7b2e98464123e45e97bbeb7ae4
SHA5123fdd2dcabaef9cd625566ae540f2ecd3b13f8a90767c076450c875b7d757365f530bed06d152cd6ee5434d3b0ec198e3976c85f8f8bd4751a99c4f3a561cd117
-
Filesize
8KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB