351cfdf1916444b9a975254f900ed2b6c502c2c5cb7b7b5576eedfaa496a986c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-08-2023 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Everything.exe
Size

1.7MB
MD5

c44487ce1827ce26ac4699432d15b42a
SHA1

8434080fad778057a50607364fee8b481f0feef8
SHA256

4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512

a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
SSDEEP

49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2548	Everything.exe

C:\Users\Admin\AppData\Local\Temp\Everything.exe
"C:\Users\Admin\AppData\Local\Temp\Everything.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads