Analysis
-
max time kernel
126s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-02-2024 19:12
General
-
Target
$PLUGINSDIR/Everything/Everything.exe
-
Size
2.2MB
-
MD5
0170601e27117e9639851a969240b959
-
SHA1
7a4aee1910b84c6715c465277229740dfc73fa39
-
SHA256
35cefe4bc4a98ad73dda4444c700aac9f749efde8f9de6a643a57a5b605bd4e7
-
SHA512
3c24fa02621b78c5ddaf1ad9523045e9fa7ccc02d85a0342e8faafc31be2a3154558d3cefcd9ae8721973fb01450ab36e6bb75a1b95fcc485a4b919f20a2202f
-
SSDEEP
49152:GQdoNDZW77g1h0lv3o4MyTW+sWxXigRRlmrK:GQf75A4P9Fo+
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵