Analysis
-
max time kernel
300s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-04-2024 13:35
General
-
Target
$PLUGINSDIR/Everything/Everything.exe
-
Size
2.1MB
-
MD5
35f0f0888d0d7b5b879d672910f20d9b
-
SHA1
4e32c69d50a178b4587b90265ba748dd854dec5d
-
SHA256
9ee15ecf32fcc4838a8369f5ee3d0c8d7dea4708526cbb158f3e5cb39f2f7b41
-
SHA512
8d3e61d0a270f7928d71e2ba18db282d42404da652eaef87e1918a68e7c5c3d9256b3ad8189e17e1a8ef289c45f58825bb37f77cc652f48695dc155d511248a1
-
SSDEEP
49152:6QwV6orrDVSr1g+Q8hnkqI/DlpJ2inRH0hNrp:6QeSpJ7+DLEhNl
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx