fc249baddd791772998825753f2ed6afb5cebab717f2017c5f8c78267173459e | Triage

Submit
Reports

Overview

overview

Static

static

samples.zip

windows7-x64

1

samples.zip

windows10-2004-x64

1

samples/$I30

windows7-x64

1

samples/$I30

windows10-2004-x64

1

samples/Everything.db

windows7-x64

3

samples/Everything.db

windows10-2004-x64

3

samples/Ev...eslack

windows7-x64

3

samples/Ev...eslack

windows10-2004-x64

3

samples/Ev...ng.exe

windows7-x64

6

samples/Ev...ng.exe

windows10-2004-x64

6

samples/Ev...ng.ini

windows7-x64

1

samples/Ev...ng.ini

windows10-2004-x64

1

samples/Ev...eslack

windows7-x64

3

samples/Ev...eslack

windows10-2004-x64

3

samples/Ev...32.dll

windows7-x64

3

samples/Ev...32.dll

windows10-2004-x64

3

samples/Ev...eslack

windows7-x64

3

samples/Ev...eslack

windows10-2004-x64

3

samples/Ev...g64.7z

windows7-x64

3

samples/Ev...g64.7z

windows10-2004-x64

3

samples/fr...ng.exe

windows7-x64

samples/fr...ng.exe

windows10-2004-x64

samples/session.tmp

windows7-x64

3

samples/session.tmp

windows10-2004-x64

3

Analysis

max time kernel
419s
max time network
1145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 14:34

Sharing

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

samples.zip

Resource

win7-20240903-en

windows7-x64

0 signatures

1200 seconds

Behavioral task

behavioral2

Sample

samples.zip

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

1200 seconds

Behavioral task

behavioral3

Sample

samples/$I30

Resource

win7-20240903-en

windows7-x64

0 signatures

1200 seconds

Behavioral task

behavioral4

Sample

samples/$I30

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

1200 seconds

Behavioral task

behavioral5

Sample

samples/Everything.db

Resource

win7-20240704-en

windows7-x64

1 signatures

1200 seconds

Behavioral task

behavioral6

Sample

samples/Everything.db

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

1200 seconds

Behavioral task

behavioral7

Sample

samples/Everything.db.fileslack

Resource

win7-20240903-en

windows7-x64

6 signatures

1200 seconds

Behavioral task

behavioral8

Sample

samples/Everything.db.fileslack

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

1200 seconds

Behavioral task

behavioral9

Sample

samples/Everything.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

1200 seconds

Behavioral task

behavioral10

Sample

samples/Everything.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

1200 seconds

Behavioral task

behavioral11

Sample

samples/Everything.ini

Resource

win7-20240903-en

windows7-x64

1 signatures

1200 seconds

Behavioral task

behavioral12

Sample

samples/Everything.ini

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

1200 seconds

Behavioral task

behavioral13

Sample

samples/Everything.ini.fileslack

Resource

win7-20240903-en

windows7-x64

6 signatures

1200 seconds

Behavioral task

behavioral14

Sample

samples/Everything.ini.fileslack

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

1200 seconds

Behavioral task

behavioral15

Sample

samples/Everything32.dll

Resource

win7-20240704-en

windows7-x64

2 signatures

1200 seconds

Behavioral task

behavioral16

Sample

samples/Everything32.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

2 signatures

1200 seconds

Behavioral task

behavioral17

Sample

samples/Everything32.dll.fileslack

Resource

win7-20240708-en

windows7-x64

6 signatures

1200 seconds

Behavioral task

behavioral18

Sample

samples/Everything32.dll.fileslack

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

1200 seconds

Behavioral task

behavioral19

Sample

samples/Everything64.7z

Resource

win7-20240903-en

windows7-x64

6 signatures

1200 seconds

Behavioral task

behavioral20

Sample

samples/Everything64.7z

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

1200 seconds

Behavioral task

behavioral21

Sample

samples/freeworldencrypting.exe

Resource

win7-20240903-en

mimic discovery evasion execution persistence ransomware trojan

windows7-x64

20 signatures

1200 seconds

Behavioral task

behavioral22

Sample

samples/freeworldencrypting.exe

Resource

win10v2004-20240802-en

mimic discovery evasion execution persistence ransomware trojan

windows10-2004-x64

31 signatures

1200 seconds

Behavioral task

behavioral23

Sample

samples/session.tmp

Resource

win7-20240903-en

windows7-x64

6 signatures

1200 seconds

Behavioral task

behavioral24

Sample

samples/session.tmp

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

1200 seconds

Report Analysis Logs

General

Target

samples/Everything.db
Size

27.1MB
MD5

29bbcfc4cf4da12cd403deeb806691cf
SHA1

4414c6fb81b3f3501934fe2c81db563b5dee5334
SHA256

9f323e6284dec51c09ffe8d2ade136b78c30e00a06783d4ca296e2fec3a49fab
SHA512

971265f344fd6ecefbbdc82fee8a22d7debf84c3132ac2a52bc542e96dfe2b70536f0c187a38bdff827a65fdb11e09a85136938744fdc721f9e0085e5f375487
SSDEEP

196608:VfTHWOmd+C8yFEH5pSlYrJ1O6GLsX2tARoxGwpAvr1:VfTHYAg6GLwSLx3Avx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Processes

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\samples\Everything.db
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy