Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
28/09/2024, 18:13
General
-
Target
$PLUGINSDIR/Everything/Everything.exe
-
Size
1.7MB
-
MD5
c665fa0aa5afa3fb41c21afe5884b4f1
-
SHA1
c79bddbea392247a4e88221f53c0e2e30368b614
-
SHA256
fb653fd840b0399cea31986b49b5ceadd28fb739dd2403a8bb05051eea5e5bbc
-
SHA512
743328d688e21f1e19605e82f1abe1b451a4812108fba7b3838b63404f9dd53a693839006cc5176dd070ab5f43de94fa9cdec47805a7e36b01042c9f6c9e4b7f
-
SSDEEP
49152:Qhua8pOpRzsOV9bzmkSMDgOPIOY9ayV9PxCr5:QhudpMHys9
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx