Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 14:20
General
- Target Everything 1.5.0.1418b/Everything 1.5.0.1418b_x64.exe
- Size 1.7MB
- Sample260727-rnf4esvbla
- SHA256 5ea2d6c9ec8807d5b79c49b35cbc76f57814852e2dc3a0fa53a157af87e3540d
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Everything 1.5.0.1418b\Everything 1.5.0.1418b_x64.exe"C:\Users\Admin\AppData\Local\Temp\Everything 1.5.0.1418b\Everything 1.5.0.1418b_x64.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Everything 1.5.0.1418b\Everything 1.5.0.1418b_x64.exe"C:\Users\Admin\AppData\Local\Temp\Everything 1.5.0.1418b\Everything 1.5.0.1418b_x64.exe" -sfxwaitall:0 "Everything\Everything.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything\Everything.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything\Everything.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Everything.db
Everything.exe
Everything.ini
Everything.lng
memory/3284-0-0x0000000140000000-0x0000000140031000-memory.dmp