d92b0f5c4ae6153b80125ea05522fbb815b9c63115e516970532917348c494a0

General

Target
jaffacakes118_Everything-1.5.0.1393a.x86-Setup.exe
Size 1.5MB
Sample260910-d5klaawcrc
SHA256 d92b0f5c4ae6153b80125ea05522fbb815b9c63115e516970532917348c494a0
MD5 f081bc7e8b0b00ad398b28205e7a701b
SHA1 849d5d3f5802f8b13640d5fe50c799e4f5098adc
SHA512 ef47bf4969489dd1930858ce466d0391852d271ce4ee8c769e66bdc3e78c4dbab0d050b6c0e2764ec275673caa6de68576e4c8440931de59e9b2e9c5f23f9947
SSDEEP 24576:NQavrHy33jZWWVGBC4DLTlcD1r7jgyiZ0o3UQORcqQIc06322m5aoDUCkVBDcUVx:yi78eJDHG1XUSOJqQIcADkrUulyl0EHm
TLSH
T1D67533498771A5A1E9E2287CD413620E3DE62EE6A7453CDB77337C5EBD30BC36822245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Everything 1.5a = "\"C:\\Program Files (x86)\\Everything 1.5a\\Everything.exe\" -startup"	Everything.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\D:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Everything 1.5a\Everything.exe	Everything.exe
File created	C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini.tmp	Everything.exe
File created	C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini.tmp	Everything.exe

Executes dropped EXE 6 IoCs

pid	Process
4856	Everything.exe
1812	Everything.exe
364	Everything.exe
5912	Everything.exe
3968	Everything.exe
2996	Everything.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Everything-1.5.0.1393a.x86-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1812	Everything.exe
1812	Everything.exe
1812	Everything.exe
1812	Everything.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	Everything.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3968	Everything.exe
3968	Everything.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3968	Everything.exe
3968	Everything.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4856	Everything.exe
4856	Everything.exe
1812	Everything.exe
1812	Everything.exe
364	Everything.exe
364	Everything.exe
5912	Everything.exe
5912	Everything.exe
3968	Everything.exe
3968	Everything.exe
2996	Everything.exe
2996	Everything.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4856	1728	jaffacakes118_Everything-1.5.0.1393a.x86-Setup.exe	89
PID 4856 wrote to memory of 1812	4856	Everything.exe	90
PID 1812 wrote to memory of 364	1812	Everything.exe	91
PID 4856 wrote to memory of 5912	4856	Everything.exe	93
PID 4856 wrote to memory of 2996	4856	Everything.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1393a.x86-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1393a.x86-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\esp5B55.tmp\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\esp5B55.tmp\Everything.exe" -setup
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\esp5B55.tmp\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\esp5B55.tmp\Everything.exe" -install "C:\Program Files (x86)\Everything 1.5a" -install-options " -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Program Files (x86)\Everything 1.5a\Everything.exe
      "C:\Program Files (x86)\Everything 1.5a\Everything.exe" -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:364
- - C:\Program Files (x86)\Everything 1.5a\Everything.exe
    "C:\Program Files (x86)\Everything 1.5a\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5912
- - C:\Program Files (x86)\Everything 1.5a\Everything.exe
    "C:\Program Files (x86)\Everything 1.5a\Everything.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2996

C:\Program Files (x86)\Everything 1.5a\Everything.exe
"C:\Program Files (x86)\Everything 1.5a\Everything.exe" -startup
1⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Everything-1.5a.ini

Path C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini
Size 108KB
SHA256 eed45fcbbf1bca40b16e07471cfd0575e4a84c8f4567363e0af33e4483a6de17
MD5 72f9e34b98bb759f8cfbb15acc49f5a9
SHA1 32564fecaa5584f77564f8bac66ca8230a74ce41
SHA512 a1db16f768a43e9ec2b3667242ca220918fed546e67f9a42c640d8d94343473f086131673511ce1ae653de6c886449f8ee303d2f18fce9d1ad2e82eaceceabc9
SSDEEP 1536:/AT1fdRQJB91+3mCeXqMrkX5Xy1Xz63m/T77iJlFp:/q1fdRk+v5i1X4m/T77iJlFp
TLSH
T1CAB35F67BE3144EB55BB6426B8F6B91D03C6DB50476226C07B6CF4A60F42B93DA3306C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything 1.5a.lnk
Size 1KB
SHA256 a7593e5bd6bc38345a031425a2177138f9b950316643d3610975913adad1a4db
MD5 bf56ae882fea0a991f50011a38a08dbf
SHA1 05e7fa758bb1121f2236c60ef33232f5066622dc
SHA512 a16499834a74ea0b01a6fd953bb60ccfd40c33048ac3bb6055a9fd50145b33d487d8942d56a11e62664896b37a7813f991136e977df320b89b869c3e91345c27
TLSH
T1C02192114BD2473AF3D2853365F15A564613FC42E1A48F6E00D683481C77117AD58EAD
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\esp5B55.tmp\Everything.exe
Size 4.6MB
SHA256 aaa30e7e725997f494200b5625b2c6a353f773e519ae8fcbb06abb2774d6d77b
MD5 2528eaf77398bb6e552c282907ea408d
SHA1 07d1c8fe7451b25526be811923b09e3dd87735ef
SHA512 098ec650e45c6915eb9e1832c4a88de1358dd93bca6d5920e3fafaa8592d76750e722bfc21230c1d64fc475180ba1da796d49eeb99227ae6520dbf71cbbe31dd
SSDEEP 49152:Pg2qWVCz3jchQd3BVh5SJLRBffOpMu2hTfh581kIL3tdOJwL:PgfWOjmQbvIRrf6t
TLSH
T12E26BF51EBC740F5ED836572A13B3B17993D9708833195DBEB902DA19D213E3A87E283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\Users\Public\Desktop\Everything 1.5a.lnk
Size 1KB
SHA256 8ac4f1fbbc13cbbdad0a740c3097aa41aa8f7cef604a06c6226d42cfd77286dc
MD5 3266774efb19698f34dce0238b28eb77
SHA1 e62771caebfa514b5f6ecaa0b3985df4ce34ff0f
SHA512 cecef823bbd47903e550452ba201c2c3cec0b81c80c1a3d6aca075e84297de3714e7fc6e920760f2b5957019fe4d8ecf3b7232ee775a52bf46f257cd38288007
TLSH
T18221B1114BD3463AF2E28537A5F19A574A12FC42D2A88F7F00D6C3481D73117AE98EED
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads