08712d7f9e87cb8181664b58471ab4addde4396566acc15b57b6c7de24a0425a

General

Target
jaffacakes118_Everything-1.5.0.1391a.x64-Setup.exe
Size 1.7MB
Sample260910-eb4bzayvfs
SHA256 08712d7f9e87cb8181664b58471ab4addde4396566acc15b57b6c7de24a0425a
MD5 53403d08a415000383c3b04d00ad6609
SHA1 b8d5ebbd275a7632a2ca714ad920ba9f24c49b1a
SHA512 211a5c32599e4e1b38d2132ec9b468f2abd512eb842c162716defe30a5f94f162e1f79de8f7ed7ad4a578b4ecc0f9eb01785d0e714ec053baaa3588d4d187029
SSDEEP 49152:nB8SJEjuZJAkQhFC6rXx2NmPZM62rnhuwwt0vRiR:kiZDuXoYBMDhvwt0vu
TLSH
T188853301C5298491C027C13CD987765F8EA5BC0D47A4228B97373CBD7C337A69B9EE91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Everything 1.5a = "\"C:\\Program Files\\Everything 1.5a\\Everything64.exe\" -startup"	Everything64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Everything64.exe
File opened (read-only)	\??\B:	Everything64.exe
File opened (read-only)	\??\H:	Everything64.exe
File opened (read-only)	\??\K:	Everything64.exe
File opened (read-only)	\??\R:	Everything64.exe
File opened (read-only)	\??\U:	Everything64.exe
File opened (read-only)	\??\X:	Everything64.exe
File opened (read-only)	\??\Z:	Everything64.exe
File opened (read-only)	\??\I:	Everything64.exe
File opened (read-only)	\??\N:	Everything64.exe
File opened (read-only)	\??\S:	Everything64.exe
File opened (read-only)	\??\W:	Everything64.exe
File opened (read-only)	\??\G:	Everything64.exe
File opened (read-only)	\??\T:	Everything64.exe
File opened (read-only)	\??\V:	Everything64.exe
File opened (read-only)	\??\D:	Everything64.exe
File opened (read-only)	\??\J:	Everything64.exe
File opened (read-only)	\??\L:	Everything64.exe
File opened (read-only)	\??\M:	Everything64.exe
File opened (read-only)	\??\O:	Everything64.exe
File opened (read-only)	\??\P:	Everything64.exe
File opened (read-only)	\??\Q:	Everything64.exe
File opened (read-only)	\??\Y:	Everything64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Everything 1.5a\Everything64.exe	Everything64.exe
File created	C:\Program Files\Everything 1.5a\Everything-1.5a.ini.tmp	Everything64.exe
File created	C:\Program Files\Everything 1.5a\Everything-1.5a.ini.tmp	Everything64.exe

Executes dropped EXE 6 IoCs

pid	Process
3852	Everything64.exe
1504	Everything64.exe
4988	Everything64.exe
1892	Everything64.exe
4932	Everything64.exe
2168	Everything64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1504	Everything64.exe
1504	Everything64.exe
1504	Everything64.exe
1504	Everything64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	Everything64.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4932	Everything64.exe
4932	Everything64.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4932	Everything64.exe
4932	Everything64.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3852	Everything64.exe
3852	Everything64.exe
1504	Everything64.exe
1504	Everything64.exe
4988	Everything64.exe
4988	Everything64.exe
1892	Everything64.exe
1892	Everything64.exe
4932	Everything64.exe
4932	Everything64.exe
2168	Everything64.exe
2168	Everything64.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3852	1104	jaffacakes118_Everything-1.5.0.1391a.x64-Setup.exe	89
PID 3852 wrote to memory of 1504	3852	Everything64.exe	90
PID 1504 wrote to memory of 4988	1504	Everything64.exe	91
PID 3852 wrote to memory of 1892	3852	Everything64.exe	92
PID 3852 wrote to memory of 2168	3852	Everything64.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1391a.x64-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1391a.x64-Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\est7267.tmp\Everything64.exe
  "C:\Users\Admin\AppData\Local\Temp\est7267.tmp\Everything64.exe" -setup
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Users\Admin\AppData\Local\Temp\est7267.tmp\Everything64.exe
    "C:\Users\Admin\AppData\Local\Temp\est7267.tmp\Everything64.exe" -install "C:\Program Files\Everything 1.5a" -install-options " -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Program Files\Everything 1.5a\Everything64.exe
      "C:\Program Files\Everything 1.5a\Everything64.exe" -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4988
- - C:\Program Files\Everything 1.5a\Everything64.exe
    "C:\Program Files\Everything 1.5a\Everything64.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1892
- - C:\Program Files\Everything 1.5a\Everything64.exe
    "C:\Program Files\Everything 1.5a\Everything64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2168

C:\Program Files\Everything 1.5a\Everything64.exe
"C:\Program Files\Everything 1.5a\Everything64.exe" -startup
1⤵
- Enumerates connected drives
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Everything-1.5a.ini

Path C:\Program Files\Everything 1.5a\Everything-1.5a.ini
Size 108KB
SHA256 c49427f3ceff6897a87e534f33c99245b0a2e19f06e6c9d9158ccf9b093172b3
MD5 0e69c517ce67348f5240ff1c85e400b8
SHA1 9dce4c126a2f4a5446c3dcab8392a0ac712c93cb
SHA512 413b1b640afd4b5ff344119f6074e8aabe7722334b73dfdb838d8aa4a0599cdf5e3149b95c7bbc2c7baf8ba407d71eec00758d50f3c55108faabe3df813614d2
SSDEEP 1536:/NT1fdRQJB9C+3mCeXqMrIX5Xy1Xz6km/T77iJlFp:/51fdRj+F5i1X/m/T77iJlFp
TLSH
T1A5B35F27BE3144EB55BB6426B8F6B91D03C6DB50576226C07B6CF4A60F42B93DA3306C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything 1.5a.lnk
Size 1KB
SHA256 23a8603fc26f8ac5bac0fad7445a0f419572e31c80912babce4fa86e65ca799e
MD5 d545620434c1d3f0e3bad1dea7be41fa
SHA1 33814f4f032df21b27cb4f4b803d16c199a1fa14
SHA512 f0c5435d55fe26a0b403907cfb6bf9f1dc1f06d39ff2fa6d0f4f00d69daf3129fe88ffe86e9551e1212acd0a07820ab1f24b8a225366ca67ade660dd7bc54482
TLSH
T17D21BD0503861B2AF6E783326A7266308722FC42E7E98F2E84C6938418B11519D94FE9
MD5 SHA1 SHA512 TLSH

Submit Download

Everything64.exe

Path C:\Users\Admin\AppData\Local\Temp\est7267.tmp\Everything64.exe
Size 5.4MB
SHA256 bdacc22ca03f5cee95fd8d3abf2bda3b5206b6b5ec086234a01cb562b21e58df
MD5 e5313a04ea223a63ec847aeeb95ac3fa
SHA1 0e5916a608ad2cef9eccf4c4664383ffa84ed82c
SHA512 eae8d8c7584d20000687b628e2de704c5f22d318a9fa3204dae3c58a76fd2b13cc2538cd0a05afabd3d1ee1dee454aa05bf25b2a37e61b5b8f038cad05dfcc30
SSDEEP 98304:sSTdTKuS4ne1uv8cFr/NWYrba+9gKHhKHuuOjH6lB5ppk9oKmLqDGsDTnF:sSTrSf1uv8cDWYrba+9gKHhNuOjH6z5g
TLSH
T110467C53E3B500ECD87BC039CA565623DBB1B45847329BDF66608B612F637E15A3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\Users\Public\Desktop\Everything 1.5a.lnk
Size 1KB
SHA256 1958d856d3c0334c44878171ff3d3e9794e17ae142a87a84cfdfffad537dd301
MD5 610fc5872f2ed3037fe93c49f2efe2a6
SHA1 2501a2dbe94811f0ebfcad3d629a6f8a10ceea18
SHA512 39cf7ffb18560c681940e94c17236d6862e4574ceeec90d40c23296ef467da8a05d8525586ca767b0a2dd5726767c96c97f634d9e21ccf4ca72ee7e93093701b
TLSH
T14B21D00503860B2AF6E783366E736A208711FC42E7A98F2E84C7A38458B11519DD4FED
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads