79447a25a593adcbdc451b6c8c82970c509d8988f516427e6a26f44f21df89bb

General

Target
jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe
Size 1.6MB
Sample260910-eefp3ser3w
SHA256 79447a25a593adcbdc451b6c8c82970c509d8988f516427e6a26f44f21df89bb
MD5 f01cf0cc03db6a66402d56a05b9114fb
SHA1 ec3b2529d4de8ef58c5027094722d0a54986cf6b
SHA512 4f348120629a1b90eeac34341a351781d1765008e91cc3874f8591ac38b6161380947a015cbbd2d40ec381dfc3b1f404b0eca27c5c51c1edae90f7462cbffa4c
SSDEEP 24576:pQbV+O8zu28OqxVYttfdodKp4WpI8+rkh5xeI5a/aGf+vJXP24EaOrUFDQQLskJK:GUOgMYDSMpnxeI5a/bfgJe4EBglfsfb
TLSH
T14E7523CAE7E121D9E944307DC02737687D906E05679982C396363C5FBEB42D3DEB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Everything 1.5a = "\"C:\\Program Files (x86)\\Everything 1.5a\\Everything.exe\" -startup"	Everything.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Everything 1.5a\Everything.exe	Everything.exe
File opened for modification	C:\Program Files (x86)\Everything 1.5a\Everything.exe	Everything.exe
File created	C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini.tmp	Everything.exe
File created	C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini.tmp	Everything.exe

Executes dropped EXE 6 IoCs

pid	Process
896	Everything.exe
1256	Everything.exe
1520	Everything.exe
2400	Everything.exe
4056	Everything.exe
1712	Everything.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1256	Everything.exe
1256	Everything.exe
1256	Everything.exe
1256	Everything.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	Everything.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4056	Everything.exe
4056	Everything.exe
4056	Everything.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4056	Everything.exe
4056	Everything.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
896	Everything.exe
896	Everything.exe
1256	Everything.exe
1256	Everything.exe
1520	Everything.exe
1520	Everything.exe
2400	Everything.exe
2400	Everything.exe
4056	Everything.exe
4056	Everything.exe
1712	Everything.exe
1712	Everything.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 896	3564	jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe	86
PID 896 wrote to memory of 1256	896	Everything.exe	89
PID 1256 wrote to memory of 1520	1256	Everything.exe	91
PID 896 wrote to memory of 2400	896	Everything.exe	94
PID 896 wrote to memory of 1712	896	Everything.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\esn588B.tmp\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\esn588B.tmp\Everything.exe" -setup
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\esn588B.tmp\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\esn588B.tmp\Everything.exe" -install "C:\Program Files (x86)\Everything 1.5a" -install-options " -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0"
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Program Files (x86)\Everything 1.5a\Everything.exe
      "C:\Program Files (x86)\Everything 1.5a\Everything.exe" -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1520
- - C:\Program Files (x86)\Everything 1.5a\Everything.exe
    "C:\Program Files (x86)\Everything 1.5a\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2400
- - C:\Program Files (x86)\Everything 1.5a\Everything.exe
    "C:\Program Files (x86)\Everything 1.5a\Everything.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1712

C:\Program Files (x86)\Everything 1.5a\Everything.exe
"C:\Program Files (x86)\Everything 1.5a\Everything.exe" -startup
1⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Everything-1.5a.ini

Path C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini
Size 108KB
SHA256 41b2bad41679c569bee569be3357e34b596b48ff1aaea3337c9df9d8781ee91f
MD5 4a3c7c6495c2373b26c1461d5cca6c53
SHA1 7748269a08e8a988ab064998f07ebef39dae66ed
SHA512 afcbba030ef7dd492ef3cd7f2067547cbb94552baa5f422447ec2192640828b91a27de0d517313bc57dc116a339119976e6913ddc81d689eb1788b10644a6737
SSDEEP 1536:/AT1fSRQJB9A+3mCeXqMrkX5Xy1Xz63m/T77iJlFp:/q1fSRR+v5i1X4m/T77iJlFp
TLSH
T153B35F67BE3144EB55BB6426B8F6B91D03C6DB50476226C07B6CF4A60F42B93DA3306C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything 1.5a.lnk
Size 1KB
SHA256 e0dd47bad2663ff5585c03594a64ec0c9b6bc3c8bdd5944552fe76ecc8dd7336
MD5 216306b111b21298251ab1ae01ee854e
SHA1 05e4db5a28684cc16c6416401bba2f96b1b0e284
SHA512 04f25f9e5d640397bb55eb7e331c557c62881ddcdf0829dded17b5f29d553208537684271fbe81f21be59881d87243b7640e5d992e85b17d696f76578400d768
TLSH
T1B921711517C70B3BF1E38631AAF21617DA32FD02E2A98F6E40C6438A54765125D9CFEE
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\esn588B.tmp\Everything.exe
Size 4.6MB
SHA256 f99f56b8191aae5116a020465fc3f4e5cddf348847719cc9eae821a606307016
MD5 ae8ea842639c39818934aad1c420f1b3
SHA1 8b60695121dbb3632f821ac7623eac75543ab0bb
SHA512 a5b4068751e6037d66b60066dad96f6b13baf58cbda1f401a43bda01ace2dbe7fa9bac690fc942c3f1f4c69410cc39c6eeb9d732c1b0c0e2bbd8b075d9187ad9
SSDEEP 49152:ifW68uBK7Ou0uMIM8N4qc+JfVtysSP5+jXlocQWVJ2X5T9CzNFDjJQA/ETanIYIS:iO68uRuPrMUlc2Vl05+jXlocQm6nYX
TLSH
T197269D41FBC701F5ED826471617B37179D3A96294323D9DBFBA03E609C213E2687E286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\Users\Public\Desktop\Everything 1.5a.lnk
Size 1KB
SHA256 76b0b38e037530898fdd5fa839d7c607f5f23cc02ff4ad132e8422be18356c4d
MD5 a478be4943d374a4abd454dcc8be2789
SHA1 38fc078eacefddd8c8c65411d65350a56be9362f
SHA512 2901d4896cee3853f2152f1ac66c09e6bd3a6a8924f4bb280d4eb1fbafa57e77bcfd1b4edcd284960f011c6bf53467151166b6a24783a3cbf156e90c39fa00f9
TLSH
T142213B1117DB0B2AF1E78635ADA21606DA22F90292A98F6E40C9434A54765126C9CFEE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads