79447a25a593adcbdc451b6c8c82970c509d8988f516427e6a26f44f21df89bb

General

Target
jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe
Size 1.6MB
Sample260910-eefp3ser3w
SHA256 79447a25a593adcbdc451b6c8c82970c509d8988f516427e6a26f44f21df89bb
MD5 f01cf0cc03db6a66402d56a05b9114fb
SHA1 ec3b2529d4de8ef58c5027094722d0a54986cf6b
SHA512 4f348120629a1b90eeac34341a351781d1765008e91cc3874f8591ac38b6161380947a015cbbd2d40ec381dfc3b1f404b0eca27c5c51c1edae90f7462cbffa4c
SSDEEP 24576:pQbV+O8zu28OqxVYttfdodKp4WpI8+rkh5xeI5a/aGf+vJXP24EaOrUFDQQLskJK:GUOgMYDSMpnxeI5a/bfgJe4EBglfsfb
TLSH
T14E7523CAE7E121D9E944307DC02737687D906E05679982C396363C5FBEB42D3DEB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Everything 1.5a = "\"C:\\Program Files (x86)\\Everything 1.5a\\Everything.exe\" -startup"	Everything.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\D:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Everything 1.5a\Everything.exe	Everything.exe
File created	C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini.tmp	Everything.exe
File created	C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini.tmp	Everything.exe

Executes dropped EXE 6 IoCs

pid	Process
3272	Everything.exe
4932	Everything.exe
4164	Everything.exe
1336	Everything.exe
468	Everything.exe
3956	Everything.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4932	Everything.exe
4932	Everything.exe
4932	Everything.exe
4932	Everything.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	Everything.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
468	Everything.exe
468	Everything.exe
468	Everything.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
468	Everything.exe
468	Everything.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3272	Everything.exe
3272	Everything.exe
4932	Everything.exe
4932	Everything.exe
4164	Everything.exe
4164	Everything.exe
1336	Everything.exe
1336	Everything.exe
468	Everything.exe
468	Everything.exe
3956	Everything.exe
3956	Everything.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3272	1936	jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe	89
PID 3272 wrote to memory of 4932	3272	Everything.exe	90
PID 4932 wrote to memory of 4164	4932	Everything.exe	91
PID 3272 wrote to memory of 1336	3272	Everything.exe	92
PID 3272 wrote to memory of 3956	3272	Everything.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1396a.x86-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\esr136F.tmp\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\esr136F.tmp\Everything.exe" -setup
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Users\Admin\AppData\Local\Temp\esr136F.tmp\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\esr136F.tmp\Everything.exe" -install "C:\Program Files (x86)\Everything 1.5a" -install-options " -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Program Files (x86)\Everything 1.5a\Everything.exe
      "C:\Program Files (x86)\Everything 1.5a\Everything.exe" -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4164
- - C:\Program Files (x86)\Everything 1.5a\Everything.exe
    "C:\Program Files (x86)\Everything 1.5a\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1336
- - C:\Program Files (x86)\Everything 1.5a\Everything.exe
    "C:\Program Files (x86)\Everything 1.5a\Everything.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3956

C:\Program Files (x86)\Everything 1.5a\Everything.exe
"C:\Program Files (x86)\Everything 1.5a\Everything.exe" -startup
1⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Everything-1.5a.ini

Path C:\Program Files (x86)\Everything 1.5a\Everything-1.5a.ini
Size 108KB
SHA256 41b2bad41679c569bee569be3357e34b596b48ff1aaea3337c9df9d8781ee91f
MD5 4a3c7c6495c2373b26c1461d5cca6c53
SHA1 7748269a08e8a988ab064998f07ebef39dae66ed
SHA512 afcbba030ef7dd492ef3cd7f2067547cbb94552baa5f422447ec2192640828b91a27de0d517313bc57dc116a339119976e6913ddc81d689eb1788b10644a6737
SSDEEP 1536:/AT1fSRQJB9A+3mCeXqMrkX5Xy1Xz63m/T77iJlFp:/q1fSRR+v5i1X4m/T77iJlFp
TLSH
T153B35F67BE3144EB55BB6426B8F6B91D03C6DB50476226C07B6CF4A60F42B93DA3306C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything 1.5a.lnk
Size 1KB
SHA256 42d5af0e37b6a2381aafd210e2320ae2f1bbdca900779bcdb10a6b7149778710
MD5 ed45c0199e4da4099d32768ebee8bcc0
SHA1 ac8e9557e37eee99f1d152db51f38f4d21a09a2d
SHA512 16a41e564fec72d6a261f32d7dacafa72e7f25b23f785a263d43c52fa7b5510ae4f5a708d7d0d4b4c993ade83e24cc54f879d134da6615207bddd051d7f9545c
TLSH
T1D721CE040BDB4F2AF2D2C23599B25602D632F842E2789F2E04CB83494872012BCDCFED
MD5 SHA1 SHA512 TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\esr136F.tmp\Everything.exe
Size 4.6MB
SHA256 f99f56b8191aae5116a020465fc3f4e5cddf348847719cc9eae821a606307016
MD5 ae8ea842639c39818934aad1c420f1b3
SHA1 8b60695121dbb3632f821ac7623eac75543ab0bb
SHA512 a5b4068751e6037d66b60066dad96f6b13baf58cbda1f401a43bda01ace2dbe7fa9bac690fc942c3f1f4c69410cc39c6eeb9d732c1b0c0e2bbd8b075d9187ad9
SSDEEP 49152:ifW68uBK7Ou0uMIM8N4qc+JfVtysSP5+jXlocQWVJ2X5T9CzNFDjJQA/ETanIYIS:iO68uRuPrMUlc2Vl05+jXlocQm6nYX
TLSH
T197269D41FBC701F5ED826471617B37179D3A96294323D9DBFBA03E609C213E2687E286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything 1.5a.lnk

Path C:\Users\Public\Desktop\Everything 1.5a.lnk
Size 1KB
SHA256 39f008142a8e42261c738216ec46151d60d7894bfedd1d6e6796b27edc78211a
MD5 af626fb9201d86d0f468ced3a05b13ae
SHA1 5d8d8ceda3ce2a8b79f2fb7ef67d68850f288afb
SHA512 84bde8e63b5b8202d289f34174632ebdb57533d0ee009d99268f7dcbcc79fa6d3d871f28814d5d0cbcec65077fe1cfa70a9e244384a6652415aab8ce13fe4bcb
TLSH
T13D21BD040BEB4B2AF2D2C23599B25606D722F942D6688F2E45CB83495872112BDDCFFD
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads