Find similar analyses in TI Lookup

Analysis date (UTC): 18 July 2024, 03:52Analysis environment: Windows 10 Pro, build 19045, x64

Everything.exe

MD5:0170601E27117E9639851A969240B959

SHA1:7A4AEE1910B84C6715C465277229740DFC73FA39

SHA256:35CEFE4BC4A98AD73DDA4444C700AAC9F749EFDE8F9DE6A643A57A5B605BD4E7

Analysis result

Threat level:Malicious activity

Full analysis:Analysis Everything.exe (MD5: 0170601E27117E9639851A969240B959) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Everything.exe (PID: 3232)

Actions looks like stealing of personal data

Everything.exe (PID: 5340)

SUSPICIOUS

Reads security settings of Internet Explorer

Everything.exe (PID: 3232)
Everything.exe (PID: 5340)
iexplore.exe (PID: 752)
cookie_exporter.exe (PID: 6540)

Application launched itself

Everything.exe (PID: 3232)

Reads the date of Windows installation

Everything.exe (PID: 3232)
Everything.exe (PID: 5340)
iexplore.exe (PID: 752)

Changes internet zones settings

iexplore.exe (PID: 752)

INFO

Checks supported languages

Everything.exe (PID: 3232)
Everything.exe (PID: 3668)
Everything.exe (PID: 5340)
Everything.exe (PID: 2416)
iexplore.exe (PID: 752)
identity_helper.exe (PID: 6276)
cookie_exporter.exe (PID: 6540)
identity_helper.exe (PID: 6504)

Reads the computer name

Everything.exe (PID: 3232)
Everything.exe (PID: 3668)
Everything.exe (PID: 5340)
Everything.exe (PID: 2416)
iexplore.exe (PID: 752)
cookie_exporter.exe (PID: 6540)
identity_helper.exe (PID: 6276)
identity_helper.exe (PID: 6504)

Process checks computer location settings

Everything.exe (PID: 3232)
Everything.exe (PID: 5340)
iexplore.exe (PID: 752)

Manual execution by a user

Everything.exe (PID: 2416)
msedge.exe (PID: 2868)

Reads Microsoft Office registry keys

Everything.exe (PID: 5340)
msedge.exe (PID: 4024)
msedge.exe (PID: 2868)
msedge.exe (PID: 6964)

Process checks whether UAC notifications are on

iexplore.exe (PID: 752)

Checks proxy server information

iexplore.exe (PID: 752)
cookie_exporter.exe (PID: 6540)

Process checks Internet Explorer phishing filters

iexplore.exe (PID: 752)

Application launched itself

msedge.exe (PID: 4024)
msedge.exe (PID: 6964)
msedge.exe (PID: 2868)

Threats

No threats detected