Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-10-2024 08:35
General
-
Target
VFS/ProgramFilesX64/AIMP/AIMP.exe
-
Size
5.8MB
-
MD5
eb0eb5dc3234d7f0bb64b7ed5bbc7673
-
SHA1
2190d5f1a09100557e9112d5720bf7c59231f20a
-
SHA256
4a0e5ff986b8355155b3efac9935c988f3c1ee5768869d731e832124a52aa8e2
-
SHA512
da15ae5c078aa25658179331eb8e83b1f361d101c84039d3e99db5e7ea9b9a455493d96d0a6fbc6cdcdf239d69d9366592b4341f424927faf0088d0dc0c28c36
-
SSDEEP
49152:9Ngn7bu88oQ6BLXVXOmCzM3mwIqYTk/Co4Qaqp8Spdkck:9N+O6Btp1Co4UpFGck
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\AIMP\AIMP.exe"C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\AIMP\AIMP.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
52KB
-
Filesize
20KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
12KB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
5.8MB
-
Filesize
4.3MB
-
Filesize
20KB
-
Filesize
140KB
-
Filesize
12.9MB
-
Filesize
12.9MB