Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
Take a minute and make a friend for life!.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Thanks for choosing Bonzi Buddy/BonziBuddy432.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Thanks for choosing Bonzi Buddy/Preview/please.reboot.me.jpg
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Thanks for choosing Bonzi Buddy/ReadMe.txt
Resource
win7-20240903-en
General
-
Target
Take a minute and make a friend for life!.zip
-
Size
49.9MB
-
MD5
2868000495bbc24b9a13272b2659e156
-
SHA1
157bda35e4b3a7d679fc22dd76346a198e20bf03
-
SHA256
88250a2ea6d6ab8c05c02a2e32ba31be464fe698c23080e9ecc12ad45fba1a03
-
SHA512
a87a4b0fb05694f078a3111d0e84998ab14c896848e9612dec85c197a61f8463d48c3bef99825e7671f3b1cbf143f4e4bd633a69978ffeecf21b46c56e059886
-
SSDEEP
1572864:4zrI+RRjVzd3Eu2Bd7sxwWQihabza7VGbBetM:4Q+DZz5EvPjWLEzGaB
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2312 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2312 7zFM.exe Token: 35 2312 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 7zFM.exe