6320da463ff49f3b80eeb9b96a8bbfc71b430e4482b94d383fd3862490a5d13f | Triage

Analysis

max time kernel
12s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 04:35

Sharing

Report Analysis Logs

General

Target

AIMr.zip
Size

28KB
MD5

aae42972c1e1c843f3f71d35b0caa444
SHA1

58c2a05f22cc3439b66262ba8c19417eca4a59fa
SHA256

6320da463ff49f3b80eeb9b96a8bbfc71b430e4482b94d383fd3862490a5d13f
SHA512

4efdd7667c3f15ea072806e6788834e33df81989cf28bffb8400a0d4cd4b4f74e65aec709187154a974dbcac6ca1ee6b0d89bda51a47154215b9a06a86832321
SSDEEP

768:4JbueZxb6kkmJIK2FAgVZ1TDOGAWNloIvE:4LOne0D4GZzK

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3000	7zFM.exe
Token: 35	3000	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AIMr.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads