Analysis
- user interaction
yes - max time kernel
36s - max time network
35s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
23/08/2026, 03:08
Static task
static1
Behavioral task
behavioral1
Sample
CHILD AIMKILL MAX.rar
Resource
win10v2004-20260513-en
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
CHILD AIMKILL MAX.rar
Resource
win10ltsc2021-20260513-en
4 signatures
900 seconds
General
- Target CHILD AIMKILL MAX.rar
- Size 8.0MB
- Sample260823-dnbl2sscnb
- SHA256 7f3063cb0dbd89305abb4d2a0a9b6ddfef1e2ec3e66b066bcef3a495258abac4
- MD5 5d80501ad9b57bf5ebfb06a36509011c
- SHA1 f0cd004de4013d32697e56bed488d083fc17d969
- SHA512 8a489ae0d54724c0e88e485fd3de63ac12cef2bf9f68e7dfe0e253dd8b0ba73afceeb37d335f863ac8f52d9851bc58ac50dab0ee1cae4de1e431872dcbb17c10
- SSDEEP 196608:oEnDqqkov/Kw8Mnqd8UW0G5m8ykDIT8HrTrigNKX:oEnuq3/KwPnqd8UXqkeIoXr2X
- TLSH T13B863394D7A6ABF1C58A893700D4DA5172BF44B27C690B6FCD8426A8F030E815EFDED4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1892 CHILD AIMKILL MAX.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5372 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 5372 7zFM.exe Token: 35 5372 7zFM.exe Token: SeSecurityPrivilege 5372 7zFM.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5372 7zFM.exe 5372 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CHILD AIMKILL MAX.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5372
-
C:\Users\Admin\Desktop\CHILD AIMKILL MAX.exe"C:\Users\Admin\Desktop\CHILD AIMKILL MAX.exe"1⤵
- Executes dropped EXE
PID:1892
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\CHILD AIMKILL MAX.exe
- Size 13.6MB
- SHA256 d2a399c9be7ee16b391fbc03020f856b5bcb4ff2aa3f1ed2e399298ccf32e058
- MD5 7066c26a08cf6ba2aefc839c290df1a7
- SHA1 5d2e236287ff89da36ca2e4771882f5108e1414d
- SHA512 98ece74ab16668a34b9c9262c9e76b9ff7626c2b07ead375b70afc0563422dbe719cbee99f81a669ddf34da55b88d139e01f7bf5b53b20aa832faa8a9dc934fd
- SSDEEP 393216:EqNz+ZEeEX85H3PIWku/un6swzMgaluV1fyETEnA:b+ku2n6F4gmuVliA
- TLSH T1BDE6F10BF28746AACF576234419BE367D2317CC4536193C76A4D8A246FA7BF02A3D790
- MD5 SHA1 SHA512 SSDEEP TLSH