b9c1b9b0080c47159b024c8cdabeac604e66aeec4022a89b120300290ae4a733 | Triage

Analysis

max time kernel
94s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 19:11

Sharing

Report Analysis Logs

General

Target

RobloxInjector.zip
Size

24.8MB
MD5

139ae6a2e4392f33471bf8d48df3063e
SHA1

43efbb3a695775907f10b11ba39f65d598711d6f
SHA256

b9c1b9b0080c47159b024c8cdabeac604e66aeec4022a89b120300290ae4a733
SHA512

d611e0307091cefbcfd57729634674a783d2c289fe69d6218ad55448c572a59cd4aa9f84763cdcc758f596d924ec5314a1dd2859b38240cee64622197380adbf
SSDEEP

786432:tzVPgXm96ziTA5+DPYWA6mjuPei9z2eXcGQH:tzV0mEziE5+be6mjti/cVH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	1804	7zFM.exe
Token: 35	1804	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
1804	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RobloxInjector.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads