2db050c4612390792244c41de6ffdb8e8d4e6273dae3001f66698c3f6e7edb69 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 04:45

Sharing

Report Analysis Logs

General

Target

RobloxExecutor.zip
Size

644KB
MD5

5cca3b7c8117a508fa8f30221ce550c0
SHA1

6f26fc9d5a2b12e0bd379f7071f4b7808f364548
SHA256

2db050c4612390792244c41de6ffdb8e8d4e6273dae3001f66698c3f6e7edb69
SHA512

9d61fc4180a658d53717ea8e9bd6540b93d95df2589da2a286e183573d2a8a030a5d162f6f5fbbd41c338788805cb8ad59da5174d4622862fa02d5607bcc66ec
SSDEEP

12288:qzOFl64h29ZNtIbtg8KoTiFQmfPBAjTJSrpjVI7IARESa:KOa4c9ObtuoTifPWkpVIV2

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2852	7zFM.exe
Token: 35	2852	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RobloxExecutor.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads