e9786c459bd577c41c3e728943f772e7622e9c1df543b0029a33d41e032f2a4a | Triage

Resubmissions

19/01/2025, 20:42

250119-zhebmswjel 10

19/01/2025, 20:37

250119-zegbtsvlgt 10

Analysis

max time kernel
675s
max time network
439s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19/01/2025, 20:42

Sharing

Report Analysis Logs

General

Target

At roblox.rar
Size

8.9MB
MD5

5eba688922292b11abe9eaabd24e1185
SHA1

5962f8e8d1f7a353923098c93d42a3011cf4b105
SHA256

e9786c459bd577c41c3e728943f772e7622e9c1df543b0029a33d41e032f2a4a
SHA512

a1e1b8cf27714b170df5c0555d0c0026e798efb6a49d3bb6a905223e8f50988fa09a94bd847154a9168af75374f0d7f0a3ab38d5e106391a8d63feda98c3c92d
SSDEEP

196608:AWzHdpDT00rf9iCNWZRvcOh/o7KyG/t9txkOe:A+HdriCNWZZcx7Kb0

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
8	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	8	7zFM.exe
Token: 35	8	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
8	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\At roblox.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads