5a3ffafc876896831f7794e2fc258861e9de6fac51313f35cd5db4bf6914ee9e | Triage

Resubmissions

23-01-2025 01:02

250123-bd52ssvjbz 10

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 01:02

Sharing

Report Analysis Logs

General

Target

Roblox Executor.zip
Size

16.5MB
MD5

0121ef0d742f203a0f8f59626bc62bec
SHA1

0ab9b524366725a4a0ef2c7e1ee2384dbdb263c7
SHA256

5a3ffafc876896831f7794e2fc258861e9de6fac51313f35cd5db4bf6914ee9e
SHA512

23131c21657b8738c91ea4960f7b2a3dfe2c5a2d2629ecd2c1491eaaf18f6cf0b8bf5fca2e9fc606b8dc4e0fde3b8f0fd7d6b42eafd360f252444ff121cdf6be
SSDEEP

393216:tP4rI4//JU7Z7XbwKBOxBOpGrsWQafuuim5c2JpoI94:u/JMZ70OMBdsWBfEKc2bza

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3864	7zFM.exe
Token: 35	3864	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3864	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Roblox Executor.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads