6e53895018ec0ca7af4473d0865a43f948cd8ffc121cb4689a7c08fc1fbb5993

Resubmissions

06/07/2026, 01:26

260706-bt2z3scx5m6

06/07/2026, 01:13

260706-bk3v1sgz5t6

06/07/2026, 00:57

260706-bbfdcscw9p8

Analysis

max time kernel
1798s
max time network
1099s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Facebook_564.0.0.48.74.zip
Size 305.5MB
Sample260706-bbfdcscw9p
SHA256 6e53895018ec0ca7af4473d0865a43f948cd8ffc121cb4689a7c08fc1fbb5993
MD5 8f2eb94a79ebc4cf43b0c411906d5370
SHA1 a52587f9360d2ef6069818c07f1d4d98d3f54d9c
SHA512 28fa8586c1c7db197905c233e3c467a2751ee96c136879bff84c059ccf34c8ee7fcb9aed58f3b2185c722e93b4ef36cad597e47021c5f15eed49307ef4f6cf61
SSDEEP 6291456:VDoSAK8ka9vEjvcEuB/Z9HaCa2GlfwMfcspj/:Vqoa9vE+BzaCa2GlfwMfcEj/
TLSH
T1C6E8C000B90D5823EACFF0BD8ED1039232173D598561D38B2167A22EDE936D6579B7F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1472	7z.exe
Token: 35	1472	7z.exe
Token: SeSecurityPrivilege	1472	7z.exe
Token: SeSecurityPrivilege	1472	7z.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1472	1812	cmd.exe	86

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\Facebook_564.0.0.48.74.zip -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\Facebook_564.0.0.48.74.zip -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads