ecf969de7fb20ec02e0fd86c42e79294af3daf13f8de7b97b20d32eb5864aa2f

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BLTools v2.5 (3).rar
Size 4.2MB
Sample260809-fbq73szhpc
SHA256 ecf969de7fb20ec02e0fd86c42e79294af3daf13f8de7b97b20d32eb5864aa2f
MD5 4548b2325862fa042fd8ca07783b2d3e
SHA1 69c702f71ded90ff35c77d53748c9384dd216a64
SHA512 92380bfe618cd5d1c91033ff14c763501e5dd9c554ce263311e21754516e4f7c9d2ffc5dd73306efdb9809d84cbb0e82e2440b54eecab3f974d7dd4e909e71a3
SSDEEP 98304:vS3ierG7udzXrfx8aSmCLCxMnMyWq2HX7zdxq0Jrt42RGR2gt:63ieFdvf3shMyKxq0Jrt40Gjt
TLSH
T1031633CA7AD91CD8403DCAE5AD350A9D23EC11A89BE74407FC00DB69D97B170A7E6C63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5384	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	5384	7zFM.exe
Token: 35	5384	7zFM.exe
Token: SeSecurityPrivilege	5384	7zFM.exe
Token: SeSecurityPrivilege	5384	7zFM.exe
Token: SeSecurityPrivilege	5384	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5384	7zFM.exe
5384	7zFM.exe
5384	7zFM.exe
5384	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BLTools v2.5 (3).rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5384

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\JoinSelect.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads