dd40bf5460b2c1dd742d22700241da3ccb390e0a76f683b7f53dc630a46f62d4

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Minecr7aftBe0drockE-1.21.130-elamigos (1).rar
Size 719.8MB
Sample261017-ftvcfsxtew
SHA256 dd40bf5460b2c1dd742d22700241da3ccb390e0a76f683b7f53dc630a46f62d4
MD5 5b1686bfa42b7a5b346f4f055108d2b9
SHA1 78991002884a9348d41d3b9d6a4a3ea9187ef457
SHA512 ca0fa5d2784002b09b4d314175dc06bc0ab4510e9d7b1e7e3f1bd10ef4e3eab9baff7279bdde0d21552c0dbb2a50ef56caa9bd71ff34345702217e1bec84e850
SSDEEP 12582912:hAqNVFczuzyIGfpSzMFBzcx60/uqcGqBP49z9O5vym3+OQ8uvb:h4zuaflTcjvcGqcz05vMRvb
TLSH
T1C8793314AB4A1D33D2331FF8DAA1B1C83C79BC40AE62511BDAA59ADD0E755C8BD347C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3252	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1300	7zFM.exe
1300	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1300	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1300	7zFM.exe
Token: 35	1300	7zFM.exe
Token: SeSecurityPrivilege	1300	7zFM.exe
Token: SeSecurityPrivilege	1300	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1300	7zFM.exe
1300	7zFM.exe
1300	7zFM.exe
1300	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 3252	1300	7zFM.exe	96

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Minecr7aftBe0drockE-1.21.130-elamigos (1).rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\7zO415E1D4B\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO415E1D4B\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO415E1D4B\setup.exe
Size 1.3MB
SHA256 787b2ca13f9ee9a5760038e2e882d257191d925f0f235fcdf50c420bf57f54a9
MD5 93563be5a44ba6804a32944f9bb2ea69
SHA1 ac35b9bd6ebda06288b6479f77c5f5d5c950e09a
SHA512 592c74ff335da3d85c34ea2ea2bbc16dc7648474926f5b573baec13fe3dc9d08c6a3da64e4070db8f011056fa3df252dc4aac9ccce5e353c071522c3c30af099
SSDEEP 24576:j1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3G4Fvx96H:RQdhZgEN6GnJPE
TLSH
T1A5555B22A3918437D5732F799C6BD2986C35BE202E74D95A7EF89E0C0E78B407D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3252-11-0x000000000050B000-0x000000000050D000-memory.dmp

Download

memory/3252-12-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/3252-13-0x0000000000400000-0x0000000000553000-memory.dmp

Download