85daadd805ef623fa4ea0a0a4fd812c8c7de0731988650535d39b0a4d0d45b36

Analysis

max time kernel
43s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxSigmaInjector.exe
Size

2.8MB
MD5

635732063b1aaafbc53ca6dd24e84a35
SHA1

36422c3c3f78273a05259dc58a4b92fd8acf94d5
SHA256

85daadd805ef623fa4ea0a0a4fd812c8c7de0731988650535d39b0a4d0d45b36
SHA512

4ad02f52428fa97ecd1de65c68f6e0928a6e92051b41fd4572677f72f5f37aa1899ac3e7d08c819ee23ca24de6cebb74debe55201c0801a12b490e1653e16c2e
SSDEEP

24576:L6RFNe8oLhqL2MbTX+i3PYHEAESmmHraigY1i+Ec0xMk58UsU3Aox3WNuyE6k5:WDNedLhqLdsSmL91Q3WNuyE6k5

Score

8^/10

evasion

Malware Config

Signatures

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	RobloxSigmaInjector.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1500	1736	RobloxSigmaInjector.exe	29
PID 1736 wrote to memory of 1500	1736	RobloxSigmaInjector.exe	29
PID 1736 wrote to memory of 1500	1736	RobloxSigmaInjector.exe	29

C:\Users\Admin\AppData\Local\Temp\RobloxSigmaInjector.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxSigmaInjector.exe"
1⤵
- Looks for VMWare Tools registry key
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads