Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 15:45
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win7-20221111-en
General
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
MD5
6723f12d15525aab7f012dc6050a8d3c
-
SHA1
a349dc774f9e5fa0023c26d421f94dec8701f19d
-
SHA256
e08d1e9c9bd59b716c3ce85ecbdbe935b5b57358f12a3f03b1f0a8914c1476f9
-
SHA512
4fef0a875bf25d097b8cfe0eadd6e4e6e5c141ac08ab4e94112f0d7b1cae1b574e5feab68a0eb79993648aabacc2d2c51c894818af0995e78e4b7cd3a60907d4
-
SSDEEP
49152:ZmFShsAj6/KeoXwO4RDQ8ZdTJCaY+4lNT7CM6PMQ3d2OnTqb6cPz:SS+Aj6/uXcDQ81sbB7
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RobloxPlayerLauncher.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
RobloxPlayerLauncher.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RobloxPlayerLauncher.exedescription ioc process File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\transformTwentyTwoDegrees.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\rules\KnownDirectivesRule.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\JestCircus\JestCircus\circus\eventHandler.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\IgnoreAllFriendsRequestsMenu\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\Flags\getFFlagFixClickAreaOnSocialTab.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-10x10.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\COPYRIGHT.txt RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\NetworkingSquads\NetworkingSquads\SQUAD_URL.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux\rodux\loggerMiddleware.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\FriendsLandingEventListener\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\FriendsLandingPage\init.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GraphQLServer\GraphQLServer\graphql\utils\mergeDeep.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\avatar\scripts\module_autopole.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\DeveloperStorybook\Storybook.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\Commands\RBXEmoteCommand.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\NetworkingGames-40b180a4-1.2.0\NetworkingGames\GAMES_URL.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\roblox_lumberyak-b6bd621d-e6abd03f\Cryo.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\PeekView.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ui\Chat\VRChatBackground.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-24c5c11f-f6df649b\RoduxFriends\Actions\FriendRequestCreated.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\UIBlox\FitFrame.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RoactUtils\RoactUtils\ExternalEventConnection.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\SocialTab\UserCarousel\Components\UserCarousel\UserCarousel.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\LuaApp\icons\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\Dash\Dash\join.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\roblox_networking-chat\networking-chat\networkRequests\createGetMessages.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\AnimationEditor\img_dark_timetag_bg.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.4.2\LuauPolyfill\Array\every.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactRootTags.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\Scheduler-a406e214-4230f473\Shared.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\9SliceEditor\Dragger2Right.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\MaterialManager\Create_New_Variant.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\StudioToolbox\EndorsedBadge.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.3.4\LuauPolyfill\Array\every.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\EmptyResultsView\EmptyResultsView.story.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Friends\mapToUsers.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\lock.toml RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\JestDiff-edcba0e9-2.4.1\JestDiff\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\t.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppCommonLib\AppCommonLib\Text.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameIconRodux\GameIconRodux\Actions\SetBigGameIcons.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\VirtualEvents\Components\EventDetailsPageLoader.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\SelfView\SelfView_icon_camera_enabled.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-31a10f32-ced4713c\ExperienceChat\Actions\TextChannelCreated.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\jsutils\devAssert.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\llama\llama\Dictionary\join.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\NetworkingSquads\Util.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppCommonLib\AppCommonLib\Immutable.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\fonts\AccanthisADFStd-Regular.otf RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\ViewSelector\top.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\DeveloperTools\DeveloperTools\RoactInspector\Classes\RoactInspectorWorker.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-09990ed6-a147b962\ExperienceChat\installReducer\TextChannels.spec.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuaProfileDeps\Rodux.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Components\Carousel\CarouselContainer.test.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_move_1.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\llama\llama\List\equalsDeep.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-90b08185\LuauPolyfill\Array\shift.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.3.4\LuauPolyfill\Array\isArray.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxAliases-4b477b13-e5753ce1\RoduxNetworking.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Packages\_Index\RoduxNetworking-fe052a05-2.3.2\RoduxNetworking\init.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameIconRodux\GameIconRodux\Selectors\getGameIcon.lua RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-c5837a56b9bf486f\content\textures\MaterialManager\Texture_None.png RobloxPlayerLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
RobloxPlayerLauncher.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F0B73A64-7ED6-4DD9-9832-F1E458C0F1AB}\Policy = "3" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E4F4F81-0506-4952-B5F7-22BDF80DD582} RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E4F4F81-0506-4952-B5F7-22BDF80DD582}\AppName = "RobloxPlayerBeta.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E4F4F81-0506-4952-B5F7-22BDF80DD582}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F0B73A64-7ED6-4DD9-9832-F1E458C0F1AB} RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F0B73A64-7ED6-4DD9-9832-F1E458C0F1AB}\AppName = "RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F0B73A64-7ED6-4DD9-9832-F1E458C0F1AB}\AppPath = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E4F4F81-0506-4952-B5F7-22BDF80DD582}\Policy = "3" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerLauncher.exe -
Modifies registry class 36 IoCs
Processes:
RobloxPlayerLauncher.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-c5837a56b9bf486f\\RobloxPlayerLauncher.exe\" %1" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\shell RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\shell\open\command RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\DefaultIcon RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\shell\open RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\roblox-player\URL Protocol RobloxPlayerLauncher.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RobloxPlayerLauncher.exepid process 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe 1932 RobloxPlayerLauncher.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
RobloxPlayerLauncher.exedescription pid process target process PID 1932 wrote to memory of 4932 1932 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1932 wrote to memory of 4932 1932 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 1932 wrote to memory of 4932 1932 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=d0b4c56632452fa149160ea75abb3fd8ebbae2c4 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7fc,0x7c8,0x7c4,0x758,0x7c0,0x13032a8,0x13032b8,0x13032c82⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771Filesize
1KB
MD531b910d0e28bfa4faded9cea77abd3e9
SHA1467a701f23d57c85d5efcafefeb66c369fd4d651
SHA256129f2ccd30c0580a3ad0f4cbb6d84a8bedc07498fff02680a83bdeeb20dd1992
SHA512947970353d67a1cde207910fb3ef8e81f42495e2400619c835caa86179af32769695b55eab10e4582d95b0781307ba58671ba451a5cb2a55df564a68b0e41498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
471B
MD5d869aa372177cefe16f9a4f3e656ae1d
SHA1dd648b47c178dcd3f7cdf5f87146cd15196d6fa2
SHA256d7cb6b3e1ae57fd75e9fda78c05e4f630710ccbb005a82518106dbcbc7237906
SHA512bb6361cedc3ce8e47bda83d9271cd9f5ce6451866785d2f79b427af8ec74ff4b655e5d1f4a3caa052f9919c05cc423bdac2e5d0a878e2ddbac69aaa75c6354a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2DFilesize
1KB
MD5c674a0c651cafbc666ff3d39fd943be0
SHA1af67492d7d9e7eedd7d485df51cd08c864bf62e2
SHA256c7422305f0d70e5796439ee0cdfe4766ffc4731e1c15951ddcc0ff3a4025deb1
SHA51207526ece36e0e63c5e6ee4dad9aacae6f22c8b9a8b31fe137720fe90dcb2b39818fec263ec561943b6cee327454a90bba5b4b63601e18c4a7ab412090a29dfc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771Filesize
450B
MD5e85d162c9f68ad0c563394aec8506166
SHA1a4b7dc0c968316300f2da240e227ac7f535bd795
SHA256be0a4f4ca1fafd762c0bd9ce274f0abb30c442a2fa11328c820cd8b41129deee
SHA5125435ea377f67e8704fdd1e58f2433b01d921d54b52fdd1b4412f0485fab267831b03a9a9191c6bc1e7d32d54986c1bdb613d1eccf409660fede7f1a36cacf91a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
400B
MD5655f335445db85104a9dc8cabe4e194c
SHA1cfb2db7ac51d80173d29edb1e9347996f455d353
SHA25611fa950d2a30433add4d4204cc1732a2d56c9a405990e4fd3c7bd9feb1823f0a
SHA512bdfb47ce9661761546f3fedb910c463195d0393e4793be48053c119d30b3221c6b8199b4ab193a32a62015729b043975cc10f57a2f9be85f70a294e6d35e5a73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2DFilesize
458B
MD561caae3919e8c67623c17da64edbfa50
SHA1d37cce5d500e15b560fad242f68cb9406f6dcfb1
SHA25637ec211778483fca2e7fb2877ce679d70d65dba673d3b470fc2cc9fa09368546
SHA5123c64313fa05ca0c5cf81045ad6d50bbe5c83c91a766162850b6fa7dc82acab76ddf1a99acdaf9391e96c73c04fcdfa924caaff53bf3904871600a4a5e6280c25
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S58XVZL8\PCClientBootstrapper[1].jsonFilesize
2KB
MD53e511c368304454f7c38d2bc125ea762
SHA1fc6a9ecc9cd17efb1ab85287d7a5006b0f3ad0c0
SHA2568921eb5bb390fe87bc77cfb96ea9c8a914ede063c256b7db3119f2babd5f4a2b
SHA5125ccc497dc5125ae885282b7e725346d010ef25efb95452ba5eafb4686a3fd5c8465dc7923bdac33bf570ed41501ce38121865f5ee92b5dc1ddbebb3b18d73842
-
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.datFilesize
40B
MD5ffd72b4fbe6c5e1fc103b648dffc4df2
SHA1ef8b987d4d3a347f687581c087ef587b30b93a85
SHA25655f9af62c7d6df8464565e7a0bea75a96e001613b9a937d0d32575a0c7be7b50
SHA512a959aec6e2e9c5be554cfa55a62a85c6adc144c2f761235367f6d668d8554e00a46031721aa1a10b0864a143009c492c6d3baa811331a7d9de45714f14445b9f
-
memory/4932-132-0x0000000000000000-mapping.dmp