Overview

overview

8

Static

static

1

instalacio...ox.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    55s
  • max time network
    62s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    07-03-2023 00:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    instalacion de roblox.exe

  • Size

    2.0MB

  • MD5

    eaa7c4c1c95b9addfde5007f7d950391

  • SHA1

    2214dca2e8d2f5204a171524096786b2717088d3

  • SHA256

    8bdc4a080415af8c84897ad4b7c99b49834d690534cd1905c998d3668063791e

  • SHA512

    2aefb2493302283e4b3e7522708da784e28b24c18c38dca5b26a2c9b83839d8de2b8558c78d2db26d13fe93ba347810da10cc63727e31951d1351a54c46b2cfa

  • SSDEEP

    49152:20oO7pOph8nfCtHTnwa/gdV0ETGRMfPMQ3dSxtTX4b6PV/L:hH7p4h8nfCRQbYVD

Score
8/10
discoveryevasionspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\instalacion de roblox.exe
    "C:\Users\Admin\AppData\Local\Temp\instalacion de roblox.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Users\Admin\AppData\Local\Temp\instalacion de roblox.exe
      "C:\Users\Admin\AppData\Local\Temp\instalacion de roblox.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=5e5c91aa835e99f5f8232bf2e5dc272e724868f1 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x744,0x748,0x74c,0x690,0x754,0x8fa330,0x8fa340,0x8fa350
      2⤵
        PID:4336

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
      Filesize

      2.0MB

      MD5

      0a5ea9b476f62da3cc0792f86ee653ac

      SHA1

      2a1e2ee0db395e7daff3bc854c70e96ad3303f03

      SHA256

      5e99b0e9c1ae1d548af407dce9694afc6462e3e1932cf8df58769b500893e003

      SHA512

      ebc1337339135a667d53fdd4387633b24530fb7d0f1f64d1114abacf7d7250a2d295e523617f43dfd8b65c503fdf27c1e3f064ac1d6666e67e563d0d7af93397

      Download Submit

    • C:\Program Files (x86)\Roblox\Versions\version-0b123e0533b6441b\RobloxPlayerLauncher.exe
      Filesize

      2.0MB

      MD5

      eaa7c4c1c95b9addfde5007f7d950391

      SHA1

      2214dca2e8d2f5204a171524096786b2717088d3

      SHA256

      8bdc4a080415af8c84897ad4b7c99b49834d690534cd1905c998d3668063791e

      SHA512

      2aefb2493302283e4b3e7522708da784e28b24c18c38dca5b26a2c9b83839d8de2b8558c78d2db26d13fe93ba347810da10cc63727e31951d1351a54c46b2cfa

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
      Filesize

      1KB

      MD5

      5c92a73b28fec71486b123843223e65f

      SHA1

      04159e159776571b75f18a8ff3df019591c8f85f

      SHA256

      96b7af30ce7f443a11e537fa8fb68b10a288f99a6ef45df60624232327b0425a

      SHA512

      f5c945edeb2b028555b1c9825fe6302264ce06d9a48bb1b428210bd7ac8b34231bc3ed8d7d20cd1e21a5a78ce83a79d5c492514f8fbfb8d46854d5ca9bcb7828

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
      Filesize

      471B

      MD5

      d5b24255647492c44d4df81200efa103

      SHA1

      b529219fdee19339da42f125e965b8472ff906bd

      SHA256

      ab0ff82c35118b55c14be59ea4a76588a939d3a161ccddb8ca0ab5e3f1893898

      SHA512

      9ccf554902c34e17651026e4c354b78646da38b6d0d3f0e52c5fbed8a03f25058cfbac5db3a44c401a17ed64df84a0cc499aeb2a4d9d168d03eda86c2f557200

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
      Filesize

      1KB

      MD5

      fba37afe2172957d479d35e50370e6b6

      SHA1

      009cea738de51e8b2dc44eec191fd56087f51dc4

      SHA256

      208ec1fe7bec79937a6432aabff83853b9c97103b79014e9f7d78dc143f62cf4

      SHA512

      bf3cc2d9fa8beb0d0527fa3ed3563876d180c0673508d9499b6f0b75590065173fe874458e8322a2dc4bae5fc76a2858e3460430ce4068ff595d9865d4781704

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
      Filesize

      450B

      MD5

      eb3267b513719679c6c462ed84cc4816

      SHA1

      0358c2a6cd2a3f5a4984238069481fe49cd6e196

      SHA256

      8925655b8c19b1ac01c726a9f68de2f28634a3fb36639e781c8e874bd7ad63a3

      SHA512

      1a0663c8db6d45496dd786a69f68fa249bcc3833163ef5280e0c64acc7273d02d8c2a96973eef4cbce089815c2220055bf57423cadb391fa3add4418524907d8

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
      Filesize

      400B

      MD5

      84cb18e6fa2acf5f030d301c5265e09b

      SHA1

      7ab4fdbc52a512c71e356b19608cd5957fdc43db

      SHA256

      997f5c83e33b3b40fcc9a47a082f7457f33f19b1fa9c13dc40131d957f0a5298

      SHA512

      e34e22e3c11c6a69d6b36f78b6fee14f422099eb5757ffafef6ca0090bffcd49749c5e6b95a2da9d0a77c28dc288468d4a40963512f0a3939926978f97bc08cb

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
      Filesize

      458B

      MD5

      1cffc3c52b5ac74c28a24cff56acba6c

      SHA1

      c4341b62ae4550671dbd04aeb9f270e6059fd988

      SHA256

      a5eb49c6203bdcbaa2fd5bc2d4201cbd28218a73254cbd7d50539d3af2c6f8e0

      SHA512

      e27d9189550df85f6f5daa609c724efd30159d73a5e17acf5eced6f9df715f751aa0deea72bc50f74b18a8443d7c216c79af72af1934e67de128b3bcaf458092

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\WindowsPlayer[1].json
      Filesize

      119B

      MD5

      46fa63f2b38f2d0c4f7d0897f5413fc7

      SHA1

      420856a615ea0ce22a92ffc95c98558d32522729

      SHA256

      f8d3ac95e2731ae8f2eda4925488dd67f9e1c5f04bbf49e3a30080cb60c5a3a2

      SHA512

      c31cdb02940141e9c9ce8d0a1c3e8a95ae82e917bd467532695af35c83b874ec715d396df5900f888e32c3d70800cdcab61b0a6af8e5a37db7d269c7f2d815aa

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\PCClientBootstrapper[1].json
      Filesize

      2KB

      MD5

      e67172b0dea73a79f6f4eb67276c2d84

      SHA1

      46296c774693fbbdd6000d83b4f11b62332095a8

      SHA256

      01b8f54205e4e554abe55e09c5ff70a1e503bbf12e83eb5fed1cb2a7bf3bc919

      SHA512

      098ba9b22ed87dc1acecc9c0bd4d462ea791971c574d3fa487a78d845975a483e92fb1235a0be86b26cf8bb36c231071ae7b34f640a66cb59eea886274b328dc

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
      Filesize

      40B

      MD5

      aa301e6190927c3a881c80ab518ae485

      SHA1

      d62a2f11b0f1c377dfa92cd280e4df41d2eae46d

      SHA256

      78a653acbe40d3519f0a5173c7a04ff9acebf52fa9aa0b6e4dade71b6b3eaa27

      SHA512

      ce93711a7764b4ddb39a4c00b8ccf7135d99c389890e954b593994e9971cb2737d49ca3bd1b7c873c77155c476bc9c121592a2711d1d36a94dd3d841178d5e20

      Download Submit