Resubmissions

25-03-2023 10:00

230325-l1sebscb53 10

General

  • Target

    https://drive.google.com/file/d/17oDc8BG7ks1itmLf1QHVmCNDvkdbLxTS/view?usp=sharing

  • Sample

    230325-l1sebscb53

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4aa08b32d2e3f0cd_0

Ransom Note
0\r�m�����@����������222975A91E3127C94D56820A452D1E26B5D41F9B6C544AA39B708CC5FC7D6693����g�J�����Mhvp�����58+�����$S�`���qL`����xL`8���Q��O����Roblox�����������������������������Qb������LangL�a"������$Qgb�'����Action.PleaseTryAgain��� Qf�B ;���Please try again.���Qez� ���Action.Reload���QcR�����Reload��QeG� ���Action.Submit���Qc�^E���Submit��0Qj��U/!���Description.VerifyingYouAreNotBot���(QhƼM-���Verifying you're not a bot��,Qi��[���Header.PleaseConfirmYouAreHuman�(QhBXO����Please Confirm You Are Human$Qg�4����Header.RobotChallenge���Qe���Y���Robot Challenge�$Qg68&���Message.Error.Default���@Qn���G3���An unknown error occurred while displaying captcha.�,QiP�t���Response.CaptchaNotEnteredError�(Qhj�i����Please fill out the Captcha�$QgJ�0w���Authentication.Captcha��Qe.Ƞ����CaptchaResources��aR�����Qe�� ���Action.Cancel���Q��|����Cancel��$Qgr[� ���Action.ChangeMediaType��,Qi2OB���Use another verification method�$(QeBՌ� ���Action.Resend���Qd��֍ ���Resend Code�Qe6�Y���Action.StartOverQd~��_ ���Start Over��,0Qe�W� ���Action.Verify���Qc� ����Verify��Q�O� ���Description�-,Qi.��3���Description.Footer.GeneratedBy��DQo*[�6���This message was generated by {environmentIdentifier}.��,Qijl�� ���Description.SecurityWarningShort�Q�2�F�����{boldStart}IMPORTANT:{boldEnd} Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc.���8QlR��+���Description.SecurityWarningShortBackupCodes��Q�R�ŷ����{boldStart}IMPORTANT:{boldEnd} Don't share your backup codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc.�HQp>Que:���Description.TwoStepVerificationActivationEmail.Body.Over13��9Q5�� ,*��Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Email for your Roblox account. For some actions like logging in, you will need to enter a 6-digit security code that Roblox sends to you via email.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��HQp�M��;���Description.TwoStepVerificationActivationEmail.Body.Under13�AQ="0��4��Hi,{lineBreak}{lineBreak}2-Step Verification with Email has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code that Roblox sends to you via email.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxDQobI4j6���Description.TwoStepVerificationActivationEmail.Subject��XQt��D&J���2-Step Verification with Email Activated for Roblox Account: {accountName}��LQq��&@���Description.TwoStepVerificationActivationSecurityKey.Body.Over13�Q�:��{����Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Security Key for your Roblox account. For some actions like logging in, you will need to have your security key.{lineBreak}{lineBreak}Roblox�PQr�zKA���Description.TwoStepVerificationActivationSecurityKey.Body.Under13����Q��?����Hi,{lineBreak}{lineBreak}2-Step Verification with Security Key has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to have their security key.{lineBreak}{lineBreak}Roblox��PQr�'�~A���Description.TwoStepVerificationActivationSecurityKey.EmailSubject���`Qv���Q���2-Step Verification with Security Key Activated for Roblox Account: {accountName}���HQpfM A9���Description.TwoStepVerificationActivationSMS.Body.Under13���=Q9�*�"0��Hi,{lineBreak}{lineBreak}2-Step Verification with SMS has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code that Roblox sends to you via SMS.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxHQpJQ2A9���Description.TwoStepVerificationActivationText.Body.Over13���IQE�J0:��Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Text Messages for your Roblox account. For some actions like logging in, you will need to enter a 6-digit security code that Roblox sends to you via text messages.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��HQpF�:���Description.TwoStepVerificationActivationText.Body.Under13��QQM*<oD��Hi,{lineBreak}{lineBreak}2-Step Verification with Text Messages has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code that Roblox sends to you via text messages.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxDQo�X�5���Description.TwoStepVerificationActivationText.Subject���`Qv³t�R���2-Step Verification with Text Messages Activated for Roblox Account: {accountName}��TQs�@*�G���Description.TwoStepVerificationAuthenticatorActivationEmail.Body.Over13��Q�N��ǚ��Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Authenticator for your Roblox account. For some actions like logging in, you will need to enter a 6-digit security code from the Authenticator App.{lineBreak}{lineBreak}Remember to save your backup codes in case you don't have access to the Authenticator app.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��TQsb�"H���Description.TwoStepVerificationAuthenticatorActivationEmail.Body.Under13�Q�:����Hi,{lineBreak}{lineBreak}2-Step Verification with Authenticator has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code from the Authenticator app.{lineBreak}{lineBreak}Remember to save your backup codes in case you don't have access to the Authenticator app.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxPQr^��C���Description.TwoStepVerificationAuthenticatorActivationEmail.Subject�`Qv&���R���2-Step Verification with Authenticator Activated for Roblox Account: {accountName}��dQwʬJ�X���Description.TwoStepVerificationAuthenticatorCustomerSupportDeactivationEmail.Body.Over13iQeZ��.[��Hello {accountName},{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Authenticator for your Roblox account.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code from an Authenticator app will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in�your {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox�hQx6��&Y���Description.TwoStepVerificationAuthenticatorCustomerSupportDeactivationEmail.Body.Under13���mQi�<��^��Hello,{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Authenticator on your child's Roblox account, {accountName}.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code from an Authenticator app will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��`Qv�J#1T���Description.TwoStepVerificationAuthenticatorCustomerSupportDeactivationEmail.Subject`Qv���S���2-Step Verification with Authenticator Deactivated by Roblox Support: {accountName}�XQtJn�I���Description.TwoStepVerificationAuthenticatorDeactivationEmail.Body.Over13���9Q5��{[)��Hello {accountName},{lineBreak}{lineBreak}You have deactivated 2-Step Verification with Authenticator for your Roblox account. A security code from an Authenticator app will no longer be required for some actions like logging in.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox���XQt�ڥ,J���Description.TwoStepVerificationAuthenticatorDeactivationEmail.Body.Under13��AQ=Zߺ�2��Hello,{lineBreak}{lineBreak}2-Step Verification with Authenticator has been deactivated for your child's Roblox account, {accountName}. A security code from an Authenticator app will no longer be required for some actions like logging in.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��TQs�Z$E���Description.TwoStepVerificationAuthenticatorDeactivationEmail.Subject���`Qv2��VT���2-Step Verification with Authenticator Deactivated for Roblox Account: {accountName}\Qu&� �O���Description.TwoStepVerificationCustomerSupportDeactivationEmail.HtmlBody.Over13�IQE���d9��Hello {accountName},{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Email for your Roblox account.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in�your {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox���\Qu��TRP���Description.TwoStepVerificationCustomerSupportDeactivationEmail.HtmlBody.Under13IQE�6<��Hello,{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Email on your child's Roblox account, {accountName}.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxTQs�hw�G���Description.TwoStepVerificationCustomerSupportDeactivationEmail.Subject�XQtR�#�K���2-Step Verification with Email Deactivated by Roblox Support: {accountName}�dQw�KU���Description.TwoStepVerificationCustomerSupportDeactivationSecurityKey.HtmlBody.Over13���%Q!B�æ��Hello {accountName},{lineBreak}{lineBreak}This message is to notify you that our support team has deactivated 2-Step Verification with Security Key for your Roblox account. This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security key will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in your {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance, {spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here: {aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}Roblox�dQw*F�#V���Description.TwoStepVerificationCustomerSupportDeactivationSecurityKey.HtmlBody.Under13��)Q%�&�"��Hello,{lineBreak}{lineBreak}This message is to notify you that our support team has deactivated 2-Step Verification with Security Key on your child's Roblox account, {accountName}. This typically occurs due to a support ticket you submitted or as a security meas

Targets

    • Target

      https://drive.google.com/file/d/17oDc8BG7ks1itmLf1QHVmCNDvkdbLxTS/view?usp=sharing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks