Resubmissions
25-03-2023 10:00
230325-l1sebscb53 10General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4aa08b32d2e3f0cd_0
Ransom Note
0\r�m�����@����������222975A91E3127C94D56820A452D1E26B5D41F9B6C544AA39B708CC5FC7D6693����g�J�����Mhvp�����58+�����$S�`���qL`����xL`8���Q��O����Roblox�����������������������������Qb������LangL�a"������$Qgb�'����Action.PleaseTryAgain��� Qf�B
;���Please try again.���Qez�
���Action.Reload���QcR�����Reload��QeG�
���Action.Submit���Qc�^E���Submit��0Qj��U/!���Description.VerifyingYouAreNotBot���(QhƼM-���Verifying you're not a bot��,Qi��[���Header.PleaseConfirmYouAreHuman�(QhBXO����Please Confirm You Are Human$Qg�4����Header.RobotChallenge���Qe���Y���Robot Challenge�$Qg68&���Message.Error.Default���@Qn���G3���An unknown error occurred while displaying captcha.�,QiP�t���Response.CaptchaNotEnteredError�(Qhj�i����Please fill out the Captcha�$QgJ�0w���Authentication.Captcha��Qe.Ƞ����CaptchaResources��aR�����Qe��
���Action.Cancel���Q��|����Cancel��$Qgr[�
���Action.ChangeMediaType��,Qi2OB���Use another verification method�$(QeBՌ�
���Action.Resend���Qd��֍���Resend Code�Qe6�Y���Action.StartOverQd~��_
���Start Over��,0Qe�W�
���Action.Verify���Qc�����Verify��Q�O����Description�-,Qi.��3���Description.Footer.GeneratedBy��DQo*[�6���This message was generated by {environmentIdentifier}.��,Qijl�� ���Description.SecurityWarningShort�Q�2�F�����{boldStart}IMPORTANT:{boldEnd} Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc.���8QlR��+���Description.SecurityWarningShortBackupCodes��Q�R�ŷ����{boldStart}IMPORTANT:{boldEnd} Don't share your backup codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc.�HQp>Que:���Description.TwoStepVerificationActivationEmail.Body.Over13��9Q5��
,*��Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Email for your Roblox account. For some actions like logging in, you will need to enter a 6-digit security code that Roblox sends to you via email.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��HQp�M��;���Description.TwoStepVerificationActivationEmail.Body.Under13�AQ="0��4��Hi,{lineBreak}{lineBreak}2-Step Verification with Email has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code that Roblox sends to you via email.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxDQobI4j6���Description.TwoStepVerificationActivationEmail.Subject��XQt��D&J���2-Step Verification with Email Activated for Roblox Account: {accountName}��LQq��&@���Description.TwoStepVerificationActivationSecurityKey.Body.Over13�Q�:��{����Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Security Key for your Roblox account. For some actions like logging in, you will need to have your security key.{lineBreak}{lineBreak}Roblox�PQr�zKA���Description.TwoStepVerificationActivationSecurityKey.Body.Under13����Q��?����Hi,{lineBreak}{lineBreak}2-Step Verification with Security Key has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to have their security key.{lineBreak}{lineBreak}Roblox��PQr�'�~A���Description.TwoStepVerificationActivationSecurityKey.EmailSubject���`Qv���Q���2-Step Verification with Security Key Activated for Roblox Account: {accountName}���HQpfMA9���Description.TwoStepVerificationActivationSMS.Body.Under13���=Q9�*�"0��Hi,{lineBreak}{lineBreak}2-Step Verification with SMS has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code that Roblox sends to you via SMS.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxHQpJQ2A9���Description.TwoStepVerificationActivationText.Body.Over13���IQE�J0:��Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Text Messages for your Roblox account. For some actions like logging in, you will need to enter a 6-digit security code that Roblox sends to you via text messages.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��HQpF�:���Description.TwoStepVerificationActivationText.Body.Under13��QQM*<oD��Hi,{lineBreak}{lineBreak}2-Step Verification with Text Messages has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code that Roblox sends to you via text messages.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxDQo�X�5���Description.TwoStepVerificationActivationText.Subject���`Qv³t�R���2-Step Verification with Text Messages Activated for Roblox Account: {accountName}��TQs�@*�G���Description.TwoStepVerificationAuthenticatorActivationEmail.Body.Over13��Q�N��ǚ��Hi {accountName},{lineBreak}{lineBreak}You have activated 2-Step Verification with Authenticator for your Roblox account. For some actions like logging in, you will need to enter a 6-digit security code from the Authenticator App.{lineBreak}{lineBreak}Remember to save your backup codes in case you don't have access to the Authenticator app.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��TQsb�"H���Description.TwoStepVerificationAuthenticatorActivationEmail.Body.Under13�Q�:����Hi,{lineBreak}{lineBreak}2-Step Verification with Authenticator has been activated for your child's Roblox account, {accountName}. For some actions like logging in, they will need to enter a 6-digit security code from the Authenticator app.{lineBreak}{lineBreak}Remember to save your backup codes in case you don't have access to the Authenticator app.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxPQr^��C���Description.TwoStepVerificationAuthenticatorActivationEmail.Subject�`Qv&���R���2-Step Verification with Authenticator Activated for Roblox Account: {accountName}��dQwʬJ�X���Description.TwoStepVerificationAuthenticatorCustomerSupportDeactivationEmail.Body.Over13iQeZ��.[��Hello {accountName},{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Authenticator for your Roblox account.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code from an Authenticator app will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in�your {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox�hQx6��&Y���Description.TwoStepVerificationAuthenticatorCustomerSupportDeactivationEmail.Body.Under13���mQi�<��^��Hello,{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Authenticator on your child's Roblox account, {accountName}.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code from an Authenticator app will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��`Qv�J#1T���Description.TwoStepVerificationAuthenticatorCustomerSupportDeactivationEmail.Subject`Qv���S���2-Step Verification with Authenticator Deactivated by Roblox Support: {accountName}�XQtJn�I���Description.TwoStepVerificationAuthenticatorDeactivationEmail.Body.Over13���9Q5��{[)��Hello {accountName},{lineBreak}{lineBreak}You have deactivated 2-Step Verification with Authenticator for your Roblox account. A security code from an Authenticator app will no longer be required for some actions like logging in.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox���XQt�ڥ,J���Description.TwoStepVerificationAuthenticatorDeactivationEmail.Body.Under13��AQ=Zߺ�2��Hello,{lineBreak}{lineBreak}2-Step Verification with Authenticator has been deactivated for your child's Roblox account, {accountName}. A security code from an Authenticator app will no longer be required for some actions like logging in.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox��TQs�Z$E���Description.TwoStepVerificationAuthenticatorDeactivationEmail.Subject���`Qv2��VT���2-Step Verification with Authenticator Deactivated for Roblox Account: {accountName}\Qu&��O���Description.TwoStepVerificationCustomerSupportDeactivationEmail.HtmlBody.Over13�IQE���d9��Hello {accountName},{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Email for your Roblox account.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in�your {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}Roblox���\Qu��TRP���Description.TwoStepVerificationCustomerSupportDeactivationEmail.HtmlBody.Under13IQE�6<��Hello,{lineBreak}{lineBreak}This message is to notify you that�our support team has deactivated 2-Step Verification with Email on your child's Roblox account, {accountName}.�This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security code will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance,�{spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here:�{aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}IMPORTANT: Don't share your security codes with anyone. Roblox will never ask you for your codes. This can include things like texting your code, screensharing, etc. By sharing your security codes with someone else, you are putting your account and its content at high risk.{lineBreak}{lineBreak}RobloxTQs�hw�G���Description.TwoStepVerificationCustomerSupportDeactivationEmail.Subject�XQtR�#�K���2-Step Verification with Email Deactivated by Roblox Support: {accountName}�dQw�KU���Description.TwoStepVerificationCustomerSupportDeactivationSecurityKey.HtmlBody.Over13���%Q!B�æ��Hello {accountName},{lineBreak}{lineBreak}This message is to notify you that our support team has deactivated 2-Step Verification with Security Key for your Roblox account. This typically occurs due to a support ticket you submitted or as a security measure to ensure the safety of your account. A security key will no longer be required for some actions like logging in. You can reactivate 2-Step Verification in your {aTagStartWithHref}{AccountSettingsPageLink}{hrefEnd}account settings{aTagEnd}.{lineBreak}{lineBreak}If you need further assistance, {spanStartTagWithBold}do not reply to this email{spanEndTag}, and reply to your existing support ticket or submit a new support request here: {aTagStartWithHref}{supportPageLink}{hrefEnd}Roblox Support{aTagEnd}.{lineBreak}{lineBreak}Roblox�dQw*F�#V���Description.TwoStepVerificationCustomerSupportDeactivationSecurityKey.HtmlBody.Under13��)Q%�&�"��Hello,{lineBreak}{lineBreak}This message is to notify you that our support team has deactivated 2-Step Verification with Security Key on your child's Roblox account, {accountName}. This typically occurs due to a support ticket you submitted or as a security meas
Targets
-
-
Target
https://drive.google.com/file/d/17oDc8BG7ks1itmLf1QHVmCNDvkdbLxTS/view?usp=sharing
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-