Overview

overview

8

Static

static

1

RobloxPlay...er.exe

windows10-1703-x64

8

Analysis

  • max time kernel
    97s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-03-2023 18:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    2.0MB

  • MD5

    6b68f3be3850e9b2ac03bad9f4de5b88

  • SHA1

    57c59090e38d6e0128874ed93f53a4e3c65ee47b

  • SHA256

    159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

  • SHA512

    de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

  • SSDEEP

    49152:UUvIzhIhn1g5yca9e3j8ITYMao+8k1TymMYPMQ3dS/BTXsb6Hrvd:USnhn6yca9ezeEsbg

Score
8/10
discoveryevasionspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5f8,0x6f8,0x5f0,0x568,0x608,0xd1b480,0xd1b490,0xd1b4a0
      2⤵
        PID:4492
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4024
      • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
        "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" -app
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
          "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x664,0x668,0x66c,0x5f4,0x674,0xf8b480,0xf8b490,0xf8b4a0
          2⤵
          • Executes dropped EXE
          PID:4232
        • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
          "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:376
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0xf8
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4112
      • C:\Windows\System32\GameBarPresenceWriter.exe
        "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
        1⤵
          PID:4932
        • C:\Windows\System32\GamePanel.exe
          "C:\Windows\System32\GamePanel.exe" 00000000000901D8 /startuptips
          1⤵
          • Drops desktop.ini file(s)
          PID:5072
        • C:\Windows\System32\bcastdvr.exe
          "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
          1⤵
            PID:4348

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
            Filesize

            2.0MB

            MD5

            2c3024c6aec09f36db69877db35f8e4b

            SHA1

            b582af99bd6ba14ae8fd28bc1cbbaec7b4df393d

            SHA256

            ee27f9cd887945d699f4a3f406e59c49076f38cef50976821d6439c0ab356a7e

            SHA512

            f2741ada8dea5939075baf3da61462ccd9430c005eb07f3354abd2f686ce83603f401655adb9e990d45808404c3b48d891f7d04e00766bf2904cd12a60a1e23a

            Download Submit
          • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\AppSettings.xml
            Filesize

            149B

            MD5

            48f58abeaac832f838efd2beb25f4c90

            SHA1

            7878e28b62e5d9bc9042a3e44094e39668f03384

            SHA256

            893a58e7946728c9dd5caac10e5bdc306a465e406c1f979ded52a13dafebce2d

            SHA512

            c5e3025b63eead12a0f8192ea41afd1216dd87b14a07d22ebafc6d3d899a06e80da947b3fcd1b3f2cf53b89b3de9967f89c415394d66c277556373b620dc827e

            Download Submit
          • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
            Filesize

            58.0MB

            MD5

            cd199f81c3a2cbdbf8ede573d6c19013

            SHA1

            f0fb145f124ac1d299a34ca7efaf98eb946718e1

            SHA256

            87da9bc3377e4503712a5fa01f1b4560effd3908cf25257f9c639ea671b34a78

            SHA512

            f06dde6f9ea5bf11d876b117a33f46a8ae5a22ecdf8fc768af4d975b626661e89ca7a866585131b1c4289a2038e8bccd28dee13b570ab4c37e1eef7ee037b08d

            Download Submit
          • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
            Filesize

            2.0MB

            MD5

            6b68f3be3850e9b2ac03bad9f4de5b88

            SHA1

            57c59090e38d6e0128874ed93f53a4e3c65ee47b

            SHA256

            159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

            SHA512

            de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

            Download Submit
          • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
            Filesize

            2.0MB

            MD5

            6b68f3be3850e9b2ac03bad9f4de5b88

            SHA1

            57c59090e38d6e0128874ed93f53a4e3c65ee47b

            SHA256

            159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

            SHA512

            de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

            Download Submit
          • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
            Filesize

            2.0MB

            MD5

            6b68f3be3850e9b2ac03bad9f4de5b88

            SHA1

            57c59090e38d6e0128874ed93f53a4e3c65ee47b

            SHA256

            159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

            SHA512

            de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

            Download Submit
          • C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
            Filesize

            2.0MB

            MD5

            6b68f3be3850e9b2ac03bad9f4de5b88

            SHA1

            57c59090e38d6e0128874ed93f53a4e3c65ee47b

            SHA256

            159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

            SHA512

            de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
            Filesize

            1KB

            MD5

            afeb947700934e6495db2ef5ea714989

            SHA1

            04b3bf94f26b6721dbcc1a82bca036c02a911c49

            SHA256

            4f5e96a0e628ca7309c330d38643b917c965130949cef8fa342f2f478341f187

            SHA512

            ddf567306b9ea5439efc12896df20f05568694fd645641f98a1a156e58948e82fd06649a6f0f1ac37b176f5c52d99ddd25d72ec0d63c85ee8235b2c1a5e3bd70

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
            Filesize

            471B

            MD5

            21ed9ca0f4579a63723066fab3cdb1e9

            SHA1

            625f8780cba0177fa7d9b747df0bd45511ddc900

            SHA256

            818a6653f6011a83d251998208826644fe68d228a739c87ec14e470e10817889

            SHA512

            203e8fa995dfd86617536e1fc445fa1fdfbc0ec462d238cfbfe1d03c81b51c81297335c4c54503070c25897858fbedd659c348ab994f9195635ff75a0f3ecda4

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
            Filesize

            1KB

            MD5

            71288df6e69e139111a733ad7b94866a

            SHA1

            9f756b5bdddb2eae7e7bf2678440117026ea8b54

            SHA256

            7441007a5974bcfdee443d0c1fe1c40d7e7f454fc0712501eb7abda978877837

            SHA512

            efab7742dd31b5397da0bf2940e9bb8de89702c39b6f062194caa33b31346ee646a3b4c622e9bc42b4ea9ed94772098476a5e87ccdfd8af0be58a7a153ffc9e0

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
            Filesize

            450B

            MD5

            bbc82e4840fa12af811d8c8db10cc228

            SHA1

            ccd799c03b5a792f6dda887164e796b3ba354e81

            SHA256

            bbbb8da982cf40373e92cd4d43e8c6248f2aa2d7ca2c00bf9aaf068cb9a0f396

            SHA512

            bac5c5fcf8c0c67545af26a75ba568dda94812330c502fd3b61d30a90116d847dcc5ed7fc75d1526f422605a08e9a39a24da5153441090f15b7f193696393e4a

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
            Filesize

            430B

            MD5

            429d075021d0fe423de9eaff8fd855c9

            SHA1

            a89f5993b10967a21cc5ddd0131b83fe3bd1c738

            SHA256

            4519f01ae530a6bc0166a0a2f259ba6c26d68aca78e78d312c42177c240e853d

            SHA512

            7632263dc6dbd5bf6a73d797329d4ac04f412ee0720fe517e2d88340fc9460c668958bc301784898a02f8d282da7bc3e5519eabf5eba6e40b64bd61df5f801df

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
            Filesize

            458B

            MD5

            0d02e53f18fa55e9524fc57d74904acb

            SHA1

            5be1185883dac9aae8c0d8613eb509a81e7ba3f1

            SHA256

            71c94455c0ce9db96fc59893b8726e25aa18290aeb0af7204f5b1f8c41f0080f

            SHA512

            9f1064f4f6ce058e2b52aa2fab5d5624d31690b665f394fceffcd0c0683286933ac58cb690925fc754f6fbd9bfa44bd5a38562adb1b50b43e6bb194a4e48e430

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\480JMPRZ\BatchIncrement[3].json
            Filesize

            163B

            MD5

            bedbf7d7d69748886e9b48f45c75fbbe

            SHA1

            aa0789d89bfbd44ca1bffe83851af95b6afb012c

            SHA256

            b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

            SHA512

            7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6RO0PN6W\PCClientBootstrapper[1].json
            Filesize

            2KB

            MD5

            38cbbb5f3278aeeb9f6daba52e5e9ce5

            SHA1

            c197d71650c07bb77f42d92486160b53265081fb

            SHA256

            f7a1729c635c16792107e96d9387039044d4f99ad3e7f8407a9d863cd98835e2

            SHA512

            9e0078d19e14ca99d694de4b3863cc15afa72effa6bac49dcdafb6127ee2b8702b83a0c3121b9e822f54ed78f7df95106d8b588b158df5b82846ffe8e4926c5f

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O4HR65AL\WindowsPlayer[1].json
            Filesize

            119B

            MD5

            8e7e1124df5cb13bde562332564be4a4

            SHA1

            37314dc17a1a5635581abbaedff6ab677469a334

            SHA256

            fca98f982f815aaa96f89bb30515e35e5dde746fcd175fe987d5d885d0a8b4b0

            SHA512

            2f16df7776ff2d8e3ec1288ecc9f333553e875c2040f83677a1ca0b6f0ad664b957a0a71001f11cd5721a13c1b0a38e1cce29239c772ced1b9ca689b474b1d8c

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O4HR65AL\WindowsPlayer[1].json
            Filesize

            119B

            MD5

            8e7e1124df5cb13bde562332564be4a4

            SHA1

            37314dc17a1a5635581abbaedff6ab677469a334

            SHA256

            fca98f982f815aaa96f89bb30515e35e5dde746fcd175fe987d5d885d0a8b4b0

            SHA512

            2f16df7776ff2d8e3ec1288ecc9f333553e875c2040f83677a1ca0b6f0ad664b957a0a71001f11cd5721a13c1b0a38e1cce29239c772ced1b9ca689b474b1d8c

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0J5Y6UEM.cookie
            Filesize

            69B

            MD5

            88b938531381c6f56369c1e2584fdce4

            SHA1

            734bcd9406c6866f2e6c445908435301707893aa

            SHA256

            f37c8531edeeed3b0c16e4e7cdeeaffc68f87f8403d28428d3432a81b03bc9fe

            SHA512

            3c5d13c2cff0512fd873c9e2388c6a7ca9abdf91e0df5c2082badfacfcf5d9a6745b1d3874929aa752f401bce66626ce6f1afe837e22cc4a3c30d1b462840655

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
            Filesize

            40B

            MD5

            9e6d49b033f69a71a0e611d76f4760b3

            SHA1

            38ba1a4f9485273829111870a9fea34af8f1a506

            SHA256

            f4c7f213d1542bd5c8c171fe178b19da1c7b9ed3f490c5e7f3f3a0c33389108e

            SHA512

            99f936857e427a4c1554a47b039a854c4f7c9890152bb9a34393d78acb301d9f700256dda38eb8c369867d1ff03f30c7cd5f15397700cd676b6c97be7df633ae

            Download Submit
          • C:\Users\Admin\Videos\Captures\desktop.ini
            Filesize

            190B

            MD5

            b0d27eaec71f1cd73b015f5ceeb15f9d

            SHA1

            62264f8b5c2f5034a1e4143df6e8c787165fbc2f

            SHA256

            86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

            SHA512

            7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

            Download Submit
          • memory/376-346-0x00000000065F0000-0x00000000065F1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/376-348-0x00000000068F0000-0x00000000068F1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/376-349-0x0000000006900000-0x0000000006901000-memory.dmp
            Filesize

            4KB

            Download
          • memory/376-350-0x0000000006910000-0x0000000006911000-memory.dmp
            Filesize

            4KB

            Download
          • memory/376-351-0x0000000000DD0000-0x00000000064FA000-memory.dmp
            Filesize

            87.2MB

            Download
          • memory/376-347-0x00000000068E0000-0x00000000068E1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/376-345-0x00000000065E0000-0x00000000065E1000-memory.dmp
            Filesize

            4KB

            Download