Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
Sample
230510-xq3m4abe7z
-
MD5
42fcd3d0e49864500ac6073e7b707de6
-
SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71
-
SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493
-
SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0
-
SSDEEP
49152:V1nMMd+fOXoWucxT08a2vJLfTj/MQPMQ3dSt9Tegb6oNpk:vVd+GXoWu5AgblM
Static task
static1
Malware Config
Targets
-
-
Target
RobloxPlayerLauncher.exe
-
Size
2.0MB
-
MD5
42fcd3d0e49864500ac6073e7b707de6
-
SHA1
d6f4b225dbd68d3729b0ea086e95f502aae2ef71
-
SHA256
4ecffe7e26029ad210d6fcddd2682902aa0d82232f80fd165e35a23e9ddca493
-
SHA512
73e9bf81cade019253262ac9e1cc156e1a76a05d7f9327b6a95fff2a5eecbf7cdeec471303fcf3979214335a8ec4d3b38da96c8676d361e133d6dde65e03dcf0
-
SSDEEP
49152:V1nMMd+fOXoWucxT08a2vJLfTj/MQPMQ3dSt9Tegb6oNpk:vVd+GXoWu5AgblM
-
Downloads MZ/PE file
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-