Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

RobloxStud...ta.exe

windows10-1703-x64

7

RobloxStud...ta.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    30s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2023, 03:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxStudioLauncherBeta.exe

  • Size

    1.7MB

  • MD5

    0d3ad3e8536c7fc109a6e0d7d0f4602f

  • SHA1

    50b2854b85c719219eb90fea2b9840a679dbb951

  • SHA256

    3cb2387973d95e8f14981163e2c4c99c1276d76aecd1799817bfea0b853c7dc0

  • SHA512

    0f22959e4ca8cf3519ac7d0700daa57dcd96d847e111f1b68327fd2b136d622ebd0a1fb6449ab4bfc0acd864a57fd00faf02c0c2d05aeb900f411686638fe2aa

  • SSDEEP

    49152:4Gd7ZRerhHUnGcy3pzM83MgIUwpsRX43TRaWapvM9T3YMoPMQ3dACETfA:4GBZRerhH4y3pzM83MgIe

Score
7/10
discoveryevasionspywarestealertrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe
      C:\Users\Admin\AppData\Local\Temp\RobloxStudioLauncherBeta.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=75e94a4b5553853bd615ec818ff02126b395c631 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x72c,0x730,0x734,0x698,0x73c,0x39d440,0x39d450,0x39d460
      2⤵
        PID:2064
      • C:\Users\Admin\AppData\Local\Temp\RBX-37D5A734\RobloxStudioLauncherBeta.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-37D5A734\RobloxStudioLauncherBeta.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Users\Admin\AppData\Local\Temp\RBX-37D5A734\RobloxStudioLauncherBeta.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-37D5A734\RobloxStudioLauncherBeta.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=d54eeff5ddfebd99f3acde55a60ecc06b0ab0dd0 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=0 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x548,0x54c,0x550,0x464,0x574,0x11c8150,0x11c8160,0x11c8170
          3⤵
          • Executes dropped EXE
          PID:4988

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Roblox\Versions\version-cb457944642b4d94\RobloxStudioLauncherBeta.exe
      Filesize

      4.6MB

      MD5

      f485f0b60d93b0e5aa330765728fe8d1

      SHA1

      9254daf60ba5ce32af57ba27217d628b5a445383

      SHA256

      ad7e4eecff78f1253ea0d29150caacb7e6d3a743b43881db32619ede3054c9bf

      SHA512

      1595a81ada9bdebf7eae5a37cc008ff570427cade4ace2fa8ea6e440846fe9420c8e6922eb8e70ba940bf17ba7b2e7540f36efd60e6f1a53b3834bb9f02f1e7c

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1ERYC57B\WindowsStudio64[1].json
      Filesize

      119B

      MD5

      ff5955127bbd9bd6590034f227d3d690

      SHA1

      0a621a80ff868c5911f0e821c320abf1cb339c9b

      SHA256

      3dd3dea0264ff8ffb29c778508c7fb432dcb7fb3bfc5fdd5f36f26a53b921a14

      SHA512

      351c5351d3ef189bffe31bf574332ee2921a90c2818dadf242f476bb642a2a8094f1f3b4e6f0e9058e01a4509c5c04eb53df984dcc19139dff08994f834981ad

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\42JDD8EA\PCStudioBootstrapper[1].json
      Filesize

      3KB

      MD5

      23ab36ab33805ce1927a9d8a6c60ad91

      SHA1

      6abaea5341d4a593fd77d9cec9cc7f718e078cdb

      SHA256

      846289a8cc33556e8bbe968a0f4e9e776fe2d488bf9e630ac56dfd9ff21eb4ca

      SHA512

      a3c35af87b688d330eaacdd2cc34bb5d22b3345f2a48fbe70e978729ec35ae5a02d4dde6c486ab320f5ee9bbf6810b2ed8c2a6fa55617a09635c0e991ca91e4b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZYPP69YI\BatchIncrement[1].json
      Filesize

      163B

      MD5

      bedbf7d7d69748886e9b48f45c75fbbe

      SHA1

      aa0789d89bfbd44ca1bffe83851af95b6afb012c

      SHA256

      b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

      SHA512

      7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZYPP69YI\version-cb457944642b4d94-rbxPkgManifest[1].txt
      Filesize

      2KB

      MD5

      11b1b76e664878f4488c0847be7f0269

      SHA1

      b08d2c9b2dce71f9f873ef5940083123ff7eacff

      SHA256

      761e1f1583704e69bb9221776845a9cb5b6155e65fc6c734bf5cec1ec5d2568e

      SHA512

      f300bdd56398d0baf26868b00b96f6083f6323b739907c8747593457f90de8ad63a8c568faadc87c4e0212504ab0d1c15d7b4208f265197bc0a4ba87e6c94df3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\RBX-37D5A734\RobloxStudioLauncherBeta.exe
      Filesize

      4.6MB

      MD5

      f485f0b60d93b0e5aa330765728fe8d1

      SHA1

      9254daf60ba5ce32af57ba27217d628b5a445383

      SHA256

      ad7e4eecff78f1253ea0d29150caacb7e6d3a743b43881db32619ede3054c9bf

      SHA512

      1595a81ada9bdebf7eae5a37cc008ff570427cade4ace2fa8ea6e440846fe9420c8e6922eb8e70ba940bf17ba7b2e7540f36efd60e6f1a53b3834bb9f02f1e7c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\RBX-37D5A734\RobloxStudioLauncherBeta.exe
      Filesize

      4.6MB

      MD5

      f485f0b60d93b0e5aa330765728fe8d1

      SHA1

      9254daf60ba5ce32af57ba27217d628b5a445383

      SHA256

      ad7e4eecff78f1253ea0d29150caacb7e6d3a743b43881db32619ede3054c9bf

      SHA512

      1595a81ada9bdebf7eae5a37cc008ff570427cade4ace2fa8ea6e440846fe9420c8e6922eb8e70ba940bf17ba7b2e7540f36efd60e6f1a53b3834bb9f02f1e7c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\RBX-37D5A734\RobloxStudioLauncherBeta.exe
      Filesize

      4.6MB

      MD5

      f485f0b60d93b0e5aa330765728fe8d1

      SHA1

      9254daf60ba5ce32af57ba27217d628b5a445383

      SHA256

      ad7e4eecff78f1253ea0d29150caacb7e6d3a743b43881db32619ede3054c9bf

      SHA512

      1595a81ada9bdebf7eae5a37cc008ff570427cade4ace2fa8ea6e440846fe9420c8e6922eb8e70ba940bf17ba7b2e7540f36efd60e6f1a53b3834bb9f02f1e7c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
      Filesize

      40B

      MD5

      7ab395fa0d80f65fc97cd151909b0ac0

      SHA1

      aaf7d47c9dbbd01f31ac6957fdea56efc858f069

      SHA256

      876f5232e51cf0c238e0e02004eedf683f0989ec5addccff249c74524eda2561

      SHA512

      c8a8b5d22bb8a96ac39e3ef47b9ae87bc74d18e8899349f3df0509efda96820ff04ef4b2510eeab0d788e213c15dc324a2c26785abc2b2503d8f7e628bd8ab29

      Download Submit