Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

RobloxSetup.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RobloxSetup.exe

  • Size

    26.1MB

  • Sample

    230921-ar3yxsde22

  • MD5

    c79e90564080d73fe684edc6ed39a025

  • SHA1

    dff2d51da979cdddf7d07ae2f8fbb3ce6b648ad3

  • SHA256

    5c40544e66d7b1148b8bf00c87729c9c63ab4df7996d74bc65b653732819f972

  • SHA512

    ad8325d29f20db3d96e1676c282b4ee1cf3249db4fdc49750f2222c450b6a08da045ea502e88f27aa4fd07aeaf19244c16852771339cee96ea23dbbfd8dddeef

  • SSDEEP

    786432:tmG5vsZW4EwupQjGE2RVGu04zpbWQVYe473/Thrrd:tmcpd5Eid9pWQueu/Thrh

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      RobloxSetup.exe

    • Size

      26.1MB

    • MD5

      c79e90564080d73fe684edc6ed39a025

    • SHA1

      dff2d51da979cdddf7d07ae2f8fbb3ce6b648ad3

    • SHA256

      5c40544e66d7b1148b8bf00c87729c9c63ab4df7996d74bc65b653732819f972

    • SHA512

      ad8325d29f20db3d96e1676c282b4ee1cf3249db4fdc49750f2222c450b6a08da045ea502e88f27aa4fd07aeaf19244c16852771339cee96ea23dbbfd8dddeef

    • SSDEEP

      786432:tmG5vsZW4EwupQjGE2RVGu04zpbWQVYe473/Thrrd:tmcpd5Eid9pWQueu/Thrh

    Score
    8/10
    discoverypersistence

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks