Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RobloxPlayerInstaller.exe
-
Size
4.5MB
-
Sample
231102-mg7wcaae4y
-
MD5
32941ed3588da058b120375bbe77c6d8
-
SHA1
4fc873c3200a65205053d2d04989b407df0ade70
-
SHA256
8f3fe55480388b43e385ca4e240f77cae90b37c4da3285af3da76495c7f4c440
-
SHA512
19ee5c5c0ceacca7bcc4ca7d41026da6525d2771d33cefd5a8511c5b922d98d8c281a6ae794a4e1d73efd8c4831daf7e7854744b051a191e2c4a1f495ab21d83
-
SSDEEP
98304:nwveaNoe1sGM8cRSMDtLRDgcaV2RDnYsKxS0S4Obkm:YTNnm85sgcX50/OJ
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerInstaller.exe
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
RobloxPlayerInstaller.exe
Resource
win10v2004-20231020-en
Malware Config
Targets
-
-
Target
RobloxPlayerInstaller.exe
-
Size
4.5MB
-
MD5
32941ed3588da058b120375bbe77c6d8
-
SHA1
4fc873c3200a65205053d2d04989b407df0ade70
-
SHA256
8f3fe55480388b43e385ca4e240f77cae90b37c4da3285af3da76495c7f4c440
-
SHA512
19ee5c5c0ceacca7bcc4ca7d41026da6525d2771d33cefd5a8511c5b922d98d8c281a6ae794a4e1d73efd8c4831daf7e7854744b051a191e2c4a1f495ab21d83
-
SSDEEP
98304:nwveaNoe1sGM8cRSMDtLRDgcaV2RDnYsKxS0S4Obkm:YTNnm85sgcX50/OJ
Score8/10-
Downloads MZ/PE file
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-