ae6434d516885984b2fbfb64c0523f790ea0cb3d2dd6f3afd63b0796917e956c

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ByGay/ROBUX_ARE_A_SCAM.exe
Size

16.2MB
MD5

e24864e9bcf7dc106f841656f5b55b32
SHA1

0a6a9830dcaf89b8a6b1ae5b15c253695e85dcd6
SHA256

bb1d826d6fee4dd4d7a55ad2787bfe9856575f430867e7830371a462f3bad669
SHA512

7a10ae8beeac4154b4f4875925dde7ca20d2fe23e23ed7b8646472133f68e9cdbc0c3e46ab5615d16351d57768c9cae080f6305c74456ba87a87e01399fb7da1
SSDEEP

196608:AVMSJG5ENxkXCuzxLhbhLyIfUnOO8zojAYHXYR8mTRzBp8oH:AHJG5ENxkXCuzxLhbhLjfUOOn33wTZ8O

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\msvcrt.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\NSI.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\advapi32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\winmm.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\DUser.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\KERNELBASE.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\SHLWAPI.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\iertutil.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\kernel32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\USP10.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\wsock32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\psapi.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\wininet.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\normaliz.DLL	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\DUI70.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\oleaut32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\CFGMGR32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\LPK.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\opengl32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\GLU32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\DCIMAN32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\comdlg32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\ws2_32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\USER32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\DDRAW.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\GDI32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\RPCRT4.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\dwmapi.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\CRYPTBASE.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\ole32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\SYSTEM32\sechost.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\imm32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\msimg32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\CLBCatQ.DLL	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\propsys.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\MSCTF.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\version.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\shell32.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\DEVOBJ.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\SETUPAPI.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	ROBUX_ARE_A_SCAM.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll	ROBUX_ARE_A_SCAM.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll	ROBUX_ARE_A_SCAM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2152	ROBUX_ARE_A_SCAM.exe
2152	ROBUX_ARE_A_SCAM.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeTcbPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeTcbPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeLoadDriverPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeCreateGlobalPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeLockMemoryPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: 33	2152	ROBUX_ARE_A_SCAM.exe
Token: SeSecurityPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeTakeOwnershipPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeManageVolumePrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeBackupPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeCreatePagefilePrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeShutdownPrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: SeRestorePrivilege	2152	ROBUX_ARE_A_SCAM.exe
Token: 33	2152	ROBUX_ARE_A_SCAM.exe
Token: SeIncBasePriorityPrivilege	2152	ROBUX_ARE_A_SCAM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	ROBUX_ARE_A_SCAM.exe

C:\Users\Admin\AppData\Local\Temp\ByGay\ROBUX_ARE_A_SCAM.exe
"C:\Users\Admin\AppData\Local\Temp\ByGay\ROBUX_ARE_A_SCAM.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Filesize
4KB

Download
memory/2152-3-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Filesize
4KB

Download
memory/2152-7-0x0000000003E30000-0x0000000003E31000-memory.dmp

Filesize
4KB

Download
memory/2152-11-0x0000000003E40000-0x0000000003E41000-memory.dmp

Filesize
4KB

Download
memory/2152-15-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

Filesize
4KB

Download
memory/2152-27-0x0000000007EB0000-0x0000000007EB1000-memory.dmp

Filesize
4KB

Download
memory/2152-19-0x0000000007EB0000-0x0000000007EB1000-memory.dmp

Filesize
4KB

Download
memory/2152-39-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

Filesize
4KB

Download
memory/2152-35-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

Filesize
4KB

Download
memory/2152-31-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

Filesize
4KB

Download
memory/2152-40-0x0000000008020000-0x0000000008021000-memory.dmp

Filesize
4KB

Download
memory/2152-49-0x0000000008020000-0x0000000008021000-memory.dmp

Filesize
4KB

Download