Analysis
-
max time kernel
1799s -
max time network
1693s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 20:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.roblox.com
Resource
win10v2004-20231023-en
Behavioral task
behavioral2
Sample
http://www.roblox.com
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral3
Sample
http://www.roblox.com
Resource
android-x64-20231023.1-en
Behavioral task
behavioral4
Sample
http://www.roblox.com
Resource
android-x64-arm64-20231023-en
General
-
Target
http://www.roblox.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133455029311209000" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1416 chrome.exe 1416 chrome.exe 3376 chrome.exe 3376 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe Token: SeShutdownPrivilege 1416 chrome.exe Token: SeCreatePagefilePrivilege 1416 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe 1416 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1416 wrote to memory of 3992 1416 chrome.exe 70 PID 1416 wrote to memory of 3992 1416 chrome.exe 70 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 1276 1416 chrome.exe 85 PID 1416 wrote to memory of 3960 1416 chrome.exe 86 PID 1416 wrote to memory of 3960 1416 chrome.exe 86 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87 PID 1416 wrote to memory of 4648 1416 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.roblox.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe52059758,0x7ffe52059768,0x7ffe520597782⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:22⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:82⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:12⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4568 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:12⤵PID:996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:82⤵PID:636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3688 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD58bd0b4f349f638a6a973570bc273de40
SHA120b3c81df40d3800576400b2db5a5e5f63f56270
SHA256a2713e59e821583c5f9ebf7cb4da2dc7648b9fdcbc3b13bf0d96b00411566445
SHA512f1ed023adb76d71bea57e8cd15c72245fdcb8d1b0a7eaffdad6ca664b0b95f1ffe5b19fd86c66b45eff176061210aabcbef4348d93f552864d3d397325aa08b8
-
Filesize
2KB
MD52215a4baa2fa8561f62008f473fc4166
SHA12961bc36daf27fd05e34a0674998ac6c95bbaa4e
SHA256730718e3609922fca37ac2f67b9fe8b8a01f84c2092b791fc1a031f0c59dcc1c
SHA5121ad5c130c8b15696d0a186958f0961f18519bc7623350787100ad676d99f734de5303c262cbd67f84b21b5915056bc6cebf190d3117ea6f6e17cf6fb7b4613a3
-
Filesize
2KB
MD593bb4e91440c1dcc3f34f668374e7af5
SHA13b5e7f1d3d4b9f18a2c70c9b365704c527cd225b
SHA256358e38f5fafbd0d4572426ec853b1e9d633ed57ae6840535e92cff6c5c642ac0
SHA51232ecc915d36ccc76f7ff440bfea11fd912445e0143e4287ea6215e33f66573be41e97ecdd924157769ed94bfed71f61540aeaf9a865a1497d61c416ff5e253d9
-
Filesize
1KB
MD53bca2aeea3b74b1a72ec9a1160276fa2
SHA1d0945782906769067173100f142a1f38d09bc29b
SHA256c15aa64f3c95ceb9c50401bd2de8f670c76234b8e0d44f027dc6f42f349b831b
SHA5127c9a3e7d8e61f5d85ac301e80619b602b445febecf9a26d159b8f6b37e81efbec603aeccce2faeb0d177a4cd13adf3a6b1eb286c103a24272e8f576ad345cc0d
-
Filesize
1KB
MD58641f89b76beb6e9fad18bfcbe314aca
SHA108d5a5efed012d0af9a5b687649bb5fca40f4f54
SHA256f0403c1456dd5188c8de3179fb1084fb4aea01d3b40b73982cab48f2b89cb6cb
SHA51249d5f5c2523dad29392efc35dae3336c0fcf9e5b03adfe424b18c7ac91027cb8c4f72b9dda3224411c537bd8cb19a766e65501893e9779120e60bd9a1b137c4d
-
Filesize
1KB
MD5c68ac2e980ba8e0fa905d11a1860e15b
SHA1579665141e2c4bf7dad1e566fd00fe5239f389ec
SHA256b19dd66aa5ff480f3204ef187e038ad0358c3213e9d86203915a17cc875608c0
SHA512b6e6e9335cb07d87b58b1799a84092dc24749fdd972d5e090bdf30b55cb8a9ca2438af41e785217f4e59ea8cf5a77d7ce19ae24cebfcf686c56077ff0b0e8ffe
-
Filesize
1KB
MD599a25126a27d18d117eefeb50028ce51
SHA18d7d6767a6e3006e4fcdfaa841bbb13523e030c4
SHA256d0c9dddd9148ca83f55c70a47374683349a03405355bf63fe014479f1d42ca17
SHA512d1dd67a7f0ec03d3d16b8ab51fc11c3d9b7aecc5bdc9d9334eb651233133cfc411c3f69bc6f2ced196d535d73fb54451d09f83f3dec765dceb24b16714ec9b2e
-
Filesize
6KB
MD512d386c54605d6d65f18e40e547dd188
SHA15cbe3b86b3d49a87a447e5b2bda44c2ce3fc7b3e
SHA256c7507545ce60202bc00372461e835e2e856731d603fd20565b86217503e987ba
SHA512eec5d58054db57d037640e58074691c3ce2a3a1283c70aa430f98b7f1c74938a68afa033ce7aec31ff713484558628db69aac836ed0f5e9bbca4442b54411b0c
-
Filesize
109KB
MD5097874837763372b64f712cc7b927d7f
SHA1817907fc70db83326ea2b3bdaa2f5ac3eaa64df6
SHA256b1912ca713ca7a1b5cb644de6e3c0993cd255e2b916ee3e024c3e98d6a757fd9
SHA51275f524fe74e0ca86af7498229d4f5362f1462a7a5c2ace6c849ed0fe99ef03fc37dd09d64800e601f869d3c59e63b54b009c656514cf7831fa3e4a84aded71b3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd