Analysis

  • max time kernel
    1799s
  • max time network
    1693s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2023 20:08

General

  • Target

    http://www.roblox.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.roblox.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe52059758,0x7ffe52059768,0x7ffe52059778
      2⤵
        PID:3992
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:2
        2⤵
          PID:1276
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:8
          2⤵
            PID:3960
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:8
            2⤵
              PID:4648
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:1
              2⤵
                PID:3000
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:1
                2⤵
                  PID:968
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4568 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:1
                  2⤵
                    PID:996
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:8
                    2⤵
                      PID:636
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:8
                      2⤵
                        PID:3804
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3688 --field-trial-handle=1868,i,18247770132459258340,11862459005716113568,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3376
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:4344

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        2KB

                        MD5

                        8bd0b4f349f638a6a973570bc273de40

                        SHA1

                        20b3c81df40d3800576400b2db5a5e5f63f56270

                        SHA256

                        a2713e59e821583c5f9ebf7cb4da2dc7648b9fdcbc3b13bf0d96b00411566445

                        SHA512

                        f1ed023adb76d71bea57e8cd15c72245fdcb8d1b0a7eaffdad6ca664b0b95f1ffe5b19fd86c66b45eff176061210aabcbef4348d93f552864d3d397325aa08b8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        2215a4baa2fa8561f62008f473fc4166

                        SHA1

                        2961bc36daf27fd05e34a0674998ac6c95bbaa4e

                        SHA256

                        730718e3609922fca37ac2f67b9fe8b8a01f84c2092b791fc1a031f0c59dcc1c

                        SHA512

                        1ad5c130c8b15696d0a186958f0961f18519bc7623350787100ad676d99f734de5303c262cbd67f84b21b5915056bc6cebf190d3117ea6f6e17cf6fb7b4613a3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        93bb4e91440c1dcc3f34f668374e7af5

                        SHA1

                        3b5e7f1d3d4b9f18a2c70c9b365704c527cd225b

                        SHA256

                        358e38f5fafbd0d4572426ec853b1e9d633ed57ae6840535e92cff6c5c642ac0

                        SHA512

                        32ecc915d36ccc76f7ff440bfea11fd912445e0143e4287ea6215e33f66573be41e97ecdd924157769ed94bfed71f61540aeaf9a865a1497d61c416ff5e253d9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        3bca2aeea3b74b1a72ec9a1160276fa2

                        SHA1

                        d0945782906769067173100f142a1f38d09bc29b

                        SHA256

                        c15aa64f3c95ceb9c50401bd2de8f670c76234b8e0d44f027dc6f42f349b831b

                        SHA512

                        7c9a3e7d8e61f5d85ac301e80619b602b445febecf9a26d159b8f6b37e81efbec603aeccce2faeb0d177a4cd13adf3a6b1eb286c103a24272e8f576ad345cc0d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        8641f89b76beb6e9fad18bfcbe314aca

                        SHA1

                        08d5a5efed012d0af9a5b687649bb5fca40f4f54

                        SHA256

                        f0403c1456dd5188c8de3179fb1084fb4aea01d3b40b73982cab48f2b89cb6cb

                        SHA512

                        49d5f5c2523dad29392efc35dae3336c0fcf9e5b03adfe424b18c7ac91027cb8c4f72b9dda3224411c537bd8cb19a766e65501893e9779120e60bd9a1b137c4d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        c68ac2e980ba8e0fa905d11a1860e15b

                        SHA1

                        579665141e2c4bf7dad1e566fd00fe5239f389ec

                        SHA256

                        b19dd66aa5ff480f3204ef187e038ad0358c3213e9d86203915a17cc875608c0

                        SHA512

                        b6e6e9335cb07d87b58b1799a84092dc24749fdd972d5e090bdf30b55cb8a9ca2438af41e785217f4e59ea8cf5a77d7ce19ae24cebfcf686c56077ff0b0e8ffe

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        99a25126a27d18d117eefeb50028ce51

                        SHA1

                        8d7d6767a6e3006e4fcdfaa841bbb13523e030c4

                        SHA256

                        d0c9dddd9148ca83f55c70a47374683349a03405355bf63fe014479f1d42ca17

                        SHA512

                        d1dd67a7f0ec03d3d16b8ab51fc11c3d9b7aecc5bdc9d9334eb651233133cfc411c3f69bc6f2ced196d535d73fb54451d09f83f3dec765dceb24b16714ec9b2e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        12d386c54605d6d65f18e40e547dd188

                        SHA1

                        5cbe3b86b3d49a87a447e5b2bda44c2ce3fc7b3e

                        SHA256

                        c7507545ce60202bc00372461e835e2e856731d603fd20565b86217503e987ba

                        SHA512

                        eec5d58054db57d037640e58074691c3ce2a3a1283c70aa430f98b7f1c74938a68afa033ce7aec31ff713484558628db69aac836ed0f5e9bbca4442b54411b0c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        109KB

                        MD5

                        097874837763372b64f712cc7b927d7f

                        SHA1

                        817907fc70db83326ea2b3bdaa2f5ac3eaa64df6

                        SHA256

                        b1912ca713ca7a1b5cb644de6e3c0993cd255e2b916ee3e024c3e98d6a757fd9

                        SHA512

                        75f524fe74e0ca86af7498229d4f5362f1462a7a5c2ace6c849ed0fe99ef03fc37dd09d64800e601f869d3c59e63b54b009c656514cf7831fa3e4a84aded71b3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd