Overview

overview

6

Static

static

1

RobloxPlay...1).exe

windows7-x64

6

RobloxPlay...1).exe

windows10-2004-x64

6

Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 15:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxPlayerInstaller (1).exe

  • Size

    4.5MB

  • MD5

    c9c89a5180728704d9fc8b10fcfa5124

  • SHA1

    6eb7edac4c879645641394eb20db3cf707019b47

  • SHA256

    0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855

  • SHA512

    98fbac35cbfff889ffb7a9b26684aee196237a54a9548285c233c2abf0a6a1f7588eb28d166a3a32e103f974418a7e75477cc699e5f0c8e3e290916b44ffc220

  • SSDEEP

    98304:Smvn+iSkszLaY6ZZBrKv0Log5yGj06VuXJ+2npsbLfNzt:P+iBsGZ7KngtE+YK3fdt

Score
6/10
evasiontrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Program Files (x86)\Roblox\Versions\version-48a28da848b7420d\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
      MicrosoftEdgeWebview2Setup.exe /silent /install
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:4060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
    Filesize

    222KB

    MD5

    515de96cd5181c348abec1fde3f7019d

    SHA1

    f6349ee33061fa4b92185881b8ea7b989d66c8c9

    SHA256

    aeeed1697a9646e2890a9de6d369c067bb162ca88960e9c100852a52b67275e2

    SHA512

    6e308d8568c90ea612fc5096a47e62e3d671846591c49f035598f321ca2a5ece61b8951ad34b4717cfb921722290c2298fcc4551ccefc19b475292feb1ffa2f0

    Download Submit

  • C:\Program Files (x86)\Roblox\Versions\version-48a28da848b7420d\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
    Filesize

    1.5MB

    MD5

    610b1b60dc8729bad759c92f82ee2804

    SHA1

    9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

    SHA256

    921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

    SHA512

    0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

    Download Submit

  • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\dd3229800e3b48a361637aae158c3afb
    Filesize

    2.3MB

    MD5

    37b778faeb13dcf7fe342560cb258604

    SHA1

    10f43b75c10f7d3521bff4dec423b4767ab9eeb7

    SHA256

    bf37fb44cce1e631def655688e8c0a966759cf554b80d6b490b5e7d6d981003d

    SHA512

    17a3f0000506233a3045d55a15cff17e40bd1c1dbde503e724355fe69cac9bbc44ecd7ee0deceb251757d305cf564acc70cff6d533b9166c3fadd8111b4a6239

    Download Submit