Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
22/02/2024, 16:04
General
- Target Roblox Evon Exploit V4 UWP_61782599.exe
- Size 9.5MB
- Sample240222-th4nmscb2t
- SHA256 be5357f63b036da79d198978cbc5b652ea02b1ccfcb1538352442cdc7f4d5549
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 39 IoCs
- Modifies registry class 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_61782599.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_61782599.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\setup61782599.exeC:\Users\Admin\AppData\Local\setup61782599.exe hhwnd=328258 hreturntoinstaller hextras=id:ad413892c2b60f5-RO-8jA2z2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
GenericSetup.LastScreen.dll
GenericSetup.dll
H2OCommonResources.dll
H2OCommonResources.dll
H2OCommonResources.dll
H2ODAL.dll
H2OModels.dll
H2OResources.dll
H2OServices.dll
H2OUtilities.dll
H2OViewModels.dll
HtmlAgilityPack.dll
HtmlAgilityPack.dll
HtmlAgilityPack.dll
MyDownloader.Core.dll
MyDownloader.Extension.dll
Newtonsoft.Json.dll
Ninject.dll
OfferSDK.dll
OfferPage.html
SciterWrapper.dll
ServiceHide.Net.dll
ServiceHide.dll
msvcp140.dll
sciter32.dll
vcruntime140.dll
setup61782599.exe
setup61782599.exe
default.dic
memory/3708-52-0x0000000005060000-0x0000000005088000-memory.dmp
memory/3708-116-0x00000000052A0000-0x00000000052CC000-memory.dmp
memory/3708-108-0x0000000005250000-0x0000000005258000-memory.dmp
memory/3708-92-0x00000000051E0000-0x0000000005204000-memory.dmp
memory/3708-126-0x0000000005230000-0x000000000524D000-memory.dmp
memory/3708-100-0x00000000051C0000-0x00000000051CA000-memory.dmp
memory/3708-142-0x0000000005910000-0x0000000005922000-memory.dmp
memory/3708-84-0x0000000005150000-0x000000000516A000-memory.dmp
memory/3708-76-0x0000000005170000-0x00000000051A2000-memory.dmp
memory/3708-195-0x0000000006010000-0x000000000609C000-memory.dmp
memory/3708-200-0x0000000005F90000-0x0000000005F9A000-memory.dmp
memory/3708-201-0x0000000005630000-0x0000000005652000-memory.dmp
memory/3708-202-0x0000000006400000-0x0000000006754000-memory.dmp
memory/3708-68-0x00000000050C0000-0x00000000050E8000-memory.dmp
memory/3708-208-0x00000000068E0000-0x00000000068EC000-memory.dmp
memory/3708-211-0x0000000006EC0000-0x0000000007464000-memory.dmp
memory/3708-60-0x0000000005090000-0x00000000050BE000-memory.dmp
memory/3708-44-0x0000000005030000-0x0000000005054000-memory.dmp
memory/3708-217-0x0000000007A30000-0x0000000007FE4000-memory.dmp
memory/3708-36-0x0000000004FE0000-0x0000000004FF4000-memory.dmp
memory/3708-234-0x0000000007470000-0x0000000007502000-memory.dmp
memory/3708-17-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
memory/3708-16-0x0000000000280000-0x0000000000658000-memory.dmp
memory/3708-245-0x00000000068B0000-0x00000000068DE000-memory.dmp
memory/3708-15-0x00000000718F0000-0x00000000720A0000-memory.dmp
memory/3708-263-0x00000000718F0000-0x00000000720A0000-memory.dmp
memory/3708-264-0x0000000004FD0000-0x0000000004FE0000-memory.dmp