8aa0127fd90693f749e08330a9c10f19f8b15fae427a22eb523b060762767d77

Analysis

max time kernel
1800s
max time network
1691s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
24-02-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox-Player-Server-Searcher-2.0.0/resources/html/layout.html
Size

828B
MD5

45b8bede5e9d16e2b7cf71fee235d998
SHA1

78e82f386d965669403c26d496c33a93bb339c17
SHA256

a011c2717907751b6471545079f234e11836191a90bd36cc47ee451445b67e4a
SHA512

9c3d5e9ee7d85c15f70a8d084ef3788c8f76f72fbf272fb937a2cf49cddf5386837ec63a318c90bd608589ac9f3f9d8c48a3b4a6db14f07f5d27ca07e176881e

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2616	msedge.exe
2616	msedge.exe
436	identity_helper.exe
436	identity_helper.exe
3868	msedge.exe
3868	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2772	2616	msedge.exe	80
PID 2616 wrote to memory of 2772	2616	msedge.exe	80
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 4816	2616	msedge.exe	82
PID 2616 wrote to memory of 2184	2616	msedge.exe	83
PID 2616 wrote to memory of 2184	2616	msedge.exe	83
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84
PID 2616 wrote to memory of 4456	2616	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Roblox-Player-Server-Searcher-2.0.0\resources\html\layout.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda74a3cb8,0x7ffda74a3cc8,0x7ffda74a3cd8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,3611590098395846763,2208731401128858305,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48f6d3312767dead2e49dc65bd734530

SHA1
6faeabf35abe99e4d57d34f37c03b3f5b96644d2

SHA256
327baa93dd5ef9b3bc664b876fde935f8b987d67e3e1782816402c51593cd61d

SHA512
e8497708c62fe8a98b5ebaf1aa4c514e30668cf35a5e9f2d9c311449406dea86d756f10cca8c0ed8396ccfa8361b3bc4e7906212f2b26c7006d3ed5d546e5ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c464d21385b98b78596a51f67be50764

SHA1
3891ac2ee62b2e8bb2678f73728a3cba5b1f61c4

SHA256
19027f75fd192db8e54e3a48666bf52e8c7485f2dc898297c03a52d71bcf730f

SHA512
bb75570dbdc8fa4a454d6841daed3c8b20d79a8ba8602fc4ef911313fe46e15054ab3851724ab3fea12e04c630017971e70ed2ec13a67d6c0a0e6d217f830afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9538a0dc496079391c6c92f4abcd4e6f

SHA1
0ca518a488fb2daa8f8bf5264461e68ee0210c71

SHA256
47f29245a4b965b7756c80ad42566df122e8fef200a4ecbded9c82be007dd45d

SHA512
ef5ffce3ff1cfede78a78d48e7e8b1a8bda06ee8ac9e170bd265ed8a862ed462b1b5eb41293b4fd6b29f62b898437ed21686371e90d44d621806fb9c7e6aeced

Download Submit