e2521ae407549f68b7e703b3efb0b9b5f39dbb815018876bd80696a49148afe0

Resubmissions

11-03-2024 18:22

240311-wzw18scd92 3

Analysis

max time kernel
18s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RBLX.EXE.py
Size

325B
MD5

67a1c1d6b8fdb2b2c6896795c57945d1
SHA1

d224801297a8fbc207e69d679a6f2c4bb7435575
SHA256

e2521ae407549f68b7e703b3efb0b9b5f39dbb815018876bd80696a49148afe0
SHA512

fb24c979c76a9933e1302296ae7464cc0b332aa6a5f0c8b8ff440cd9c754fbcee30e09493b3e3eed0e3e8bdbc20c5902e48b967a4d9d9620fbee47488528a456

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RBLX.EXE.py
1⤵
- Modifies registry class
PID:1976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads