General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    4.6MB

  • Sample

    240324-ar3cdshd5x

  • MD5

    f2ab971188e38589e09627a28c6a4166

  • SHA1

    c06b344bb4549cc3c544bc4e806765e732c295fb

  • SHA256

    4e51c3c2d137c03478fb5baccd01fea368c9af1d6140947be5c959f2b7ff132e

  • SHA512

    031c8c895a690ae422b4fed61d5596044a4314a6365386ee7baaf246987cb998bb071f7f55f3a22cbdea0a2bc0d7e6fefe345046feaa6d4f5efff39bcf6803c7

  • SSDEEP

    98304:Snv+fpQMp+3DTM7iK4lH0Fg33rlZqSkwaSfSyq7Gba:KIQpDOiK4Kgnz1ftvu

Malware Config

Targets

    • Target

      RobloxPlayerInstaller.exe

    • Size

      4.6MB

    • MD5

      f2ab971188e38589e09627a28c6a4166

    • SHA1

      c06b344bb4549cc3c544bc4e806765e732c295fb

    • SHA256

      4e51c3c2d137c03478fb5baccd01fea368c9af1d6140947be5c959f2b7ff132e

    • SHA512

      031c8c895a690ae422b4fed61d5596044a4314a6365386ee7baaf246987cb998bb071f7f55f3a22cbdea0a2bc0d7e6fefe345046feaa6d4f5efff39bcf6803c7

    • SSDEEP

      98304:Snv+fpQMp+3DTM7iK4lH0Fg33rlZqSkwaSfSyq7Gba:KIQpDOiK4Kgnz1ftvu

    • Modifies RDP port number used by Windows

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Downloads MZ/PE file

    • Drops desktop.ini file(s)

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies Installed Components in the registry

    • Sets file execution options in registry

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks