Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
55s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/03/2024, 16:40
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/ic3w0lf22/Roblox-Account-Manager/files/14641626/Ro-Exec.zip
Resource
win11-20240221-en
General
-
Target
https://github.com/ic3w0lf22/Roblox-Account-Manager/files/14641626/Ro-Exec.zip
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133558584640167308" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000_Classes\Local Settings chrome.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Ro-Exec.zip:Zone.Identifier chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4816 chrome.exe 4816 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4816 chrome.exe 4816 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe Token: SeShutdownPrivilege 4816 chrome.exe Token: SeCreatePagefilePrivilege 4816 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe 4816 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 1660 4816 chrome.exe 79 PID 4816 wrote to memory of 1660 4816 chrome.exe 79 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4824 4816 chrome.exe 82 PID 4816 wrote to memory of 4972 4816 chrome.exe 83 PID 4816 wrote to memory of 4972 4816 chrome.exe 83 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84 PID 4816 wrote to memory of 4820 4816 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ic3w0lf22/Roblox-Account-Manager/files/14641626/Ro-Exec.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8d5109758,0x7ff8d5109768,0x7ff8d51097782⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:22⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:82⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:12⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:12⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:82⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:82⤵PID:1380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:82⤵
- NTFS ADS
PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:82⤵PID:3104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1848,i,6002044459339051553,3175972794493219123,131072 /prefetch:82⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1164
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2520
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Ro-Exec\Launcher.bat" "1⤵PID:4656
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:2364
-
-
C:\Users\Admin\Downloads\Ro-Exec\compiler.execompiler.exe config2⤵PID:2936
-
-
C:\Users\Admin\Downloads\Ro-Exec\compiler.exe"C:\Users\Admin\Downloads\Ro-Exec\compiler.exe"1⤵PID:3356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fa0d274881ce8b31ca083f3c36cd7f4a
SHA16eb7f075563d801bd2948dcfe53e7bce6d8b5352
SHA2562c14f71c3c720a2e3a2d893626580665d59de1ad473b826901de852c624d8d86
SHA512152175a7fd127dc6b5b852aadbc34db4313d39b918aade028dbbf2b43d1a968ef3ced6b427cf41b20765fde4f9be3c0cc1efc49676c4812110466048dba9fe70
-
Filesize
538B
MD55d1a27caf02cf1668c170a1ebc751b13
SHA14fc44f2c7761babef35a26f8e742a66269cb8d38
SHA2567bb1adebbd0447a3df311d6515538cb89dcf2577cb8b78c38750de71671365dd
SHA512793c43acc0f4b9309ddf22c77412fc05c33170fa52f95aaa4a5b7a06f838f2c86a39247a600aac70808bccb6e3b438a47f174fb65b8f495ae30785c6e3594692
-
Filesize
6KB
MD5427a1318a44da53478ab146f0730bb06
SHA1d02c2661d211c9a05292d2d0494e57cee808bf6d
SHA256fc6038babf20a0b656c143acb216484f51ea7165f94bb63a1a1ab9d9940aaeda
SHA512956c95d89411444e6ff3daae280adfdcd4d04a3f140c3e27866bb86f82fffe5a9992a78c768a0dd1f7a47d76ae079ab089ffebffd38443820596254276b22599
-
Filesize
132KB
MD5fd44c7852ef65f775e410e8de8211484
SHA17c3614d8652783750bb82ccf6349e85c802f218e
SHA25616629763b7da9281276f3e05b63b63b22d4d72191491c8349b3951085d4d598b
SHA512b498a073212b4cd064f798af02bc98aa20f7bdd7663ea888749aa4c34e2a8372a7d7350796cf2c66e500e45494890578c658f989a50bef5eb843ba32b7dbf4d6
-
Filesize
131KB
MD5ec2cb76953210226b520f33ddc8bc5db
SHA1aa24629b36f546689c474046ca8524850bd6576a
SHA2566b65c1422e6523c46df6286279e71116e147734d642e9da6870c9c948ec50d77
SHA5124165c6e41a9badd667cfbe1335f9c0d56633864f454b640ec14b071b2846f026f1ec8c6d2fcd18e151398fa1609f37514dd175dd591253bf95721e2dff49a85b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
479KB
MD586711d8e3a8e9373c52040db6d438789
SHA1a9a42faf7ead5847d727f7dd378822d656d58dbf
SHA256d0d6cabab10e62f0261e2ca13daa453b4ec38c9f81880a55d1aca04c8ae5a3fa
SHA51238e98b43babf3ba4eaf5d79f85cbb5049df7c17019a700afac52371de6f112a426e67c20d5cb37fcfbcf8aa78a4b4d1596ea0afb5843cbb93628c0540cee888b
-
Filesize
555B
MD533db27e7685dcdab9178369531cbbe7f
SHA165a388bc623e0c16e5441e4e682831431a54c484
SHA2562a843e35f0d5e283783740143ad4455f08984234f558b82ee4e1351edf6481c1
SHA5123373d711ef99c0153bf3861c451488c83d5145df9a05abf85a89a16feae1cfaba8a78d85e2757e3381e5a20b1c7b6758c045130cc6087c831deafcfd68e020d8