General
-
Target
RobloxPlayerLauncher.exe
-
Size
1.6MB
-
Sample
240410-wr2lraff25
-
MD5
df3c89248671866cfb9e0a407fad20b4
-
SHA1
2258e20671e6aaba8ce75abb5bc5bca8c4df0035
-
SHA256
93580834e65af2f5a83aacef47a1ec3ef45fc6ab9683ec4df771bbea713ab38f
-
SHA512
f6658f2653aefebc573518773c97319d87d70cabeb182cd622a5722d4df0417df17318f4b25b7929ab03e982a072e914175971b96e205356c5c6a23a3fedaf01
-
SSDEEP
49152:NmAhTN2Q5MmBRS+qYNS2+3njUrG+TvamoGXtTOgM7PMQpdAUFTHrPHHoV5N:gAhTkyZBdM2+3njUmrPHA
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
RobloxPlayerLauncher.exe
-
Size
1.6MB
-
MD5
df3c89248671866cfb9e0a407fad20b4
-
SHA1
2258e20671e6aaba8ce75abb5bc5bca8c4df0035
-
SHA256
93580834e65af2f5a83aacef47a1ec3ef45fc6ab9683ec4df771bbea713ab38f
-
SHA512
f6658f2653aefebc573518773c97319d87d70cabeb182cd622a5722d4df0417df17318f4b25b7929ab03e982a072e914175971b96e205356c5c6a23a3fedaf01
-
SSDEEP
49152:NmAhTN2Q5MmBRS+qYNS2+3njUrG+TvamoGXtTOgM7PMQpdAUFTHrPHHoV5N:gAhTkyZBdM2+3njUmrPHA
-
Cobalt Strike reflective loader
Detects the reflective loader used by Cobalt Strike.
-
Detect ZGRat V1
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies AppInit DLL entries
-
Modifies Installed Components in the registry
-
Modifies Windows Firewall
-
Possible privilege escalation attempt
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1File Deletion
1Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1