General
-
Target
RobloxPlayerInstaller.exe
-
Size
4.4MB
-
Sample
240422-n7txvaba42
-
MD5
49754baebc698fa5c100c42618775057
-
SHA1
408bbe67a1a92001886d6eb2a41b51bfb50cad49
-
SHA256
3e49e24060c5ecf09abfedb8c9f3ef09070c5f033ba156dee52b0778fb1183c9
-
SHA512
3e9677083210041aa66bd963b7c2cd22f27d44acfd334b7954ad936d7228a1f0c1323b1f598f78286fdb9251584d33ab6267edffe4bf29c6b6b898ed4ea6a0a7
-
SSDEEP
98304:wuvuP+p0Ex6bnYhHgfIG0ZqXN7Bgr+Wzb73:JuHECagAiNurVz3
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerInstaller.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
RobloxPlayerInstaller.exe
-
Size
4.4MB
-
MD5
49754baebc698fa5c100c42618775057
-
SHA1
408bbe67a1a92001886d6eb2a41b51bfb50cad49
-
SHA256
3e49e24060c5ecf09abfedb8c9f3ef09070c5f033ba156dee52b0778fb1183c9
-
SHA512
3e9677083210041aa66bd963b7c2cd22f27d44acfd334b7954ad936d7228a1f0c1323b1f598f78286fdb9251584d33ab6267edffe4bf29c6b6b898ed4ea6a0a7
-
SSDEEP
98304:wuvuP+p0Ex6bnYhHgfIG0ZqXN7Bgr+Wzb73:JuHECagAiNurVz3
-
Adds Run key to start application
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4