cbd33d7ba3b8ef4562c696e1b70b5e71faded4cfb6b18b5f4c3d2eae20abf872

General

Target

NetflixCE V4/NetflixCE/RobloxStudio.exe
Size

16.1MB
MD5

8e6a15de31285c621f54e28f2a916234
SHA1

5d00229772679367c103cd38428aa9943bbeab10
SHA256

648397280c2b3660755a91900faccbc2f9431f891ae3ecccd8c54950abcaff11
SHA512

7b1b1f6fc3186db8752805f66baf846a9930a6edb516e312c381fe018a47be184f478e3f604a41a7d76d42ff1b4bcd6463c8738d558aa9f806a6cf40dccdaee2
SSDEEP

393216:b3Z8A06vEQ3ITvzx46SxiILGRKuc3W/R8q:b3ZIzx46YNLRWpN

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 50 IoCs

Processes:

RobloxStudio.exe

description	ioc	process
File opened for modification	C:\Windows\system32\version.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\hhctrl.ocx	RobloxStudio.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\msimg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\GDI32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\sechost.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\wsock32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\oleaut32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\DCIMAN32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\comdlg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\psapi.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\kernel32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\USP10.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\opengl32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\wininet.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL	RobloxStudio.exe
File opened for modification	C:\Windows\system32\winmm.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\CLBCatQ.DLL	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\CRYPTBASE.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\SETUPAPI.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\DDRAW.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\CFGMGR32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\ole32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\USER32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\advapi32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\imm32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\normaliz.DLL	RobloxStudio.exe
File opened for modification	C:\Windows\system32\iertutil.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\LPK.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\DEVOBJ.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\NSI.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\DUI70.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\KERNELBASE.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\RPCRT4.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\SHLWAPI.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\dwmapi.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\msvcrt.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\DUser.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\GLU32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\ws2_32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\shell32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\MSCTF.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\propsys.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	RobloxStudio.exe

Drops file in Windows directory 2 IoCs

Processes:

RobloxStudio.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll	RobloxStudio.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RobloxStudio.exe

pid process

3024 RobloxStudio.exe
3024 RobloxStudio.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

RobloxStudio.exe

description	pid	process
Token: SeDebugPrivilege	3024	RobloxStudio.exe
Token: SeTcbPrivilege	3024	RobloxStudio.exe
Token: SeTcbPrivilege	3024	RobloxStudio.exe
Token: SeLoadDriverPrivilege	3024	RobloxStudio.exe
Token: SeCreateGlobalPrivilege	3024	RobloxStudio.exe
Token: SeLockMemoryPrivilege	3024	RobloxStudio.exe
Token: 33	3024	RobloxStudio.exe
Token: SeSecurityPrivilege	3024	RobloxStudio.exe
Token: SeTakeOwnershipPrivilege	3024	RobloxStudio.exe
Token: SeManageVolumePrivilege	3024	RobloxStudio.exe
Token: SeBackupPrivilege	3024	RobloxStudio.exe
Token: SeCreatePagefilePrivilege	3024	RobloxStudio.exe
Token: SeShutdownPrivilege	3024	RobloxStudio.exe
Token: SeRestorePrivilege	3024	RobloxStudio.exe
Token: 33	3024	RobloxStudio.exe
Token: SeIncBasePriorityPrivilege	3024	RobloxStudio.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

RobloxStudio.exe

pid	process
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe
3024	RobloxStudio.exe

C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\RobloxStudio.exe
"C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\RobloxStudio.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3024

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3024-0-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/3024-3-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/3024-7-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/3024-11-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/3024-15-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/3024-19-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/3024-27-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/3024-31-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/3024-35-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/3024-39-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads