Analysis
-
max time kernel
240s -
max time network
244s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-04-2024 17:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://create.roblox.com/landing
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
https://create.roblox.com/landing
Resource
win11-20240419-en
General
-
Target
https://create.roblox.com/landing
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2540 msedge.exe 2540 msedge.exe 3156 msedge.exe 3156 msedge.exe 2672 identity_helper.exe 2672 identity_helper.exe 1304 msedge.exe 1304 msedge.exe 1728 msedge.exe 1728 msedge.exe 1728 msedge.exe 1728 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 3152 3156 msedge.exe 79 PID 3156 wrote to memory of 3152 3156 msedge.exe 79 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 3328 3156 msedge.exe 80 PID 3156 wrote to memory of 2540 3156 msedge.exe 81 PID 3156 wrote to memory of 2540 3156 msedge.exe 81 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82 PID 3156 wrote to memory of 4480 3156 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://create.roblox.com/landing1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb6b633cb8,0x7ffb6b633cc8,0x7ffb6b633cd82⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:22⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:12⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4380 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4386636378989325657,3164730855548453984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:2840
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:408
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56e498afe43878690d3c18fab2dd375a5
SHA1b53f3ccbfe03a300e6b76a7c453bacb8ca9e13bd
SHA256beb39e9a246495e9dd2971224d23c511b565a72a6f02315c9f9bf1dcfae7df78
SHA5123bf8a2dd797e7f41377267ad26bde717b5b3839b835fe7b196e748fec775ffd39346dba154bb5d8bda4e6568133daaa7fefa3a0d2a05e035c7210bb3c60041a7
-
Filesize
152B
MD5b8b53ef336be1e3589ad68ef93bbe3a7
SHA1dec5c310225cab7d871fe036a6ed0e7fc323cf56
SHA256fe5c2fb328310d7621d8f5af5af142c9ce10c80f127c4ab63171738ad34749e1
SHA512a9081a5a909d9608adfc2177d304950b700b654e397cf648ed90ecac8ac44b860b2cf55a6d65e4dfa84ef79811543abf7cb7f6368fd3914e138dfdd7a9c09537
-
Filesize
5KB
MD5b601a1be6a809af686916324848895da
SHA1fb6ad08f6a229bc3cdb546935ccf92aabe61ae90
SHA2566948df1f50586ed00742a28a8eda6c159bf62361af3cdd3889fa2bea24801b68
SHA5121198a303cc29bc5f4f0293249253bdc89ad116b7f59b340811d0e00b35ecef39a4866bdcdb43310b877992da475b8a266e2ecbcdf571a2a72c1b1769c799d9b1
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
8KB
MD58805d979e02f6ea8ac86125290ae7108
SHA1940b0648fa87edff6a4830bbf8f05c1bd5857cc6
SHA25653b473a74a8ee669f332115222643b6995e62f45231b64d02a929b2d7742ec9b
SHA512e95c711067884683d02f7ea6fd21e0cc1588e81d9ee1179b4f5e55ec666f3c4372aed4cd25a60a6ee8cc40bd2940ccd4acc5170a280a2c5827ceeb76cf5b68e6
-
Filesize
8KB
MD544dc88bad42c5eb1c1d3b838b957d732
SHA12b60321c93ae6bd62f686601c5ad641b909dfcdf
SHA256794403d04df566c66b915aa866f9b8eb1eb9f102a059edbfac0813ace56a25da
SHA512ca8ba8c5d43fcafa65ab49400d4c87f0906e54e0b5559f02ceb57e4f885d380c4e91ac546e0bf89c472f452dbb47f976354f64563a8999f771a7944aae4a1e13