Analysis
-
max time kernel
15s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RobloxStudio.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
RobloxStudio.exe
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
General
-
Target
RobloxStudio.exe
-
Size
16.1MB
-
MD5
016b6b84630a08d1b5c16a17f7d9b1e6
-
SHA1
bce714025b42cdc54ea6686c4fdc403b7be94168
-
SHA256
dddffd8688265c06984adb8baacb6b4e0cb34f2e67de24f87006e4d67eacc78e
-
SHA512
db8d4df40bb24be45ad52e9c1f696e800466495392cbf7744e58da25b8adb50c68b236dd35a49a04fd520f20f358baf8f532c65c9642a451f2154263ee4016cc
-
SSDEEP
393216:b3Z8A06vEQ3ITvzx46SxiILGRKuP3WXR8q:b3ZIzx46YNLGWBN
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5672 taskmgr.exe Token: SeSystemProfilePrivilege 5672 taskmgr.exe Token: SeCreateGlobalPrivilege 5672 taskmgr.exe Token: 33 5672 taskmgr.exe Token: SeIncBasePriorityPrivilege 5672 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxStudio.exe"C:\Users\Admin\AppData\Local\Temp\RobloxStudio.exe"1⤵PID:3264
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5672