Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 00:56
Behavioral task
behavioral1
Sample
LIVE-WindowsPlayer-version-24872f7beace4d0a/RobloxBetaLauncher.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
LIVE-WindowsPlayer-version-24872f7beace4d0a/RobloxBetaLauncher.exe
Resource
win10v2004-20240426-en
General
-
Target
LIVE-WindowsPlayer-version-24872f7beace4d0a/RobloxBetaLauncher.exe
-
Size
17.7MB
-
MD5
47b060421b60734cdded37210e70953d
-
SHA1
31c342e6fb9f640f15c954a158f924247ca508cd
-
SHA256
dbf61e3520db8f7cc121ae3a8f6991fd58002ea5561d402f5bac443b2dbb6749
-
SHA512
6d7e48b3f01336a31e65d776ed4ab14b7e8ca6cc5549b399a1ed1cad58a4033e8a3e91948fc877ea7b8490a3ba7109913b22523905bfce080c09bd57fdecf2c0
-
SSDEEP
393216:iqPnLFXlrPmQ8DOETgsvfGF3FgKEvEYcpAkq:nPLFXNOQhE6d9v4
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2720 RobloxBetaLauncher.exe -
resource yara_rule behavioral1/files/0x000500000001a34e-111.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2720 1952 RobloxBetaLauncher.exe 28 PID 1952 wrote to memory of 2720 1952 RobloxBetaLauncher.exe 28 PID 1952 wrote to memory of 2720 1952 RobloxBetaLauncher.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\LIVE-WindowsPlayer-version-24872f7beace4d0a\RobloxBetaLauncher.exe"C:\Users\Admin\AppData\Local\Temp\LIVE-WindowsPlayer-version-24872f7beace4d0a\RobloxBetaLauncher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\LIVE-WindowsPlayer-version-24872f7beace4d0a\RobloxBetaLauncher.exe"C:\Users\Admin\AppData\Local\Temp\LIVE-WindowsPlayer-version-24872f7beace4d0a\RobloxBetaLauncher.exe"2⤵
- Loads dropped DLL
PID:2720
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378