Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 12:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.mediafire.com/file/2i4jcywyzqe11b/ROBLOX HACK.rar/file
Resource
win10v2004-20240508-en
General
-
Target
http://www.mediafire.com/file/2i4jcywyzqe11b/ROBLOX HACK.rar/file
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3448 msedge.exe 3448 msedge.exe 764 msedge.exe 764 msedge.exe 2480 identity_helper.exe 2480 identity_helper.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe 3396 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe 764 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 764 wrote to memory of 1696 764 msedge.exe 82 PID 764 wrote to memory of 1696 764 msedge.exe 82 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 1076 764 msedge.exe 83 PID 764 wrote to memory of 3448 764 msedge.exe 84 PID 764 wrote to memory of 3448 764 msedge.exe 84 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85 PID 764 wrote to memory of 372 764 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mediafire.com/file/2i4jcywyzqe11b/ROBLOX HACK.rar/file1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c47182⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:12⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16196669011598803220,6163970778885525142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3396
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1800
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD53cb4d6d9e8b489cdec9d839b45b79cca
SHA14af95e4c8403413fedd9cbaba252fc61f65bcb9f
SHA256dc9df5a549844ca4068b141646a490c49e325654cee180e44aeb53f6ba142ae0
SHA512f8cd91cb7bf037056e91f7949374262acfc63436039295ebc5ac7f88d6cdd2f6b54026b7ca26e5d3978aba1b4345e0d1a69173c64b2d7b7f9d79dbef3eed6b5a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD523547b30d392f55ed97c626307dae61e
SHA1ca0f26fdbd19463c3b903aa1aee414d1987ecae7
SHA256007e98dbe5ee09997a2daa5c9913d845e36bcbef342f11bc6c91fc406ae6ee58
SHA51238872217e3a892a9e2a38611ec10066df7a8c2b8d4cb4fb13fb7be6e0767f857f2a369372a2d61c3e66ad1a6536a42935f89983a3e9e0d662d2852b88603ba86
-
Filesize
1KB
MD57317c2f5b8def710dd30d04138fb8331
SHA109191d17faf490f54311fc272cc9245fa397946e
SHA256aded9088b7f99b7e82105543167f8de743f6c11a65c6ba94fbe46b3476bfa9c9
SHA512b66c56d36fa1423a5de71eb66c7b118606fec6bc3fc35cbd8ec3f6b1c33e1af1ff132debf918c440cd69d956e12563c83c2c043968407685616419f5435f4b30
-
Filesize
1KB
MD5f54dc27941f2524cbd65dd8e3e3ef752
SHA1f699b843158ff1288b6d3e34f9b1326cfef6fc3f
SHA256c5c8af55e3a978dc385fb7c8c3eb798f023bfb86906a524a291b394f1e0bbc62
SHA5124e3abd2df738b0503f8d0ab2895986f1649d516226516bd9651a03533dae9be012243e8d35c4d0528b07e689d93ca38d31a21b25340ad180ce1b70a27b2025b6
-
Filesize
6KB
MD5a344a8f2b88e4c1794237b5c6097e42c
SHA15dbf7741ef197ad0cc610b01904f2cc230700142
SHA256265d2bb3e15d6ce40cde9c1a65429b0edf29ce302f911ecc596b9e78e6456433
SHA5128b0a5c6e98cdfde5fac34dbeb6ea3ff0440a45ea818bd71e6858036c8ca62687937b2afdd865a152aa17bdd318fb32021798efea03c31a44854a222d0696e667
-
Filesize
7KB
MD5f30f7a6c314f0b29366ce3c8f481136a
SHA1ab5a1548df90d9dd2a3a926f92a38d5fcb580c86
SHA256ef3c2f51631b45bf076610ac2260e1eed34684f729eca055194b5fed85de192a
SHA512126f044cf813b0c3257d4a4f69926aec6a7a336e77862b4538ef69f4a28aec9dfbad620fa60be167a31c7c3b5ed0d3f4a60aeab4b644a50caae141a3ab8ff75c
-
Filesize
7KB
MD5aeace92c640d3aa393d3f8ba881eb3ed
SHA1bebf8b3ff49dfdaa176c99d9928bd247050f2af4
SHA256b30b7391a91abfcdfd8b18e8a9232ee2e2d7ccb6f461172af5990fdf79091747
SHA5129d41fcec2b2f46dd5afbe1f72714da61cd2874a3052251cce43834a2f8c37cfa96896f03e7713e23a875b30e1576ba57af5f3ff753f38f7faeffbcf90666aef2
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD52e8634a004e8ffcb94d8b239d639f428
SHA16266e4d4bf64c3940df792df8d0360ee609c236b
SHA2565470e8feab222911aec5449e84d802600907eccb58113cff302ee071a2f0fc36
SHA512e341bd39a7cc0d38fdf0d0db14bcef7ce85630eb94b7f9c8367091b6094f2d289ddb8b69aeedadeaf0a52586ece081edba38acf6afd53a6c261c74dc14a2fd5d