hxxps://create[.]roblox[.]com/landing

Analysis

max time kernel
1768s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://create.roblox.com/landing
Sample240613-ya3tlaydpb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1036	msedge.exe
1036	msedge.exe
3688	identity_helper.exe
3688	identity_helper.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4828	1036	msedge.exe	82
PID 1036 wrote to memory of 4828	1036	msedge.exe	82
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 2268	1036	msedge.exe	83
PID 1036 wrote to memory of 1920	1036	msedge.exe	84
PID 1036 wrote to memory of 1920	1036	msedge.exe	84
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85
PID 1036 wrote to memory of 4412	1036	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://create.roblox.com/landing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15c846f8,0x7ffd15c84708,0x7ffd15c84718
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2316267363725060309,8253909774213753938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 42KB
SHA256 01bc6b654fbb35db915a7963ab9ce2473ce952985796aa9c07175deb4df28e35
MD5 e375447ed0a7aa1ca7d5dc5ca4632b2b
SHA1 34cefcc7ffd7b329b63af54d2b35d890d14fa870
SHA512 2202c9152a15458694c83f25962b8adcdd90cd06a8f4ffd2b062ae88e0803e560cb111c241a81e04f6f07d97348aadbaca0522a5a67613708a747717e7b4356b
SSDEEP 768:simsWSig38lKCQvw5gcrqXcQpnEXc4TbBULE8VWlLlflCIKdkSHBKg:simsWYslKtpEX3aEIWdXRskzg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 3a4b2dddc68fa80ccc019d32ddd150fcb0387b92e29abdae2957e1bff2cd85d2
MD5 2ec49ba7068b8bbb81cc782070c38551
SHA1 4ae29ea6208b9018493c8dfb3e8a8505c0e09966
SHA512 ac5f8effb7e34eed2cc470701ea2f9288283fbea77bce16082f4803b99bafbe55ef9347c9b8d97f942c94a7f4b8fcfb07b58c7d38112f2597dc17191dcc2b1d9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 2e12b2956d9ffa2084032e7dfce62c1c19e5fdeb360e8ca507120b81f8d342cf
MD5 1c9c52d85802d9b5abd0a9d0493538e8
SHA1 1b03a2b5bd7de5305356e55ea395e83d5beb7bdb
SHA512 b18ddf323663b882735f8c0fafce679f09c446e5238972d94933e06b67dd0ed3f09919f573decf5efcdfd1144aea2090ad252461ba4ac9e66c7979570a96aafe
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 32fc14c433578ee24a3b9e36cc21146048efd63f2733c536a3c445aaa5b2aee1
MD5 64d0b51f5ae3cc9a518dd1a587c28dba
SHA1 c1543fc7d0f641d765602996e5d8364e85f3990f
SHA512 d15b91d20594088a44027fb5da3162dd5f3e8cc3bb10197f2e67ae13c0b65def6276df9e14157fa94f4d2c597a5ad5d837967287b060c598e95fadf2438772e2
SSDEEP 96:nhkVoxm/DQYmqh1tmYwpvWMoiVmdeHIqQyEUWQyV+VDCziEwb:nhkfISKYGWMXd7Ero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 918ac3dd54044b916f9f00ef01604657a9dc74f0a2d20841941a039cdc5daed2
MD5 750f5211565fee2e857f65bd02a6d398
SHA1 e019cd9b312f3991d027450fb4333546241f175a
SHA512 976def39f8957bf55d9fd9ce16cfe1d5c703006335f0185f0e36cd1883cf374e307b44182766a1ee53822089daccdbfce86980f05f3837e0eb75e22be8cf3ba9
SSDEEP 96:nhkVoxm/Dgmqh1tmYwpvWMoiVmde65uu1nGUoGYqIqGyEUWQyV+VD7AiEwb:nhkffSKYGWMUuu5mqdxErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2caafe012b2fd44465a47735df0329481c20fa05bfbc1f83167c5e12ff720311
MD5 b4ec62fc95e7de11ad1220e28b41d0bc
SHA1 ef8e6ae1601455b04d4d6c70e68f1b3dfc238549
SHA512 67fdb3e66dfa1b8c23b98f7fd343f3014adc78e9209df572ebd0287bf2744d4f529be886e10eb81c3883fd4b823647ba3323032b31b516bf4b5f01ade2ff3033
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdp0Ke2RUKdv33z2OMDCRHD:A9iIxuERzA83h09RZxYYEJ3aOMWRHqle
MD5 SHA1 SHA512 SSDEEP

Submit Download