Resubmissions
08/07/2024, 23:38
240708-3mqr1svdqn 1008/07/2024, 23:37
240708-3l9thavdnm 1008/07/2024, 23:16
240708-29be6swfqe 1008/07/2024, 23:14
240708-27ygxstfrq 10Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 23:14
Behavioral task
behavioral1
Sample
RobloxTool2.45.exe
Resource
win7-20240705-en
General
-
Target
RobloxTool2.45.exe
-
Size
560KB
-
MD5
a6d0cce9aed3e8a5253320afe320a5cf
-
SHA1
80c69e820ed28392af4adc0c86ccbf6ed011a347
-
SHA256
adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5
-
SHA512
f6d21be9b58547c5f5396f7f14bac177090b2e00daaaef07424db9572d0efdc789cd80abfa6781a55e5fa26ee024b02b739c1a72090ee19e8fea5b7a85e66756
-
SSDEEP
12288:WLV6Btpmk25LG7Ilxs0G4ASfUsZblcfM1Zj7S:EApfayCW0XthbCM3S
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Manager = "C:\\Program Files (x86)\\WPA Manager\\wpamgr.exe" RobloxTool2.45.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxTool2.45.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\WPA Manager\wpamgr.exe RobloxTool2.45.exe File opened for modification C:\Program Files (x86)\WPA Manager\wpamgr.exe RobloxTool2.45.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4588 schtasks.exe 784 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe 840 RobloxTool2.45.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 840 RobloxTool2.45.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 840 RobloxTool2.45.exe Token: SeDebugPrivilege 840 RobloxTool2.45.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 840 wrote to memory of 4588 840 RobloxTool2.45.exe 85 PID 840 wrote to memory of 4588 840 RobloxTool2.45.exe 85 PID 840 wrote to memory of 4588 840 RobloxTool2.45.exe 85 PID 840 wrote to memory of 784 840 RobloxTool2.45.exe 87 PID 840 wrote to memory of 784 840 RobloxTool2.45.exe 87 PID 840 wrote to memory of 784 840 RobloxTool2.45.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCA3B.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4588
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCAC9.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:784
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d5ff21d38f0e1018fc72aa2f55f011aa
SHA15ad2c2e8143cd0e0f6d7dcef7391ab572e3cea37
SHA256bd4af90cd9750d3930b417bbb917fa3573d386dcb068e5a1fdca4ae88ee02382
SHA51243772bfed10631fc1ff65f85fa0d8afcd562da2bdf3178cb9cbc49aa2d6b075020900fd8f53af3f080330b8bad36b257a6a51ff6fb4ee20025a389a7c27610a2
-
Filesize
1KB
MD5e7d3c8560fe3e223f6dfa16c2066930e
SHA18e7729d6856489a28fb1fd6d2fbc3661d6394f18
SHA256ec5bea77c4f620d54db7e0ea1ee81551631b7d9e42ae619deaa9a14f5f69415f
SHA512f6a4f3bf0fa30a459a662250f502772f431c1cef5562f8a3e9770529c5d24e7226b46531af8c9e96a556f417a275caaa70df96fddaa482c5218bb6b47f2614ae