Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win7-20240708-en
General
-
Target
RobloxPlayerLauncher.exe
-
Size
5.8MB
-
MD5
b022682dd39d113f2d5a65a172dbd28f
-
SHA1
aa874df3d3d0a9539c53a8a0c96c4c119bae2c52
-
SHA256
47a2e8bbef18d5491be3c449d9a5464a8804d9d1a85bc7e24ff80876e85104a3
-
SHA512
d6746ca7c1e10b1ed7fb48d857210ce5cd0f0542c81fdbf00a6afaf4607f30020ccc09f4c41ef9f50bc2562bf6e4380e7abaef1d5a5b1e91773281bcd9e58525
-
SSDEEP
98304:6Qv2DFDUtJEjcseLtY1pthFX26elVJ2qg4FMvq821kRlzcV7yMuh:B2BDULEjL//elNg44R+VGMA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RobloxPlayerLauncher.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerLauncher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerLauncher.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3972 RobloxPlayerLauncher.exe 3972 RobloxPlayerLauncher.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3972 wrote to memory of 3748 3972 RobloxPlayerLauncher.exe 86 PID 3972 wrote to memory of 3748 3972 RobloxPlayerLauncher.exe 86 PID 3972 wrote to memory of 3748 3972 RobloxPlayerLauncher.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=cb5e1ef861e0b94bbfd3c1c166285778889972be --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7b4,0x7ac,0x7b8,0x67c,0x6ac,0x1826a74,0x1826a84,0x1826a942⤵PID:3748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
Filesize2KB
MD5c361abef55c9deca3430fc383378c04c
SHA1c5eee0cc9e59c101c90414cb562688cfd7d48421
SHA256bf8c55dbfdf76fffcb08902063d95865a9b767247c1b79dc3705f39f006ef05a
SHA5121c39ab2018eb769191198a8d0f4695ee90bdeec99bc74bb87db7d1df74672ec0ba91cc9ba6bc0fbd0b3d3b67e227fe50e64a0a5cb0e7472848325415bb00114e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD54930610a8a69f0dbb782ed1e766dde54
SHA17e4cb627f187156b2121594a9028dbdfa138c617
SHA25600a45205bc050ece00eaf2a5435405593bce15aaf43af5474be5ed8670135aab
SHA512c112a3100a016bd36b13de88130cea3dbc2ec51dc42bd6705b04d02685e679428cc09ef63800b25aa07f45053659579f5ed62aaa0592430302ae1b5c0752c608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
Filesize488B
MD5c27888bf56e2aa2c203aac9c64f19d6d
SHA15bddd02037fbebe5fb689b01cf01b66cb3182a8f
SHA2563040bf8e149b25570233c114f465f7770182d1c37109484e00b4288175276fb3
SHA51245ee27f277db23647ccd5ff130a14963d509ba2fd0b2b17044a25d024b883a0096b47f1f2eda3bedc494ef690df3188449cba0877bf685b36ad911206a6235c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD562299e4bf2a88f3d029bad6c5769dd1a
SHA112d55b833581bec80607aa3be494f9006baee6a7
SHA256cf0eebd352fe8e8d440756095a93401ac10901fcafedaa7efc835a3732145857
SHA512e2e1b5b542e420c1bc8f0bd89dd625861c1deac6f940c04ae3cbefd84e6f3154bc5d60aeb908257194e08d949cfa2e5f0f9d35d24323db06221ced87e4f877e9
-
Filesize
8KB
MD5dc739793526b0863ec929014503e2f7d
SHA1d08912f1cbdd5819d0d42702f8943c03d61f4922
SHA256b54095b8df7667737d879ea0e4c7e3ab35d4cafc12bc46af6ca941fddfda3a3d
SHA512ee585523805ba42f9d64b498ffe3e13d3e4f9a14e24ffbd3b23a5da85f5f45155e7bd56f85f72d8935cbcca55fb5b006f9fc827ddfa44139b9be84f3c26f9bbd
-
Filesize
163B
MD5bedbf7d7d69748886e9b48f45c75fbbe
SHA1aa0789d89bfbd44ca1bffe83851af95b6afb012c
SHA256b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
SHA5127dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6