Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    38s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 09:17

General

  • Target

    Roblox Account Manager.exe

  • Size

    5.5MB

  • MD5

    eb54116db322c49ec2faca86f725931e

  • SHA1

    c703685ac6221d7de624039d7351886b21ca53fc

  • SHA256

    5c7d96455bbb045cb3cb3726d7b4fff2d0810a21d7fdb34ad134696aa7f47d5e

  • SHA512

    ef6ea52df848bf8c7c77831ee5ca64cf337a92edbb0e8d0d38844e204157545aa3c397eeea12d05f276ce4984f519a1a05cf21bc04514fbb35beebf86d7f8e78

  • SSDEEP

    98304:8H6+2bT1Qm7d9G3s2tIfKLUXk8zdywnr5a0kqXf0Fb7WnZhP+MQuPN5Ppauz+l:5Qm59siyLU0lY9a0kSIb7aZhP+MQuPNw

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
      2⤵
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7868fcc51aeda97cb11596c9658c3406

    SHA1

    fc8c567a6369da203d79ca2536144eb998dc73d4

    SHA256

    aa746d33012c8f392f67752c927cdc4289bb6623ed5eebcb59a4fce6ed1f867a

    SHA512

    43e9c6d01552169dae48e4d571836757e31e683fb9c4902bdbd32da96e7c0d21fb453b77174bd426ea0dc7e39cbc47f67ecfba07e50e5b36594dcffb3cf21737

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3f8a1648f179f2f0b2f47aeb9ef9b4c8

    SHA1

    2d01955849008a12850801c3be635f5373acdaa0

    SHA256

    433622262fa44e5777d63983cd9e454dbc9196dd1ac5849db940a81d71540436

    SHA512

    fdef1396f956403d421adf4efa46ee9a6d97e90e8a25deb4dc570a3a35ab9c49f7b6e82053ee381c243459e95e503cdd575b1d343f94cf1b72aa00f23861b2ea

  • C:\Users\Admin\AppData\Local\Temp\CabB79.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini

    Filesize

    1014B

    MD5

    1d917eaf5dcc8e06dd032c33f3a3d36a

    SHA1

    1eacb4eced22393fd5140910d30070f2e054e2fe

    SHA256

    787fa9af1c32b7e198119469c0e2c02c06b34ec7c990b62b9f4fb9bc8cedaa5f

    SHA512

    3cf5bc6160262ad454477cc0fab401696a7e5dff9e6fae1cdcfa0579ded640ea8c383dfcea6194f55c914927058e2355fd661d1fa83f87c10aeffa6a91cb9fcd

  • C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini

    Filesize

    314B

    MD5

    f18fa783f4d27e35e54e54417334bfb4

    SHA1

    94511cdf37213bebdaf42a6140c9fe5be8eb07ba

    SHA256

    563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

    SHA512

    602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config

    Filesize

    6KB

    MD5

    d5e4966de947333592289d70916257a9

    SHA1

    5907df0fd07df6c33926906e94f4ed08d40be017

    SHA256

    d726d47b772a70fabc777c8ed46655fe5200e672f01f11dd95c5f4994e0a71e0

    SHA512

    c618054766bee664f0605a037f065c196c35495ee993b305f0bece4738ec9f7bd632dc8fb541bcf9d156f12e115455f31dd8db2a8cceb9d7d2f0d05d501831e9

  • C:\Users\Admin\AppData\Local\Temp\TarB7D.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\log4.config

    Filesize

    936B

    MD5

    e4659ac08af3582a23f38bf6c562f841

    SHA1

    19cb4f014ba96285fa1798f008deabce632c7e76

    SHA256

    e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

    SHA512

    5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

  • memory/2088-4-0x0000000000BC0000-0x0000000000BE6000-memory.dmp

    Filesize

    152KB

  • memory/2088-6-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2088-5-0x0000000000BF0000-0x0000000000C0E000-memory.dmp

    Filesize

    120KB

  • memory/2088-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

    Filesize

    4KB

  • memory/2088-16-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2088-3-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2088-2-0x0000000000B20000-0x0000000000B66000-memory.dmp

    Filesize

    280KB

  • memory/2088-1-0x00000000000D0000-0x000000000064A000-memory.dmp

    Filesize

    5.5MB

  • memory/2740-20-0x000000000AA30000-0x000000000AAD0000-memory.dmp

    Filesize

    640KB

  • memory/2740-18-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2740-21-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2740-19-0x0000000005610000-0x0000000005644000-memory.dmp

    Filesize

    208KB

  • memory/2740-27-0x0000000009510000-0x0000000009568000-memory.dmp

    Filesize

    352KB

  • memory/2740-30-0x0000000005EC0000-0x0000000005EDA000-memory.dmp

    Filesize

    104KB

  • memory/2740-31-0x0000000005F60000-0x0000000005F68000-memory.dmp

    Filesize

    32KB

  • memory/2740-29-0x000000000ADD0000-0x000000000AEA6000-memory.dmp

    Filesize

    856KB

  • memory/2740-32-0x000000000B510000-0x000000000B5C2000-memory.dmp

    Filesize

    712KB

  • memory/2740-22-0x00000000054C0000-0x00000000054CA000-memory.dmp

    Filesize

    40KB

  • memory/2740-15-0x0000000004810000-0x0000000004884000-memory.dmp

    Filesize

    464KB

  • memory/2740-13-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2740-11-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2740-277-0x0000000002640000-0x0000000002648000-memory.dmp

    Filesize

    32KB

  • memory/2740-279-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2740-280-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2740-281-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB