Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 22:02

General

  • Target

    roblox account manager.exe

  • Size

    5.4MB

  • MD5

    334728f32a1144c893fdffc579a7709b

  • SHA1

    97d2eb634d45841c1453749acb911ce1303196c0

  • SHA256

    be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1

  • SHA512

    5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f

  • SSDEEP

    98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe
    "C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe
      "C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe" -restart
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
        "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Windows\Temp\{7F8894AF-6A16-477C-9FEC-639B003D1000}\.cr\vcredist.tmp
          "C:\Windows\Temp\{7F8894AF-6A16-477C-9FEC-639B003D1000}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=544 -burn.filehandle.self=552 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:232
          • C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0F46A1E2-0BF1-425B-9697-48F092E479A8} {2F7352DB-AB91-49E8-A908-9123773C66A6} 232
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3056
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1136 -burn.embedded BurnPipe.{42ACD8EA-C88F-4CB1-812F-DC3126E696A3} {ECF63735-FBFB-43F5-A7D7-A329AF63BB9E} 3056
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3192
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1136 -burn.embedded BurnPipe.{42ACD8EA-C88F-4CB1-812F-DC3126E696A3} {ECF63735-FBFB-43F5-A7D7-A329AF63BB9E} 3056
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3552
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{34059292-8A63-4FDE-BC35-A89276F3A51E} {985AF12D-76CE-4486-8AF7-D61FBEB84DE7} 3552
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:1352
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 940
                  8⤵
                  • Program crash
                  PID:1892
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3728
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1208
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3552 -ip 3552
    1⤵
      PID:4608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57f67b.rbs

      Filesize

      16KB

      MD5

      01c903794854453479a4ec4cde5afb6a

      SHA1

      5823e99dd7176c2a57eb84eae99740bb4f4240fa

      SHA256

      bd68407a60f3c0217cba2a8535db906cf113094afababbdd1580f0767b95da0e

      SHA512

      35c6bbfb78a74c2b7bf827abe1281223341ea58146913c62783155c946790c4aedee20104c600d3b80288fe1275e45840340078b184e48add73f6c44eccaf4bb

    • C:\Config.Msi\e57f680.rbs

      Filesize

      18KB

      MD5

      d6c8dc8fadfc89854ee3f48d3f1220c4

      SHA1

      dbbacce6e35e8a741049b45c48413698793365cb

      SHA256

      bcf2a5f19b7a56d6065bf57e7d4e95ddd232468682b3afa6597afc59d529014b

      SHA512

      25c0ff693802b6c20c5cc7eed149b77ba301caf4ece7b92edcb084c057de8c163ba2b0f75f95bf924d3eb1a4e369a14ece953aec7e81e6f28447a400cb5e259e

    • C:\Config.Msi\e57f68d.rbs

      Filesize

      20KB

      MD5

      467c28848a166ac0a7c6e2b466707f76

      SHA1

      fa66dad707498a09ba539d52a40752c0c4e13704

      SHA256

      8b5d5343c2bf0454b8262e4068fc0672b92cd979bc4674268302ac709c017aee

      SHA512

      1d3350d11bf90a57a148a4ff42730236d6909afe9df0096771eafdb4a91445feb159ddb34bfd469b98b51ec079570dff6433284a3b5dc2c827073220a7a83c50

    • C:\Config.Msi\e57f69c.rbs

      Filesize

      19KB

      MD5

      107ec3c82736496f24c18129d8d66ea8

      SHA1

      307a491c34a6a3e355cee65da57bef19256fd5a4

      SHA256

      52f5811c4d4a8b5ae35646c270b361a291d4eb33c8358cb5aa5f4fe0f3c8b53a

      SHA512

      a4a0062eec22319345e11f284ce879f8f381406ae7ee69576b18e4f47148d6daaf64250f023599a61745f1c471fcae0ea0d396e7a1a5ac8f286311baf95c7d62

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\roblox account manager.exe.log

      Filesize

      1KB

      MD5

      a02e8a8a790f0e0861e3b6b0dbe56062

      SHA1

      a3e65805e5c78641cafebc1052906d7350da9d2e

      SHA256

      7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

      SHA512

      108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

    • C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini

      Filesize

      314B

      MD5

      f18fa783f4d27e35e54e54417334bfb4

      SHA1

      94511cdf37213bebdaf42a6140c9fe5be8eb07ba

      SHA256

      563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

      SHA512

      602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240802220257_000_vcRuntimeMinimum_x86.log

      Filesize

      2KB

      MD5

      b7a42ea4ddb1cc814f2144c618f033c2

      SHA1

      90a01cc727ab999979c580af907cf9726e54dd62

      SHA256

      7a62579736fd7a884d1451ccb132e2817e000fcbdbd58a54aa555bdeacdf4d41

      SHA512

      5629c9cfa3b7092ebc310087afdcb6ff35ab463702f074b9bcf4397ba7bbf7132fc4d54f3d83a4b3e690be4a0c5874e7c3da54187cd4689ee551f1eb9ff3c88b

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240802220257_001_vcRuntimeAdditional_x86.log

      Filesize

      2KB

      MD5

      54e3c3fe61d5cc3661a5fa3f3e6d416c

      SHA1

      1afde6431d8d5fab7e994012f00b866e9dbd0147

      SHA256

      d7a2e20fca791c27e92307fc2098c67afacbc5321858334e8cf24406483c10fb

      SHA512

      c83e5ef9ca9368da4539fe4c830bf8fb03a8825481bc1b570b5a701da8e4b608fa57bb6e60104d089e506422191ed9b8b252853595f7f6327f2372795a1f8447

    • C:\Users\Admin\AppData\Local\Temp\log4.config

      Filesize

      936B

      MD5

      e4659ac08af3582a23f38bf6c562f841

      SHA1

      19cb4f014ba96285fa1798f008deabce632c7e76

      SHA256

      e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

      SHA512

      5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

    • C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe.config

      Filesize

      6KB

      MD5

      0a86fa27d09e26491dbbb4fe27f4b410

      SHA1

      63e4b5afb8bdb67fc1d6f8dddeb40be20939289e

      SHA256

      2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d

      SHA512

      fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d

    • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp

      Filesize

      13.2MB

      MD5

      8457542fd4be74cb2c3a92b3386ae8e9

      SHA1

      198722b4f5fc62721910569d9d926dce22730c22

      SHA256

      a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600

      SHA512

      91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182

    • C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\.ba\logo.png

      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

    • C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\.ba\wixstdba.dll

      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

    • C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\cab54A5CABBE7274D8A22EB58060AAB7623

      Filesize

      822KB

      MD5

      25bd21af44d3968a692e9b8a85f5c11d

      SHA1

      d805d1624553199529a82151f23a1330ac596888

      SHA256

      f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809

      SHA512

      ed3660183bf4e0d39e4f43a643007afc143b1d4ec0b45f0fdce28d8e896f646ec24a2a7a5429e8b10f4379cb4ffd1572adba10fc426990d05c0cafefdd87a4fb

    • C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\cabB3E1576D1FEFBB979E13B1A5379E0B16

      Filesize

      4.9MB

      MD5

      3a7979fbe74502ddc0a9087ee9ca0bdf

      SHA1

      3c63238363807c2f254163769d0a582528e115af

      SHA256

      7327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca

      SHA512

      6435db0f210ad317f4cd00bb3300eb41fb86649f7a0e3a05e0f64f8d0163ab53dbdb3c98f99a15102ce09fcd437a148347bab7bfd4afe4c90ff2ea05bb4febff

    • C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\vcRuntimeAdditional_x86

      Filesize

      180KB

      MD5

      2ba51e907b5ee6b2aef6dfe5914ae3e3

      SHA1

      6cc2c49734bf9965fe0f3977705a417ed8548718

      SHA256

      be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a

      SHA512

      e3ba5aa8f366e3b1a92d8258daa74f327248fb21f168b7472b035f8d38f549f5f556eb9093eb8483ca51b78e9a77ee6e5b6e52378381cce50918d81e8e982d47

    • C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\vcRuntimeMinimum_x86

      Filesize

      180KB

      MD5

      828f217e9513cfff708ffe62d238cfc5

      SHA1

      9fb65d4edb892bf940399d5fd6ae3a4b15c2e4ba

      SHA256

      a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886

      SHA512

      ffc72b92f1431bbd07889e28b55d14ea11f8401e2d0b180e43a898914209893941affacc0a4ea34eeefc9b0ca4bc84a3045591cd98aae6bdb11ae831dc6bb121

    • C:\Windows\Temp\{7F8894AF-6A16-477C-9FEC-639B003D1000}\.cr\vcredist.tmp

      Filesize

      634KB

      MD5

      337b547d2771fdad56de13ac94e6b528

      SHA1

      3aeecc5933e7d8977e7a3623e8e44d4c3d0b4286

      SHA256

      81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0

      SHA512

      0d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36

    • memory/384-15-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/384-0-0x00000000752EE000-0x00000000752EF000-memory.dmp

      Filesize

      4KB

    • memory/384-1-0x0000000000290000-0x00000000007FC000-memory.dmp

      Filesize

      5.4MB

    • memory/384-2-0x00000000058B0000-0x0000000005E54000-memory.dmp

      Filesize

      5.6MB

    • memory/384-3-0x00000000051B0000-0x00000000051F6000-memory.dmp

      Filesize

      280KB

    • memory/384-4-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/384-5-0x0000000005300000-0x0000000005392000-memory.dmp

      Filesize

      584KB

    • memory/384-6-0x0000000005210000-0x0000000005236000-memory.dmp

      Filesize

      152KB

    • memory/384-7-0x0000000005250000-0x000000000526E000-memory.dmp

      Filesize

      120KB

    • memory/4756-36-0x000000000D800000-0x000000000D81A000-memory.dmp

      Filesize

      104KB

    • memory/4756-33-0x000000000D4F0000-0x000000000D5A2000-memory.dmp

      Filesize

      712KB

    • memory/4756-22-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/4756-20-0x0000000006200000-0x000000000620A000-memory.dmp

      Filesize

      40KB

    • memory/4756-19-0x0000000006040000-0x00000000060B4000-memory.dmp

      Filesize

      464KB

    • memory/4756-16-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/4756-24-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/4756-14-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/4756-37-0x000000000D830000-0x000000000D838000-memory.dmp

      Filesize

      32KB

    • memory/4756-35-0x000000000D710000-0x000000000D804000-memory.dmp

      Filesize

      976KB

    • memory/4756-34-0x000000000D6E0000-0x000000000D702000-memory.dmp

      Filesize

      136KB

    • memory/4756-23-0x000000000AF20000-0x000000000AF5A000-memory.dmp

      Filesize

      232KB

    • memory/4756-31-0x000000000C120000-0x000000000C178000-memory.dmp

      Filesize

      352KB

    • memory/4756-26-0x000000000B750000-0x000000000B7F0000-memory.dmp

      Filesize

      640KB

    • memory/4756-25-0x000000000B5E0000-0x000000000B5EA000-memory.dmp

      Filesize

      40KB

    • memory/4756-276-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/4756-278-0x0000000006E50000-0x0000000006E5A000-memory.dmp

      Filesize

      40KB

    • memory/4756-279-0x0000000006E80000-0x0000000006E92000-memory.dmp

      Filesize

      72KB

    • memory/4756-318-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/4756-447-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB

    • memory/4756-448-0x0000000006F70000-0x0000000006FC0000-memory.dmp

      Filesize

      320KB

    • memory/4756-449-0x0000000006F30000-0x0000000006F38000-memory.dmp

      Filesize

      32KB

    • memory/4756-450-0x000000000C180000-0x000000000C4D4000-memory.dmp

      Filesize

      3.3MB

    • memory/4756-452-0x00000000752E0000-0x0000000075A90000-memory.dmp

      Filesize

      7.7MB