Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
roblox account manager.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
roblox account manager.exe
Resource
win10v2004-20240802-en
General
-
Target
roblox account manager.exe
-
Size
5.4MB
-
MD5
334728f32a1144c893fdffc579a7709b
-
SHA1
97d2eb634d45841c1453749acb911ce1303196c0
-
SHA256
be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
-
SHA512
5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f
-
SSDEEP
98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation roblox account manager.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation vcredist.tmp -
Executes dropped EXE 3 IoCs
pid Process 3368 vcredist.tmp 232 vcredist.tmp 3056 VC_redist.x86.exe -
Loads dropped DLL 2 IoCs
pid Process 232 vcredist.tmp 3552 VC_redist.x86.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{47109d57-d746-4f8b-9618-ed6a17cc922b} = "\"C:\\ProgramData\\Package Cache\\{47109d57-d746-4f8b-9618-ed6a17cc922b}\\VC_redist.x86.exe\" /burn.runonce" VC_redist.x86.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 18 raw.githubusercontent.com 19 raw.githubusercontent.com -
Drops file in System32 directory 49 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140ita.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140kor.dll msiexec.exe File created C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\concrt140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_1.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140esn.dll msiexec.exe File created C:\Windows\SysWOW64\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcamp140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcomp140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140enu.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_1.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140kor.dll msiexec.exe File created C:\Windows\SysWOW64\vcomp140.dll msiexec.exe File created C:\Windows\SysWOW64\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140esn.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vccorlib140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140fra.dll msiexec.exe File created C:\Windows\SysWOW64\concrt140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140chs.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140ita.dll msiexec.exe File created C:\Windows\SysWOW64\vcamp140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\SysWOW64\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140deu.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140u.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\SysWOW64\mfcm140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_atomic_wait.dll msiexec.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIFCC0.tmp msiexec.exe File created C:\Windows\Installer\e57f687.msi msiexec.exe File created C:\Windows\Installer\e57f688.msi msiexec.exe File opened for modification C:\Windows\Installer\e57f688.msi msiexec.exe File created C:\Windows\Installer\SourceHash{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D} msiexec.exe File opened for modification C:\Windows\Installer\MSI379.tmp msiexec.exe File created C:\Windows\Installer\e57f676.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{0C3457A0-3DCE-4A33-BEF0-9B528C557771} msiexec.exe File created C:\Windows\Installer\e57f69d.msi msiexec.exe File opened for modification C:\Windows\Installer\e57f676.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF964.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1892 3552 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language roblox account manager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language roblox account manager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\TypedURLs roblox account manager.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b} VC_redist.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Version = "14.40.33810.0" VC_redist.x86.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\VC_Runtime_Minimum msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.40.33810" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b} VC_redist.x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\PackageCode = "56C1F3EFF13FBC94887129B2E83EB575" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\899C6AE5CA5D9DE4983CF9521BC7DCD3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\Servicing_Key msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E} VC_redist.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\ = "{47109d57-d746-4f8b-9618-ed6a17cc922b}" VC_redist.x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.40.33810" VC_redist.x86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}v14.40.33810\\packages\\vcRuntimeMinimum_x86\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E} VC_redist.x86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14 VC_redist.x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{0C3457A0-3DCE-4A33-BEF0-9B528C557771}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.40.33810" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\PackageCode = "829638B4928B2094C8872CEC8D04BB92" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}v14.40.33810\\packages\\vcRuntimeMinimum_x86\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle VC_redist.x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\0A7543C0ECD333A4EB0FB925C8557717 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\PackageName = "vc_runtimeMinimum_x86.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14 VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.40.33810" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b} VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\Provider msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Version = "237536274" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\Version = "237536274" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\InstanceType = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E} VC_redist.x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Language = "1033" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe 1208 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4756 roblox account manager.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4756 roblox account manager.exe Token: SeBackupPrivilege 3728 vssvc.exe Token: SeRestorePrivilege 3728 vssvc.exe Token: SeAuditPrivilege 3728 vssvc.exe Token: SeShutdownPrivilege 3056 VC_redist.x86.exe Token: SeIncreaseQuotaPrivilege 3056 VC_redist.x86.exe Token: SeSecurityPrivilege 1208 msiexec.exe Token: SeCreateTokenPrivilege 3056 VC_redist.x86.exe Token: SeAssignPrimaryTokenPrivilege 3056 VC_redist.x86.exe Token: SeLockMemoryPrivilege 3056 VC_redist.x86.exe Token: SeIncreaseQuotaPrivilege 3056 VC_redist.x86.exe Token: SeMachineAccountPrivilege 3056 VC_redist.x86.exe Token: SeTcbPrivilege 3056 VC_redist.x86.exe Token: SeSecurityPrivilege 3056 VC_redist.x86.exe Token: SeTakeOwnershipPrivilege 3056 VC_redist.x86.exe Token: SeLoadDriverPrivilege 3056 VC_redist.x86.exe Token: SeSystemProfilePrivilege 3056 VC_redist.x86.exe Token: SeSystemtimePrivilege 3056 VC_redist.x86.exe Token: SeProfSingleProcessPrivilege 3056 VC_redist.x86.exe Token: SeIncBasePriorityPrivilege 3056 VC_redist.x86.exe Token: SeCreatePagefilePrivilege 3056 VC_redist.x86.exe Token: SeCreatePermanentPrivilege 3056 VC_redist.x86.exe Token: SeBackupPrivilege 3056 VC_redist.x86.exe Token: SeRestorePrivilege 3056 VC_redist.x86.exe Token: SeShutdownPrivilege 3056 VC_redist.x86.exe Token: SeDebugPrivilege 3056 VC_redist.x86.exe Token: SeAuditPrivilege 3056 VC_redist.x86.exe Token: SeSystemEnvironmentPrivilege 3056 VC_redist.x86.exe Token: SeChangeNotifyPrivilege 3056 VC_redist.x86.exe Token: SeRemoteShutdownPrivilege 3056 VC_redist.x86.exe Token: SeUndockPrivilege 3056 VC_redist.x86.exe Token: SeSyncAgentPrivilege 3056 VC_redist.x86.exe Token: SeEnableDelegationPrivilege 3056 VC_redist.x86.exe Token: SeManageVolumePrivilege 3056 VC_redist.x86.exe Token: SeImpersonatePrivilege 3056 VC_redist.x86.exe Token: SeCreateGlobalPrivilege 3056 VC_redist.x86.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4756 roblox account manager.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 384 wrote to memory of 4756 384 roblox account manager.exe 84 PID 384 wrote to memory of 4756 384 roblox account manager.exe 84 PID 384 wrote to memory of 4756 384 roblox account manager.exe 84 PID 4756 wrote to memory of 3368 4756 roblox account manager.exe 85 PID 4756 wrote to memory of 3368 4756 roblox account manager.exe 85 PID 4756 wrote to memory of 3368 4756 roblox account manager.exe 85 PID 3368 wrote to memory of 232 3368 vcredist.tmp 86 PID 3368 wrote to memory of 232 3368 vcredist.tmp 86 PID 3368 wrote to memory of 232 3368 vcredist.tmp 86 PID 232 wrote to memory of 3056 232 vcredist.tmp 89 PID 232 wrote to memory of 3056 232 vcredist.tmp 89 PID 232 wrote to memory of 3056 232 vcredist.tmp 89 PID 3056 wrote to memory of 3192 3056 VC_redist.x86.exe 95 PID 3056 wrote to memory of 3192 3056 VC_redist.x86.exe 95 PID 3056 wrote to memory of 3192 3056 VC_redist.x86.exe 95 PID 3192 wrote to memory of 3552 3192 VC_redist.x86.exe 96 PID 3192 wrote to memory of 3552 3192 VC_redist.x86.exe 96 PID 3192 wrote to memory of 3552 3192 VC_redist.x86.exe 96 PID 3552 wrote to memory of 1352 3552 VC_redist.x86.exe 97 PID 3552 wrote to memory of 1352 3552 VC_redist.x86.exe 97 PID 3552 wrote to memory of 1352 3552 VC_redist.x86.exe 97 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe"C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe"C:\Users\Admin\AppData\Local\Temp\roblox account manager.exe" -restart2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp"C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\Temp\{7F8894AF-6A16-477C-9FEC-639B003D1000}\.cr\vcredist.tmp"C:\Windows\Temp\{7F8894AF-6A16-477C-9FEC-639B003D1000}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=544 -burn.filehandle.self=552 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\.be\VC_redist.x86.exe"C:\Windows\Temp\{397DCF4A-84E8-4B19-A8A6-3103AF25FEF1}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0F46A1E2-0BF1-425B-9697-48F092E479A8} {2F7352DB-AB91-49E8-A908-9123773C66A6} 2325⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1136 -burn.embedded BurnPipe.{42ACD8EA-C88F-4CB1-812F-DC3126E696A3} {ECF63735-FBFB-43F5-A7D7-A329AF63BB9E} 30566⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1136 -burn.embedded BurnPipe.{42ACD8EA-C88F-4CB1-812F-DC3126E696A3} {ECF63735-FBFB-43F5-A7D7-A329AF63BB9E} 30567⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{34059292-8A63-4FDE-BC35-A89276F3A51E} {985AF12D-76CE-4486-8AF7-D61FBEB84DE7} 35528⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 9408⤵
- Program crash
PID:1892
-
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3552 -ip 35521⤵PID:4608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD501c903794854453479a4ec4cde5afb6a
SHA15823e99dd7176c2a57eb84eae99740bb4f4240fa
SHA256bd68407a60f3c0217cba2a8535db906cf113094afababbdd1580f0767b95da0e
SHA51235c6bbfb78a74c2b7bf827abe1281223341ea58146913c62783155c946790c4aedee20104c600d3b80288fe1275e45840340078b184e48add73f6c44eccaf4bb
-
Filesize
18KB
MD5d6c8dc8fadfc89854ee3f48d3f1220c4
SHA1dbbacce6e35e8a741049b45c48413698793365cb
SHA256bcf2a5f19b7a56d6065bf57e7d4e95ddd232468682b3afa6597afc59d529014b
SHA51225c0ff693802b6c20c5cc7eed149b77ba301caf4ece7b92edcb084c057de8c163ba2b0f75f95bf924d3eb1a4e369a14ece953aec7e81e6f28447a400cb5e259e
-
Filesize
20KB
MD5467c28848a166ac0a7c6e2b466707f76
SHA1fa66dad707498a09ba539d52a40752c0c4e13704
SHA2568b5d5343c2bf0454b8262e4068fc0672b92cd979bc4674268302ac709c017aee
SHA5121d3350d11bf90a57a148a4ff42730236d6909afe9df0096771eafdb4a91445feb159ddb34bfd469b98b51ec079570dff6433284a3b5dc2c827073220a7a83c50
-
Filesize
19KB
MD5107ec3c82736496f24c18129d8d66ea8
SHA1307a491c34a6a3e355cee65da57bef19256fd5a4
SHA25652f5811c4d4a8b5ae35646c270b361a291d4eb33c8358cb5aa5f4fe0f3c8b53a
SHA512a4a0062eec22319345e11f284ce879f8f381406ae7ee69576b18e4f47148d6daaf64250f023599a61745f1c471fcae0ea0d396e7a1a5ac8f286311baf95c7d62
-
Filesize
1KB
MD5a02e8a8a790f0e0861e3b6b0dbe56062
SHA1a3e65805e5c78641cafebc1052906d7350da9d2e
SHA2567fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594
SHA512108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42
-
Filesize
314B
MD5f18fa783f4d27e35e54e54417334bfb4
SHA194511cdf37213bebdaf42a6140c9fe5be8eb07ba
SHA256563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
SHA512602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071
-
Filesize
2KB
MD5b7a42ea4ddb1cc814f2144c618f033c2
SHA190a01cc727ab999979c580af907cf9726e54dd62
SHA2567a62579736fd7a884d1451ccb132e2817e000fcbdbd58a54aa555bdeacdf4d41
SHA5125629c9cfa3b7092ebc310087afdcb6ff35ab463702f074b9bcf4397ba7bbf7132fc4d54f3d83a4b3e690be4a0c5874e7c3da54187cd4689ee551f1eb9ff3c88b
-
Filesize
2KB
MD554e3c3fe61d5cc3661a5fa3f3e6d416c
SHA11afde6431d8d5fab7e994012f00b866e9dbd0147
SHA256d7a2e20fca791c27e92307fc2098c67afacbc5321858334e8cf24406483c10fb
SHA512c83e5ef9ca9368da4539fe4c830bf8fb03a8825481bc1b570b5a701da8e4b608fa57bb6e60104d089e506422191ed9b8b252853595f7f6327f2372795a1f8447
-
Filesize
936B
MD5e4659ac08af3582a23f38bf6c562f841
SHA119cb4f014ba96285fa1798f008deabce632c7e76
SHA256e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
SHA5125bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249
-
Filesize
6KB
MD50a86fa27d09e26491dbbb4fe27f4b410
SHA163e4b5afb8bdb67fc1d6f8dddeb40be20939289e
SHA2562b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
SHA512fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d
-
Filesize
13.2MB
MD58457542fd4be74cb2c3a92b3386ae8e9
SHA1198722b4f5fc62721910569d9d926dce22730c22
SHA256a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
SHA51291a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
822KB
MD525bd21af44d3968a692e9b8a85f5c11d
SHA1d805d1624553199529a82151f23a1330ac596888
SHA256f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809
SHA512ed3660183bf4e0d39e4f43a643007afc143b1d4ec0b45f0fdce28d8e896f646ec24a2a7a5429e8b10f4379cb4ffd1572adba10fc426990d05c0cafefdd87a4fb
-
Filesize
4.9MB
MD53a7979fbe74502ddc0a9087ee9ca0bdf
SHA13c63238363807c2f254163769d0a582528e115af
SHA2567327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca
SHA5126435db0f210ad317f4cd00bb3300eb41fb86649f7a0e3a05e0f64f8d0163ab53dbdb3c98f99a15102ce09fcd437a148347bab7bfd4afe4c90ff2ea05bb4febff
-
Filesize
180KB
MD52ba51e907b5ee6b2aef6dfe5914ae3e3
SHA16cc2c49734bf9965fe0f3977705a417ed8548718
SHA256be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a
SHA512e3ba5aa8f366e3b1a92d8258daa74f327248fb21f168b7472b035f8d38f549f5f556eb9093eb8483ca51b78e9a77ee6e5b6e52378381cce50918d81e8e982d47
-
Filesize
180KB
MD5828f217e9513cfff708ffe62d238cfc5
SHA19fb65d4edb892bf940399d5fd6ae3a4b15c2e4ba
SHA256a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886
SHA512ffc72b92f1431bbd07889e28b55d14ea11f8401e2d0b180e43a898914209893941affacc0a4ea34eeefc9b0ca4bc84a3045591cd98aae6bdb11ae831dc6bb121
-
Filesize
634KB
MD5337b547d2771fdad56de13ac94e6b528
SHA13aeecc5933e7d8977e7a3623e8e44d4c3d0b4286
SHA25681873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
SHA5120d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36