Resubmissions

02/08/2024, 19:58

240802-ypzeqaxglp 6

02/08/2024, 19:46

240802-yg1mtasemh 7

02/08/2024, 19:45

240802-ygwc4asemb 6

02/08/2024, 19:45

240802-ygqgvaselc 6

02/08/2024, 19:44

240802-yf4yvaxdnq 6

02/08/2024, 19:43

240802-yff7saxdlj 6

02/08/2024, 19:39

240802-ydf41ascre 7

General

  • Target

    RobloxStudioInstaller.exe

  • Size

    4.4MB

  • Sample

    240802-ygwc4asemb

  • MD5

    96054bd5385aa4720717cd4085b91f25

  • SHA1

    472470578ce8706b17b7ac6148461da9dd70eedd

  • SHA256

    efc8ed2815bb341e102d9160fe74c12e0fb1f59513b672e5ddf63911d300a014

  • SHA512

    8ffcba01e51782c4c946b73303d2cff4105c2f7e465100c9cfaa5ae96a7cb51a6c22020c43402e4779053e7e3e1f616b374c7e019e8b089349b46e75f0886615

  • SSDEEP

    98304:4VvqeclcRUVPFZnGJTVgqekkbOcfyzmCQTqVLarbhh/C0S:iqeQVH8gakLpqlwK0S

Malware Config

Targets

    • Target

      RobloxStudioInstaller.exe

    • Size

      4.4MB

    • MD5

      96054bd5385aa4720717cd4085b91f25

    • SHA1

      472470578ce8706b17b7ac6148461da9dd70eedd

    • SHA256

      efc8ed2815bb341e102d9160fe74c12e0fb1f59513b672e5ddf63911d300a014

    • SHA512

      8ffcba01e51782c4c946b73303d2cff4105c2f7e465100c9cfaa5ae96a7cb51a6c22020c43402e4779053e7e3e1f616b374c7e019e8b089349b46e75f0886615

    • SSDEEP

      98304:4VvqeclcRUVPFZnGJTVgqekkbOcfyzmCQTqVLarbhh/C0S:iqeQVH8gakLpqlwK0S

    • Checks whether UAC is enabled

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

MITRE ATT&CK Enterprise v15

Tasks