Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RobloxPlayerInstaller.exe
-
Size
4.5MB
-
Sample
240806-tnqc7stdlp
-
MD5
c9c89a5180728704d9fc8b10fcfa5124
-
SHA1
6eb7edac4c879645641394eb20db3cf707019b47
-
SHA256
0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855
-
SHA512
98fbac35cbfff889ffb7a9b26684aee196237a54a9548285c233c2abf0a6a1f7588eb28d166a3a32e103f974418a7e75477cc699e5f0c8e3e290916b44ffc220
-
SSDEEP
98304:Smvn+iSkszLaY6ZZBrKv0Log5yGj06VuXJ+2npsbLfNzt:P+iBsGZ7KngtE+YK3fdt
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerInstaller.exe
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
RobloxPlayerInstaller.exe
-
Size
4.5MB
-
MD5
c9c89a5180728704d9fc8b10fcfa5124
-
SHA1
6eb7edac4c879645641394eb20db3cf707019b47
-
SHA256
0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855
-
SHA512
98fbac35cbfff889ffb7a9b26684aee196237a54a9548285c233c2abf0a6a1f7588eb28d166a3a32e103f974418a7e75477cc699e5f0c8e3e290916b44ffc220
-
SSDEEP
98304:Smvn+iSkszLaY6ZZBrKv0Log5yGj06VuXJ+2npsbLfNzt:P+iBsGZ7KngtE+YK3fdt
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1