Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/08/2024, 21:44

General

  • Target

    Roblox Account Manager.exe

  • Size

    5.2MB

  • MD5

    a057fae0c8c97ee6cf2c12fb7bcf034d

  • SHA1

    64fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6

  • SHA256

    cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9

  • SHA512

    447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200

  • SSDEEP

    98304:b2bT1Qm7d9GP4i7q0LTWgtUmWzmSyZs9S8Z/LywnrSkqXf0Fb7WnhNMYkj7:4Qm59q/tUhzmS9zZ/mY+kSIb7ahNMYk

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3456
      • C:\Users\Admin\AppData\Local\Temp\Auto Update.exe
        "C:\Users\Admin\AppData\Local\Temp\Auto Update.exe" -update
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
        • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
          "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe
            "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3736
            • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
              "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4900
              • C:\Windows\Temp\{9C0150B3-ADF4-46B3-A3E4-C8515DE552F0}\.cr\vcredist.tmp
                "C:\Windows\Temp\{9C0150B3-ADF4-46B3-A3E4-C8515DE552F0}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=544 -burn.filehandle.self=652 /q /norestart
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3816
                • C:\Windows\Temp\{BD30B72E-5BB8-4418-BF6A-6D4BB61463DA}\.be\VC_redist.x86.exe
                  "C:\Windows\Temp\{BD30B72E-5BB8-4418-BF6A-6D4BB61463DA}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9EF74F2B-0E62-4858-8314-AAAB68D8388D} {868AD90F-32FC-4254-B850-4DF396D0E760} 3816
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:3352
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1532
                  8⤵
                  • Program crash
                  PID:4644
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3172
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5032
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3816 -ip 3816
    1⤵
      PID:4380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log

      Filesize

      1KB

      MD5

      a02e8a8a790f0e0861e3b6b0dbe56062

      SHA1

      a3e65805e5c78641cafebc1052906d7350da9d2e

      SHA256

      7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

      SHA512

      108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

    • C:\Users\Admin\AppData\Local\Temp\Auto Update.exe

      Filesize

      5.2MB

      MD5

      a057fae0c8c97ee6cf2c12fb7bcf034d

      SHA1

      64fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6

      SHA256

      cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9

      SHA512

      447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200

    • C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini

      Filesize

      1KB

      MD5

      5369e83203a8972ee844ac973efd985a

      SHA1

      d91909ad9be3a67f66687a5cc58258fe2b715986

      SHA256

      fbbf21c6c6a3594b126ad1e48a06e315478022b6fa54ab0dc54b9ddaf30089ee

      SHA512

      af7fbb21b3ff7a32b34c72a303f380edda527a0f4273237f3c9a9f8804e83eb2bbbc1300135d094f64888227d72fdd832616dc2e18797398ad3df6db0d6b16f6

    • C:\Users\Admin\AppData\Local\Temp\RAMSettings.ini

      Filesize

      979B

      MD5

      55b8673b79b50f986f86a11d2d070f4f

      SHA1

      51a3100f7cd5906526263c3d3393eced7d0ee637

      SHA256

      1df09256c36fd4688402dcb748319d78827606aa53686bffdf709aa43d6765c7

      SHA512

      7ae72de3fcdf4e175699714fd78fc35b04ed3aaef8efe717ebdf62c9e4e125e22642dda9eaf3c00659d73ea8638452b0e9cd1a21cd88a6f4e72f98113d0b072a

    • C:\Users\Admin\AppData\Local\Temp\RAMTheme.ini

      Filesize

      314B

      MD5

      f18fa783f4d27e35e54e54417334bfb4

      SHA1

      94511cdf37213bebdaf42a6140c9fe5be8eb07ba

      SHA256

      563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

      SHA512

      602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe

      Filesize

      5.4MB

      MD5

      334728f32a1144c893fdffc579a7709b

      SHA1

      97d2eb634d45841c1453749acb911ce1303196c0

      SHA256

      be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1

      SHA512

      5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f

    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config

      Filesize

      5KB

      MD5

      7e067afe7c779870c370c40240e2ce1f

      SHA1

      71d59901ee26810c2b2cfdeca176cec9a54fdb48

      SHA256

      5e0ba1895cf088e6d6907b8abbd8cd41c86f39cc642351a9ab0bf458bf1f5b31

      SHA512

      7ae4e81cd7a06aca5c363e1009d898aa8b42236d6796c38a8ba07adb52eae45f69cd446d008a0e1d12c60c02a43bee1c813231d58884c6dd69a2967e243c9cc6

    • C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe.config

      Filesize

      6KB

      MD5

      0a86fa27d09e26491dbbb4fe27f4b410

      SHA1

      63e4b5afb8bdb67fc1d6f8dddeb40be20939289e

      SHA256

      2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d

      SHA512

      fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d

    • C:\Users\Admin\AppData\Local\Temp\log.txt

      Filesize

      142B

      MD5

      8f9c70ac8657af24194e37d87d99bf52

      SHA1

      a61f49bb9471f0c0632014da516e6e483abadca4

      SHA256

      034895019e155619dc219d8dc68dcd3149f2acbcdfc10d3e7148d0f59da20344

      SHA512

      4a932c41975fe5f17ac3d11dd21ffe51e316a3e1b050b00745a365a5b9d5e82804cd95dd1031d4535dcbd9c970a732c7404a97c6f5d91f70a39230ec5d26c12b

    • C:\Users\Admin\AppData\Local\Temp\log.txt

      Filesize

      569B

      MD5

      268caf6bfebc7a55b02d3eb8b4475912

      SHA1

      2b785e8cfd8a5109b62013cb4767bae0b62534fe

      SHA256

      51e5b7fa25270ac9aa193e5be92e73e07b58608969b82d4828d43be534911c7b

      SHA512

      f3e01c0cc3a4c0c11261c03572a9e99d8cdeb131a23d4e92a378978af66f01bd05b7d37543338598489043db804fd91e98aeb0c24f0bf16cbd77f3064736cff4

    • C:\Users\Admin\AppData\Local\Temp\log4.config

      Filesize

      936B

      MD5

      e4659ac08af3582a23f38bf6c562f841

      SHA1

      19cb4f014ba96285fa1798f008deabce632c7e76

      SHA256

      e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

      SHA512

      5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

    • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp

      Filesize

      13.2MB

      MD5

      8457542fd4be74cb2c3a92b3386ae8e9

      SHA1

      198722b4f5fc62721910569d9d926dce22730c22

      SHA256

      a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600

      SHA512

      91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182

    • C:\Windows\Temp\{9C0150B3-ADF4-46B3-A3E4-C8515DE552F0}\.cr\vcredist.tmp

      Filesize

      634KB

      MD5

      337b547d2771fdad56de13ac94e6b528

      SHA1

      3aeecc5933e7d8977e7a3623e8e44d4c3d0b4286

      SHA256

      81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0

      SHA512

      0d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36

    • C:\Windows\Temp\{BD30B72E-5BB8-4418-BF6A-6D4BB61463DA}\.ba\logo.png

      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

    • C:\Windows\Temp\{BD30B72E-5BB8-4418-BF6A-6D4BB61463DA}\.ba\wixstdba.dll

      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

    • memory/1256-15-0x0000000075050000-0x0000000075800000-memory.dmp

      Filesize

      7.7MB

    • memory/1256-7-0x0000000005990000-0x00000000059AE000-memory.dmp

      Filesize

      120KB

    • memory/1256-6-0x0000000005950000-0x0000000005976000-memory.dmp

      Filesize

      152KB

    • memory/1256-5-0x0000000005A60000-0x0000000005AF2000-memory.dmp

      Filesize

      584KB

    • memory/1256-4-0x0000000005900000-0x0000000005946000-memory.dmp

      Filesize

      280KB

    • memory/1256-3-0x0000000075050000-0x0000000075800000-memory.dmp

      Filesize

      7.7MB

    • memory/1256-2-0x0000000005F70000-0x0000000006514000-memory.dmp

      Filesize

      5.6MB

    • memory/1256-0-0x000000007505E000-0x000000007505F000-memory.dmp

      Filesize

      4KB

    • memory/1256-1-0x0000000000A10000-0x0000000000F4E000-memory.dmp

      Filesize

      5.2MB

    • memory/2712-70-0x0000000000480000-0x00000000009EC000-memory.dmp

      Filesize

      5.4MB

    • memory/2712-71-0x0000000005210000-0x0000000005256000-memory.dmp

      Filesize

      280KB

    • memory/2796-55-0x000000000A3C0000-0x000000000A3D2000-memory.dmp

      Filesize

      72KB

    • memory/2796-62-0x000000000BCD0000-0x000000000BCEE000-memory.dmp

      Filesize

      120KB

    • memory/2796-56-0x000000000A460000-0x000000000A4D6000-memory.dmp

      Filesize

      472KB

    • memory/3456-53-0x0000000075050000-0x0000000075800000-memory.dmp

      Filesize

      7.7MB

    • memory/3456-24-0x0000000075050000-0x0000000075800000-memory.dmp

      Filesize

      7.7MB

    • memory/3456-35-0x000000000BF90000-0x000000000C04E000-memory.dmp

      Filesize

      760KB

    • memory/3456-39-0x000000000C350000-0x000000000C35A000-memory.dmp

      Filesize

      40KB

    • memory/3456-38-0x000000000C080000-0x000000000C088000-memory.dmp

      Filesize

      32KB

    • memory/3456-37-0x000000000C090000-0x000000000C098000-memory.dmp

      Filesize

      32KB

    • memory/3456-33-0x000000000B9A0000-0x000000000BA52000-memory.dmp

      Filesize

      712KB

    • memory/3456-31-0x000000000B910000-0x000000000B968000-memory.dmp

      Filesize

      352KB

    • memory/3456-36-0x000000000C050000-0x000000000C06A000-memory.dmp

      Filesize

      104KB

    • memory/3456-26-0x000000000B230000-0x000000000B23A000-memory.dmp

      Filesize

      40KB

    • memory/3456-25-0x000000000B1A0000-0x000000000B232000-memory.dmp

      Filesize

      584KB

    • memory/3456-34-0x000000000BE20000-0x000000000BE42000-memory.dmp

      Filesize

      136KB

    • memory/3456-23-0x000000000A900000-0x000000000A934000-memory.dmp

      Filesize

      208KB

    • memory/3456-14-0x0000000075050000-0x0000000075800000-memory.dmp

      Filesize

      7.7MB

    • memory/3456-17-0x0000000075050000-0x0000000075800000-memory.dmp

      Filesize

      7.7MB

    • memory/3456-22-0x0000000075050000-0x0000000075800000-memory.dmp

      Filesize

      7.7MB

    • memory/3456-19-0x0000000005FB0000-0x0000000006024000-memory.dmp

      Filesize

      464KB

    • memory/3456-20-0x0000000006060000-0x000000000606A000-memory.dmp

      Filesize

      40KB

    • memory/3736-88-0x000000000DD20000-0x000000000DE14000-memory.dmp

      Filesize

      976KB

    • memory/3736-82-0x000000000BE00000-0x000000000BEA0000-memory.dmp

      Filesize

      640KB

    • memory/3736-81-0x000000000BC20000-0x000000000BC5A000-memory.dmp

      Filesize

      232KB