Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
Roblox Account Manager.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Roblox Account Manager.exe
Resource
win10v2004-20240802-en
General
-
Target
Roblox Account Manager.exe
-
Size
5.2MB
-
MD5
a057fae0c8c97ee6cf2c12fb7bcf034d
-
SHA1
64fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6
-
SHA256
cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9
-
SHA512
447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200
-
SSDEEP
98304:b2bT1Qm7d9GP4i7q0LTWgtUmWzmSyZs9S8Z/LywnrSkqXf0Fb7WnhNMYkj7:4Qm59q/tUhzmS9zZ/mY+kSIb7ahNMYk
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation Roblox Account Manager.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation Roblox Account Manager.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation Roblox Account Manager.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation vcredist.tmp -
Deletes itself 1 IoCs
pid Process 2796 Auto Update.exe -
Executes dropped EXE 6 IoCs
pid Process 2796 Auto Update.exe 2712 Roblox Account Manager.exe 3736 Roblox Account Manager.exe 4900 vcredist.tmp 3816 vcredist.tmp 3352 VC_redist.x86.exe -
Loads dropped DLL 1 IoCs
pid Process 3816 vcredist.tmp -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{47109d57-d746-4f8b-9618-ed6a17cc922b} = "\"C:\\ProgramData\\Package Cache\\{47109d57-d746-4f8b-9618-ed6a17cc922b}\\VC_redist.x86.exe\" /burn.runonce" VC_redist.x86.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 31 raw.githubusercontent.com 46 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4644 3816 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Auto Update.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Roblox Account Manager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Roblox Account Manager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Roblox Account Manager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Roblox Account Manager.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e7a671f193ce7b7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e7a671f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e7a671f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de7a671f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e7a671f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\TypedURLs Roblox Account Manager.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\TypedURLs Roblox Account Manager.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.40.33810" VC_redist.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b} VC_redist.x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Dependents VC_redist.x86.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\ = "{47109d57-d746-4f8b-9618-ed6a17cc922b}" VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Version = "14.40.33810.0" VC_redist.x86.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2796 Auto Update.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 3456 Roblox Account Manager.exe Token: SeDebugPrivilege 2796 Auto Update.exe Token: SeIncreaseQuotaPrivilege 2796 Auto Update.exe Token: SeDebugPrivilege 3736 Roblox Account Manager.exe Token: SeBackupPrivilege 3172 vssvc.exe Token: SeRestorePrivilege 3172 vssvc.exe Token: SeAuditPrivilege 3172 vssvc.exe Token: SeBackupPrivilege 5032 srtasks.exe Token: SeRestorePrivilege 5032 srtasks.exe Token: SeSecurityPrivilege 5032 srtasks.exe Token: SeTakeOwnershipPrivilege 5032 srtasks.exe Token: SeBackupPrivilege 5032 srtasks.exe Token: SeRestorePrivilege 5032 srtasks.exe Token: SeSecurityPrivilege 5032 srtasks.exe Token: SeTakeOwnershipPrivilege 5032 srtasks.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1256 wrote to memory of 3456 1256 Roblox Account Manager.exe 86 PID 1256 wrote to memory of 3456 1256 Roblox Account Manager.exe 86 PID 1256 wrote to memory of 3456 1256 Roblox Account Manager.exe 86 PID 3456 wrote to memory of 2796 3456 Roblox Account Manager.exe 87 PID 3456 wrote to memory of 2796 3456 Roblox Account Manager.exe 87 PID 3456 wrote to memory of 2796 3456 Roblox Account Manager.exe 87 PID 2712 wrote to memory of 3736 2712 Roblox Account Manager.exe 90 PID 2712 wrote to memory of 3736 2712 Roblox Account Manager.exe 90 PID 2712 wrote to memory of 3736 2712 Roblox Account Manager.exe 90 PID 3736 wrote to memory of 4900 3736 Roblox Account Manager.exe 92 PID 3736 wrote to memory of 4900 3736 Roblox Account Manager.exe 92 PID 3736 wrote to memory of 4900 3736 Roblox Account Manager.exe 92 PID 4900 wrote to memory of 3816 4900 vcredist.tmp 93 PID 4900 wrote to memory of 3816 4900 vcredist.tmp 93 PID 4900 wrote to memory of 3816 4900 vcredist.tmp 93 PID 3816 wrote to memory of 3352 3816 vcredist.tmp 94 PID 3816 wrote to memory of 3352 3816 vcredist.tmp 94 PID 3816 wrote to memory of 3352 3816 vcredist.tmp 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\Auto Update.exe"C:\Users\Admin\AppData\Local\Temp\Auto Update.exe" -update3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp"C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\Temp\{9C0150B3-ADF4-46B3-A3E4-C8515DE552F0}\.cr\vcredist.tmp"C:\Windows\Temp\{9C0150B3-ADF4-46B3-A3E4-C8515DE552F0}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=544 -burn.filehandle.self=652 /q /norestart7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\Temp\{BD30B72E-5BB8-4418-BF6A-6D4BB61463DA}\.be\VC_redist.x86.exe"C:\Windows\Temp\{BD30B72E-5BB8-4418-BF6A-6D4BB61463DA}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9EF74F2B-0E62-4858-8314-AAAB68D8388D} {868AD90F-32FC-4254-B850-4DF396D0E760} 38168⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 15328⤵
- Program crash
PID:4644
-
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3816 -ip 38161⤵PID:4380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a02e8a8a790f0e0861e3b6b0dbe56062
SHA1a3e65805e5c78641cafebc1052906d7350da9d2e
SHA2567fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594
SHA512108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42
-
Filesize
5.2MB
MD5a057fae0c8c97ee6cf2c12fb7bcf034d
SHA164fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6
SHA256cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9
SHA512447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200
-
Filesize
1KB
MD55369e83203a8972ee844ac973efd985a
SHA1d91909ad9be3a67f66687a5cc58258fe2b715986
SHA256fbbf21c6c6a3594b126ad1e48a06e315478022b6fa54ab0dc54b9ddaf30089ee
SHA512af7fbb21b3ff7a32b34c72a303f380edda527a0f4273237f3c9a9f8804e83eb2bbbc1300135d094f64888227d72fdd832616dc2e18797398ad3df6db0d6b16f6
-
Filesize
979B
MD555b8673b79b50f986f86a11d2d070f4f
SHA151a3100f7cd5906526263c3d3393eced7d0ee637
SHA2561df09256c36fd4688402dcb748319d78827606aa53686bffdf709aa43d6765c7
SHA5127ae72de3fcdf4e175699714fd78fc35b04ed3aaef8efe717ebdf62c9e4e125e22642dda9eaf3c00659d73ea8638452b0e9cd1a21cd88a6f4e72f98113d0b072a
-
Filesize
314B
MD5f18fa783f4d27e35e54e54417334bfb4
SHA194511cdf37213bebdaf42a6140c9fe5be8eb07ba
SHA256563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
SHA512602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071
-
Filesize
5.4MB
MD5334728f32a1144c893fdffc579a7709b
SHA197d2eb634d45841c1453749acb911ce1303196c0
SHA256be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
SHA5125df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f
-
Filesize
5KB
MD57e067afe7c779870c370c40240e2ce1f
SHA171d59901ee26810c2b2cfdeca176cec9a54fdb48
SHA2565e0ba1895cf088e6d6907b8abbd8cd41c86f39cc642351a9ab0bf458bf1f5b31
SHA5127ae4e81cd7a06aca5c363e1009d898aa8b42236d6796c38a8ba07adb52eae45f69cd446d008a0e1d12c60c02a43bee1c813231d58884c6dd69a2967e243c9cc6
-
Filesize
6KB
MD50a86fa27d09e26491dbbb4fe27f4b410
SHA163e4b5afb8bdb67fc1d6f8dddeb40be20939289e
SHA2562b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
SHA512fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d
-
Filesize
142B
MD58f9c70ac8657af24194e37d87d99bf52
SHA1a61f49bb9471f0c0632014da516e6e483abadca4
SHA256034895019e155619dc219d8dc68dcd3149f2acbcdfc10d3e7148d0f59da20344
SHA5124a932c41975fe5f17ac3d11dd21ffe51e316a3e1b050b00745a365a5b9d5e82804cd95dd1031d4535dcbd9c970a732c7404a97c6f5d91f70a39230ec5d26c12b
-
Filesize
569B
MD5268caf6bfebc7a55b02d3eb8b4475912
SHA12b785e8cfd8a5109b62013cb4767bae0b62534fe
SHA25651e5b7fa25270ac9aa193e5be92e73e07b58608969b82d4828d43be534911c7b
SHA512f3e01c0cc3a4c0c11261c03572a9e99d8cdeb131a23d4e92a378978af66f01bd05b7d37543338598489043db804fd91e98aeb0c24f0bf16cbd77f3064736cff4
-
Filesize
936B
MD5e4659ac08af3582a23f38bf6c562f841
SHA119cb4f014ba96285fa1798f008deabce632c7e76
SHA256e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
SHA5125bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249
-
Filesize
13.2MB
MD58457542fd4be74cb2c3a92b3386ae8e9
SHA1198722b4f5fc62721910569d9d926dce22730c22
SHA256a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
SHA51291a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182
-
Filesize
634KB
MD5337b547d2771fdad56de13ac94e6b528
SHA13aeecc5933e7d8977e7a3623e8e44d4c3d0b4286
SHA25681873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
SHA5120d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2