hxxps://rule34video[.]com/categories/roblox/

max time kernel
60s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rule34video.com/categories/roblox/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1740	msedge.exe
1740	msedge.exe
4836	msedge.exe
4836	msedge.exe
1092	identity_helper.exe
1092	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 3184	1740	msedge.exe	78
PID 1740 wrote to memory of 3184	1740	msedge.exe	78
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1900	1740	msedge.exe	79
PID 1740 wrote to memory of 1996	1740	msedge.exe	80
PID 1740 wrote to memory of 1996	1740	msedge.exe	80
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81
PID 1740 wrote to memory of 4100	1740	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rule34video.com/categories/roblox/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd99603cb8,0x7ffd99603cc8,0x7ffd99603cd8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,3683261865247831916,15731031293599336291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7e80712b5c9e7a8c486beac7b7a3b14

SHA1
b9bc38575fd4bb4e878cf38028f436d70b70af9f

SHA256
4c7af4bce6c6756dd212514db8857fcef32e3cb0d8afeb00b5c3ca1cf553c29a

SHA512
44c793f2a092d9e63f20962c338ff825b419f5dddcf5b81f6e89d021ceff6e86a62eb91ec78d0ea365cbe07a06e660d58aa29703f52015d3d26a6a91335b4513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d74f0d9c6f70af121a7c1677e423ba2f

SHA1
2bae14a89717bdce5b698c5d623ee44a57789456

SHA256
f263b04b3006a63349ba7b8005ffa648941ca06007ea2e3c68a374ad0696c1ab

SHA512
0d18381ac982d4370c395e9514d6e4d684f9b4fb38ca8c94a74f61bd04a2d5e8887ccc0dbd06e44adc5f1c9339fb2b4db1c07b1c1408b776267b3c548cc98194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bd85f3f7b872a302ef345327d778591

SHA1
d54271e35c671923fc5a84196a2acc173a95d872

SHA256
c3d69a3317af69b25f7c097da9b3c51a2a9d1f4a47566ac2a1bd8e16e2ee6962

SHA512
3f28d30783324b5f2ded58cde45cbde61ef16bd4ad001c475565441d454c1d89ad714fa0a09cd73fca8d9ff386b3d46479068b2773086c5f791ef10362916c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
762bf93986b78b316c3a83f68d1b7e0d

SHA1
bbf3e931d3042b30e1a6e96fed4de704b4b501fc

SHA256
95f0f562428446ec74075dd779cb0cdcf5ad4e0d9d84ac5cb9c4988879f616de

SHA512
dfc678e3072107ce01138c2c0a4c3662fa953ae460b778d6aa44141ba74a5e1a65d53534de4e6a247eb5615adf44bdc0b559925bf4ee2fe3293ca319dcea3491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
434f193a64822d019e0380b8ded63567

SHA1
9fcc0def5bd0c4121e540cc56d413b1c2c1ccce1

SHA256
31505c094d5f5d5ee0c88fe3dcb84017ee07faaf2e6e51533bda996481482983

SHA512
2c7293e4fd52ae2b652e43c54b9e40b1c26ca6b2ccb784950c6da97a15b09aceb7272a5725cb29d29b89ea9c4686cc04acb4eb09d61daee0e4f7cb63801dd530

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit