hxxps://github[.]com/ic3w0lf22/Roblox-Account-Manager/releases/download/3[.]6[.]1/Roblox[.]Account[.]Manager[.]3[.]6[.]1[.]zip

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ic3w0lf22/Roblox-Account-Manager/releases/download/3.6.1/Roblox.Account.Manager.3.6.1.zip

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	Roblox Account Manager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	vcredist.tmp

Executes dropped EXE 6 IoCs

pid	Process
1792	Auto Update.exe
996	Roblox Account Manager.exe
4180	Roblox Account Manager.exe
1104	vcredist.tmp
5076	vcredist.tmp
2424	VC_redist.x86.exe

Loads dropped DLL 3 IoCs

pid	Process
5076	vcredist.tmp
4180	Roblox Account Manager.exe
6108	VC_redist.x86.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{47109d57-d746-4f8b-9618-ed6a17cc922b} = "\"C:\\ProgramData\\Package Cache\\{47109d57-d746-4f8b-9618-ed6a17cc922b}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
86	raw.githubusercontent.com
87	raw.githubusercontent.com
115	raw.githubusercontent.com

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI51F0.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}	msiexec.exe
File created	C:\Windows\Installer\e594a1f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E93.tmp	msiexec.exe
File created	C:\Windows\Installer\e594a31.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0C3457A0-3DCE-4A33-BEF0-9B528C557771}	msiexec.exe
File created	C:\Windows\Installer\e594a46.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594a1f.msi	msiexec.exe
File created	C:\Windows\Installer\e594a30.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594a31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6599.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Auto Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Account Manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f7b83aff83bcb26e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f7b83aff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f7b83aff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df7b83aff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f7b83aff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\TypedURLs	Roblox Account Manager.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}v14.40.33810\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\PackageCode = "56C1F3EFF13FBC94887129B2E83EB575"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\0A7543C0ECD333A4EB0FB925C8557717	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\899C6AE5CA5D9DE4983CF9521BC7DCD3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\PackageCode = "829638B4928B2094C8872CEC8D04BB92"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.40.33810"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Version = "14.40.33810.0"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\Provider	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{0C3457A0-3DCE-4A33-BEF0-9B528C557771}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A7543C0ECD333A4EB0FB925C8557717\VC_Runtime_Minimum	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\ = "{47109d57-d746-4f8b-9618-ed6a17cc922b}"	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.40.33810"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.40,bundle\Dependents\{47109d57-d746-4f8b-9618-ed6a17cc922b}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0C3457A0-3DCE-4A33-BEF0-9B528C557771}v14.40.33810\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1792	Auto Update.exe
1792	Auto Update.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
2424	VC_redist.x86.exe
2424	VC_redist.x86.exe
2424	VC_redist.x86.exe
2424	VC_redist.x86.exe
2424	VC_redist.x86.exe
2424	VC_redist.x86.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe
5560	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4180	Roblox Account Manager.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	Roblox Account Manager.exe
Token: SeDebugPrivilege	1792	Auto Update.exe
Token: SeIncreaseQuotaPrivilege	1792	Auto Update.exe
Token: SeDebugPrivilege	4180	Roblox Account Manager.exe
Token: SeBackupPrivilege	4196	vssvc.exe
Token: SeRestorePrivilege	4196	vssvc.exe
Token: SeAuditPrivilege	4196	vssvc.exe
Token: SeShutdownPrivilege	2424	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2424	VC_redist.x86.exe
Token: SeSecurityPrivilege	5560	msiexec.exe
Token: SeCreateTokenPrivilege	2424	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	2424	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	2424	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	2424	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	2424	VC_redist.x86.exe
Token: SeTcbPrivilege	2424	VC_redist.x86.exe
Token: SeSecurityPrivilege	2424	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	2424	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	2424	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	2424	VC_redist.x86.exe
Token: SeSystemtimePrivilege	2424	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	2424	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	2424	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	2424	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	2424	VC_redist.x86.exe
Token: SeBackupPrivilege	2424	VC_redist.x86.exe
Token: SeRestorePrivilege	2424	VC_redist.x86.exe
Token: SeShutdownPrivilege	2424	VC_redist.x86.exe
Token: SeDebugPrivilege	2424	VC_redist.x86.exe
Token: SeAuditPrivilege	2424	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	2424	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	2424	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	2424	VC_redist.x86.exe
Token: SeUndockPrivilege	2424	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	2424	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	2424	VC_redist.x86.exe
Token: SeManageVolumePrivilege	2424	VC_redist.x86.exe
Token: SeImpersonatePrivilege	2424	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	2424	VC_redist.x86.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe
Token: SeTakeOwnershipPrivilege	5560	msiexec.exe
Token: SeRestorePrivilege	5560	msiexec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1660	1512	Roblox Account Manager.exe	114
PID 1512 wrote to memory of 1660	1512	Roblox Account Manager.exe	114
PID 1512 wrote to memory of 1660	1512	Roblox Account Manager.exe	114
PID 1660 wrote to memory of 1792	1660	Roblox Account Manager.exe	115
PID 1660 wrote to memory of 1792	1660	Roblox Account Manager.exe	115
PID 1660 wrote to memory of 1792	1660	Roblox Account Manager.exe	115
PID 996 wrote to memory of 4180	996	Roblox Account Manager.exe	121
PID 996 wrote to memory of 4180	996	Roblox Account Manager.exe	121
PID 996 wrote to memory of 4180	996	Roblox Account Manager.exe	121
PID 4180 wrote to memory of 1104	4180	Roblox Account Manager.exe	124
PID 4180 wrote to memory of 1104	4180	Roblox Account Manager.exe	124
PID 4180 wrote to memory of 1104	4180	Roblox Account Manager.exe	124
PID 1104 wrote to memory of 5076	1104	vcredist.tmp	125
PID 1104 wrote to memory of 5076	1104	vcredist.tmp	125
PID 1104 wrote to memory of 5076	1104	vcredist.tmp	125
PID 5076 wrote to memory of 2424	5076	vcredist.tmp	126
PID 5076 wrote to memory of 2424	5076	vcredist.tmp	126
PID 5076 wrote to memory of 2424	5076	vcredist.tmp	126
PID 2424 wrote to memory of 6088	2424	VC_redist.x86.exe	134
PID 2424 wrote to memory of 6088	2424	VC_redist.x86.exe	134
PID 2424 wrote to memory of 6088	2424	VC_redist.x86.exe	134
PID 6088 wrote to memory of 6108	6088	VC_redist.x86.exe	135
PID 6088 wrote to memory of 6108	6088	VC_redist.x86.exe	135
PID 6088 wrote to memory of 6108	6088	VC_redist.x86.exe	135
PID 6108 wrote to memory of 5608	6108	VC_redist.x86.exe	136
PID 6108 wrote to memory of 5608	6108	VC_redist.x86.exe	136
PID 6108 wrote to memory of 5608	6108	VC_redist.x86.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ic3w0lf22/Roblox-Account-Manager/releases/download/3.6.1/Roblox.Account.Manager.3.6.1.zip
1⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4100,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
1⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3324,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
1⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5392,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5396,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
1⤵
PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6100,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
1⤵
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6152,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
1⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6052,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
1⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6920,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
1⤵
PID:3936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3900

C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
"C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
  "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe" -restart
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Auto Update.exe
    "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Auto Update.exe" -update
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1792
  - - C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
      "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:996
    - - C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
        
        "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe" -restart
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\Temp\{FE0FB6FF-D7B7-4EDA-A7B3-6BE2983A6BB8}\.cr\vcredist.tmp
        
        "C:\Windows\Temp\{FE0FB6FF-D7B7-4EDA-A7B3-6BE2983A6BB8}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=548 -burn.filehandle.self=560 /q /norestart
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{F70AA078-FEB2-42FD-889B-FD3D4918CD0A} {7754A132-A0EE-41C0-AB6B-EB1AABEF304F} 5076
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{16F4BFFF-74EE-4662-BE56-D4E729E5BC17} {D03BF886-DC21-445A-9D53-79433E7AC87B} 2424
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{16F4BFFF-74EE-4662-BE56-D4E729E5BC17} {D03BF886-DC21-445A-9D53-79433E7AC87B} 2424
        10⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{562DAA28-87FD-48C0-ACD0-5B3D1068CF5A} {A2068DF1-4BA0-47D0-A9FE-042375800E4F} 6108
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6076,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
1⤵
PID:1624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5412

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e594a24.rbs

Filesize
16KB

MD5
2da9c4e65aab26aa0f692dacc8be4c26

SHA1
c3f1f5cc0e9c958aeedeb15a21f12cccda2c794d

SHA256
39b28e7c3b2659e4443484ac8395110d100f04c916512c384d93c67ae2e7837a

SHA512
58ca0d54e11a09495a6be8460cb8714fbd6642e9077b09f3a390bc0dba4b588a8a8a39fdb67936240532a40c274618c6e3a49920f2927ad505426de60afeac0c

Download Submit
C:\Config.Msi\e594a29.rbs

Filesize
18KB

MD5
353171b2c2ec6a88cf135de27bba6bd4

SHA1
5f99771a073ca6609741944a5cb26cb432072206

SHA256
e5bf54bebf8e589057417bd39f8c364833a573d8865e3a49ebb94a1e1562e61a

SHA512
fac476aa3b0d1445adbd2d7ea1979bd4db43e6f3bb925aeb2755a6683fe060db8c9cb2e02581395ae3113cb28b8b83d4d931a5f51d55f137803708ebb317f8ff

Download Submit
C:\Config.Msi\e594a36.rbs

Filesize
20KB

MD5
965f845605d7924a747c180786c2766b

SHA1
03de94d1d1627e8bf14d3885532670c4bf801998

SHA256
5848b775fbeaa23a080ce036b3857e52f717d40787968776fabb473b17e3c3e0

SHA512
67d497799f09acd0c01a0758004b7b5f3f6bcaae6c96f80e239ce7cd56e6599de20e7de9f7695ec4c91622f94039c4dee0273e0dffc3dbc9ac03e0637ce8fe35

Download Submit
C:\Config.Msi\e594a45.rbs

Filesize
19KB

MD5
47c1af38557168ca338c610f7d7f00ee

SHA1
2729487735411e62beba8126708aaad17b14a2fb

SHA256
f2cce64839e6b1162e5500b80b5566a6ca52a73ae2f85c8246afac50f72222e2

SHA512
73db26513a7a44376d12b701475082c3a207588fcc12285ae82841e91f805c504983d38fa43bb0590c0579b8bd2076d8c88152608e328838c1b7014c0c8b71fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log

Filesize
1KB

MD5
a02e8a8a790f0e0861e3b6b0dbe56062

SHA1
a3e65805e5c78641cafebc1052906d7350da9d2e

SHA256
7fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594

SHA512
108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240810204231_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
ff9121cede2ce95afc764f678e4d677e

SHA1
cc87bde13f49769e10fcdfe5fff02234e1797104

SHA256
80ada8b4626809e57977585f6ccd034d0b7113462b68f748ec6c89deee987298

SHA512
6b08acde152602638043b593fb06905c515b71715aead2def5f39e22d1cd2b7bfacf6b9db6ca1756677c8b0a34e058c7be9cbf8cf61ff89386c6c5e05dbeb566

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240810204231_001_vcRuntimeAdditional_x86.log

Filesize
4KB

MD5
a16197a4f3c96e547ea1f42ef88db34a

SHA1
61e3e2398725ab435782b102d452ee590bda6c0d

SHA256
4d2286e691a729a5906feccd989ee98bb2d5cf923d2d621b3da028c867799122

SHA512
619412a862ea105a47b8d6b44b304167be4d16699b8769c22154ff8388f7482cb3dcdfc6730d41959c08ae15be56fb4277ed025bbb92202c08c942e67869412a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp

Filesize
13.2MB

MD5
8457542fd4be74cb2c3a92b3386ae8e9

SHA1
198722b4f5fc62721910569d9d926dce22730c22

SHA256
a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600

SHA512
91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Auto Update.exe

Filesize
5.2MB

MD5
a057fae0c8c97ee6cf2c12fb7bcf034d

SHA1
64fe0eb242b5c3f9c42f4f2c1685e4a36708e4f6

SHA256
cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9

SHA512
447cf69cf39ef19d098f4ab223d6ad9d760efb1eabb1bb0dac27fd2e55ac14c5a6502f2edd00b199d2db702e38551065bcc087c8df931360e769443908a4d200

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\RAMSettings.ini

Filesize
1KB

MD5
5369e83203a8972ee844ac973efd985a

SHA1
d91909ad9be3a67f66687a5cc58258fe2b715986

SHA256
fbbf21c6c6a3594b126ad1e48a06e315478022b6fa54ab0dc54b9ddaf30089ee

SHA512
af7fbb21b3ff7a32b34c72a303f380edda527a0f4273237f3c9a9f8804e83eb2bbbc1300135d094f64888227d72fdd832616dc2e18797398ad3df6db0d6b16f6

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\RAMSettings.ini

Filesize
979B

MD5
55b8673b79b50f986f86a11d2d070f4f

SHA1
51a3100f7cd5906526263c3d3393eced7d0ee637

SHA256
1df09256c36fd4688402dcb748319d78827606aa53686bffdf709aa43d6765c7

SHA512
7ae72de3fcdf4e175699714fd78fc35b04ed3aaef8efe717ebdf62c9e4e125e22642dda9eaf3c00659d73ea8638452b0e9cd1a21cd88a6f4e72f98113d0b072a

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\RAMTheme.ini

Filesize
314B

MD5
f18fa783f4d27e35e54e54417334bfb4

SHA1
94511cdf37213bebdaf42a6140c9fe5be8eb07ba

SHA256
563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1

SHA512
602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe

Filesize
5.4MB

MD5
334728f32a1144c893fdffc579a7709b

SHA1
97d2eb634d45841c1453749acb911ce1303196c0

SHA256
be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1

SHA512
5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe.config

Filesize
5KB

MD5
7e067afe7c779870c370c40240e2ce1f

SHA1
71d59901ee26810c2b2cfdeca176cec9a54fdb48

SHA256
5e0ba1895cf088e6d6907b8abbd8cd41c86f39cc642351a9ab0bf458bf1f5b31

SHA512
7ae4e81cd7a06aca5c363e1009d898aa8b42236d6796c38a8ba07adb52eae45f69cd446d008a0e1d12c60c02a43bee1c813231d58884c6dd69a2967e243c9cc6

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe.config

Filesize
6KB

MD5
0a86fa27d09e26491dbbb4fe27f4b410

SHA1
63e4b5afb8bdb67fc1d6f8dddeb40be20939289e

SHA256
2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d

SHA512
fbebc4dc0925d5d67271cac04c1ed324091442ef4c9f6243d2c1c523c9aa6b338c6a594e4987fc142dd3b2a023338a267c8a3454e47fbf0b3e0dbd7b3b65cc0d

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\libsodium.dll

Filesize
477KB

MD5
4f6426e3626d5d46fb19c13043cb84de

SHA1
9dfa32f957c19c843a568b57d555d6d5cbc61579

SHA256
7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba

SHA512
7a83adf2b36973ceb52bfc95591bc91d4ac778a4e11d11723f6d8bf208811b8fa7d072851cfed73407c9413455de717e9a42f8e6bb1a133cb2b1981c66bb5832

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\log.txt

Filesize
142B

MD5
8472bd83c945b68a4279863b2c5eb6de

SHA1
13eaf6129eea6b4a5e6bf67588bab68681105a75

SHA256
a98786062dffab2c561fd391cbfce37bdc9e5f5eade22d896ae295a45dfb13a6

SHA512
ceaec429cf7504b1db357c5b31ef3a6356a9cb1cbb4dc4dc0ff86a896f295223206a7c09ad9c7c5b2c33f56468c69e629a038e860e4ddf33b5c1e22ccdeaa557

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\log.txt

Filesize
569B

MD5
c3b6e0a468e2442d130381150331a243

SHA1
431af864d709a5a08cfcab17cd9b8b48b1d9be21

SHA256
18d802aed19e7a97b5a75f613e9c015add04ea9aeebc897791d9ed8a31b2ee0d

SHA512
3c88fecfeda1e2a785846c33ca2b662130f449d62bc44424ac9555abe4f5251ab4ee3d940e63db6a6508c0eb5f3fdba9613bb6d27fc0ffb14b0ba13b50cc474d

Download Submit
C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\log4.config

Filesize
936B

MD5
e4659ac08af3582a23f38bf6c562f841

SHA1
19cb4f014ba96285fa1798f008deabce632c7e76

SHA256
e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5

SHA512
5bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249

Download Submit
C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
822KB

MD5
25bd21af44d3968a692e9b8a85f5c11d

SHA1
d805d1624553199529a82151f23a1330ac596888

SHA256
f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809

SHA512
ed3660183bf4e0d39e4f43a643007afc143b1d4ec0b45f0fdce28d8e896f646ec24a2a7a5429e8b10f4379cb4ffd1572adba10fc426990d05c0cafefdd87a4fb

Download Submit
C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
3a7979fbe74502ddc0a9087ee9ca0bdf

SHA1
3c63238363807c2f254163769d0a582528e115af

SHA256
7327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca

SHA512
6435db0f210ad317f4cd00bb3300eb41fb86649f7a0e3a05e0f64f8d0163ab53dbdb3c98f99a15102ce09fcd437a148347bab7bfd4afe4c90ff2ea05bb4febff

Download Submit
C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\vcRuntimeAdditional_x86

Filesize
180KB

MD5
2ba51e907b5ee6b2aef6dfe5914ae3e3

SHA1
6cc2c49734bf9965fe0f3977705a417ed8548718

SHA256
be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a

SHA512
e3ba5aa8f366e3b1a92d8258daa74f327248fb21f168b7472b035f8d38f549f5f556eb9093eb8483ca51b78e9a77ee6e5b6e52378381cce50918d81e8e982d47

Download Submit
C:\Windows\Temp\{FDBE127A-3498-41A9-ADCA-D736B166434A}\vcRuntimeMinimum_x86

Filesize
180KB

MD5
828f217e9513cfff708ffe62d238cfc5

SHA1
9fb65d4edb892bf940399d5fd6ae3a4b15c2e4ba

SHA256
a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886

SHA512
ffc72b92f1431bbd07889e28b55d14ea11f8401e2d0b180e43a898914209893941affacc0a4ea34eeefc9b0ca4bc84a3045591cd98aae6bdb11ae831dc6bb121

Download Submit
C:\Windows\Temp\{FE0FB6FF-D7B7-4EDA-A7B3-6BE2983A6BB8}\.cr\vcredist.tmp

Filesize
634KB

MD5
337b547d2771fdad56de13ac94e6b528

SHA1
3aeecc5933e7d8977e7a3623e8e44d4c3d0b4286

SHA256
81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0

SHA512
0d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36

Download Submit
memory/996-69-0x0000000000580000-0x0000000000AEC000-memory.dmp

Filesize
5.4MB

Download
memory/996-70-0x0000000005360000-0x00000000053A6000-memory.dmp

Filesize
280KB

Download
memory/1512-1-0x0000000000E50000-0x000000000138E000-memory.dmp

Filesize
5.2MB

Download
memory/1512-6-0x0000000005DB0000-0x0000000005DD6000-memory.dmp

Filesize
152KB

Download
memory/1512-13-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1512-5-0x0000000005E50000-0x0000000005EE2000-memory.dmp

Filesize
584KB

Download
memory/1512-0-0x000000007460E000-0x000000007460F000-memory.dmp

Filesize
4KB

Download
memory/1512-2-0x00000000062C0000-0x0000000006864000-memory.dmp

Filesize
5.6MB

Download
memory/1512-3-0x0000000005C90000-0x0000000005CD6000-memory.dmp

Filesize
280KB

Download
memory/1512-4-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1660-22-0x000000000AD00000-0x000000000AD34000-memory.dmp

Filesize
208KB

Download
memory/1660-19-0x0000000006160000-0x000000000616A000-memory.dmp

Filesize
40KB

Download
memory/1660-14-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1660-16-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1660-18-0x0000000005800000-0x0000000005874000-memory.dmp

Filesize
464KB

Download
memory/1660-52-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1660-21-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1660-23-0x00000000093B0000-0x0000000009442000-memory.dmp

Filesize
584KB

Download
memory/1660-38-0x0000000002A70000-0x0000000002A8E000-memory.dmp

Filesize
120KB

Download
memory/1660-24-0x0000000009440000-0x000000000944A000-memory.dmp

Filesize
40KB

Download
memory/1660-37-0x0000000002A40000-0x0000000002A4A000-memory.dmp

Filesize
40KB

Download
memory/1660-36-0x000000000D460000-0x000000000D468000-memory.dmp

Filesize
32KB

Download
memory/1660-33-0x000000000D370000-0x000000000D42E000-memory.dmp

Filesize
760KB

Download
memory/1660-35-0x000000000D470000-0x000000000D478000-memory.dmp

Filesize
32KB

Download
memory/1660-29-0x000000000BCA0000-0x000000000BCF8000-memory.dmp

Filesize
352KB

Download
memory/1660-31-0x000000000CFF0000-0x000000000D0A2000-memory.dmp

Filesize
712KB

Download
memory/1660-32-0x000000000D340000-0x000000000D362000-memory.dmp

Filesize
136KB

Download
memory/1660-34-0x000000000D430000-0x000000000D44A000-memory.dmp

Filesize
104KB

Download
memory/1792-61-0x0000000009120000-0x000000000913E000-memory.dmp

Filesize
120KB

Download
memory/1792-55-0x00000000071C0000-0x0000000007236000-memory.dmp

Filesize
472KB

Download
memory/1792-54-0x0000000007120000-0x0000000007132000-memory.dmp

Filesize
72KB

Download
memory/4180-88-0x000000000D4F0000-0x000000000D5E4000-memory.dmp

Filesize
976KB

Download
memory/4180-82-0x0000000009AD0000-0x0000000009B70000-memory.dmp

Filesize
640KB

Download
memory/4180-185-0x000000000F070000-0x000000000F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/4180-81-0x000000000B890000-0x000000000B8CA000-memory.dmp

Filesize
232KB

Download
memory/4180-152-0x000000000CD10000-0x000000000CD60000-memory.dmp

Filesize
320KB

Download
memory/4180-79-0x00000000063B0000-0x0000000006424000-memory.dmp

Filesize
464KB

Download
memory/4180-151-0x00000000058A0000-0x00000000058B4000-memory.dmp

Filesize
80KB

Download
memory/4180-153-0x000000000BA30000-0x000000000BA38000-memory.dmp

Filesize
32KB

Download
memory/4180-376-0x000000006DB90000-0x000000006DBA5000-memory.dmp

Filesize
84KB

Download
memory/5608-298-0x0000000000B80000-0x0000000000BF7000-memory.dmp

Filesize
476KB

Download
memory/6088-336-0x0000000000B80000-0x0000000000BF7000-memory.dmp

Filesize
476KB

Download
memory/6108-335-0x0000000000B80000-0x0000000000BF7000-memory.dmp

Filesize
476KB

Download