Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240802-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
11-08-2024 21:59
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerInstaller.exe
Resource
win10v2004-20240802-ja
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
RobloxPlayerInstaller.exe
-
Size
5.5MB
-
MD5
3191d6165056c1d4283c23bc0b6a0785
-
SHA1
d072084d2cac90facdf6ee9363c71a79ff001016
-
SHA256
cbd127eca5601ef7b8f7bec72e73cf7ae1386696c68af83a252c947559513791
-
SHA512
ac0fa1c6e8192395ec54f301bc9294c2a13cb50698d79d1ca32db9d4deb4852e7607032733d721bc5c9fd8d1ce5610dd73b30b66e0302141377f263a3b7fa0f3
-
SSDEEP
98304:PvvnSTv4jyAjF0jl4kj4/5N6v1sgHqN1qlwlR4tcbMjh+1uGQOY:vnav4xFG2h5zgHqhlRpMjM1oz
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2460 RobloxPlayerInstaller.exe 2460 RobloxPlayerInstaller.exe