b2619f4d0d1b9f22f403f7637e65696372bd3bd72d8157acf95bc7b4036e62a9

Analysis

max time kernel
1565s
max time network
1568s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload/Roblox.app/[email protected]
Size

13KB
MD5

125deb5076e65759d1221c08d1771f27
SHA1

e8314f0891858829e3fffd1fd9a923d3c2bac6cf
SHA256

20620cf48a693364183a441b162c257f3c77b06fb612d383ef8d7ca732c83cd8
SHA512

acb9c03ac50e89777f14c49b214bad4b8dd7bc6987f70aa7ba6af8acf7a66d2e4f30fb54d1a57980901c6fd6ae70b32cecaf51bf81ba814fc66cf662bcb0e06e
SSDEEP

384:BnruxEvjppQang47SYip0dayF3t9VhuAENbOx:Byx1YGu9VwAA0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Payload\Roblox.app\[email protected]
1⤵
- Suspicious use of FindShellTrayWindow
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2260-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download