Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    RobloxStudioInstaller.exe

  • Size

    5.5MB

  • Sample

    240823-xnqkrashpr

  • MD5

    658a6b0f3866e63545503fdff59d000c

  • SHA1

    e5df1309e574ee77ca1727bf64a269f376d5ebd9

  • SHA256

    61b302dcf209bd7a3288a6a9e478c6ad0a5d6b195f5328f827c938d5122f679c

  • SHA512

    bc02baab236cf4427f26dba22fd3ab977abd8df1eb7d30b20d7b36f410f70877872a85f6d7bfdccc8b53c5e2ff5a70cdd056ac133d0bb7ec5a7596fbb7144e8a

  • SSDEEP

    98304:TEPv7pdHvByXvgnqmX9c4xcsGdg+lFzEURTEhcHyFULh/Ju2LP:A7pZByXXmG4xkg+RRQcSWhLP

Malware Config

Targets

    • Target

      RobloxStudioInstaller.exe

    • Size

      5.5MB

    • MD5

      658a6b0f3866e63545503fdff59d000c

    • SHA1

      e5df1309e574ee77ca1727bf64a269f376d5ebd9

    • SHA256

      61b302dcf209bd7a3288a6a9e478c6ad0a5d6b195f5328f827c938d5122f679c

    • SHA512

      bc02baab236cf4427f26dba22fd3ab977abd8df1eb7d30b20d7b36f410f70877872a85f6d7bfdccc8b53c5e2ff5a70cdd056ac133d0bb7ec5a7596fbb7144e8a

    • SSDEEP

      98304:TEPv7pdHvByXvgnqmX9c4xcsGdg+lFzEURTEhcHyFULh/Ju2LP:A7pZByXXmG4xkg+RRQcSWhLP

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks