Analysis
-
max time kernel
71s -
max time network
78s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 05:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.roblox.com.bi/users/5445740091/profile
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
https://www.roblox.com.bi/users/5445740091/profile
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://www.roblox.com.bi/users/5445740091/profile
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
https://www.roblox.com.bi/users/5445740091/profile
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
https://www.roblox.com.bi/users/5445740091/profile
Resource
macos-20240711.1-en
General
-
Target
https://www.roblox.com.bi/users/5445740091/profile
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 704 msedge.exe 704 msedge.exe 3404 msedge.exe 3404 msedge.exe 4992 identity_helper.exe 4992 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe 3404 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3404 wrote to memory of 1696 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 1696 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 4752 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 704 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 704 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe PID 3404 wrote to memory of 3976 3404 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com.bi/users/5445740091/profile1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff40046f8,0x7ffff4004708,0x7ffff40047182⤵PID:1696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:22⤵PID:4752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:704 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:82⤵PID:3976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:3636
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:2192
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:3940
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:82⤵PID:1736
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:1484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:1612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,603326047995250722,15277588274667161039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4172
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize328B
MD5dcd4fdc7e67378f9cc224b33e5c1f342
SHA182f8ffe7236d4197cca4c499c17324bc5e049c1a
SHA256f1c7e3e1ddf256bd8c92b502d5944430bedcb97c5f171ac4a81a523a4c4ef053
SHA51283139983b84245075ce6070b15345b93d570dd23b86a327a4a0f575a39b167abef886e8c0586cb403dbafc17cbecf054a897f069fb2cf68f1042e98a5bb3cd44
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\640fe3db-1111-4745-a076-dce3d944bc0b.tmp
Filesize7KB
MD56370adee98df8c5623a75aca98f93aa7
SHA11324045891dbfd535441a5ebfe2e58644f4ed3c7
SHA256d8ffcf5c4066d8a326f0c95a4205c300b4a2fcf90a2b9c25b9cfd8b333cb1a39
SHA512234f61f5bf9dc01483917821e867735b073c13712f2ea9602f90b10def102450c5b3a1aed8e5bb47200d4ad25491fdc0a15415b26595006e5c4178f5326fb792
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD54ab27d311f71411521527602eac3d9e1
SHA121f0cab19ae61d6f90570e184f27f7a29f60c789
SHA25642211cb2d3b530d0796161dc9776ef19b1e06ca806fa008ee917c0c6b2d62585
SHA5125c6070dc974326a0ca191d76cdaa9c9fc205442cd612c7757d0f1daa96cb109a3d08e989808db29fb2daaed36d63957feda532caa34720a4b8770e9abc591222
-
Filesize
2KB
MD50e32c4cf58f9ad32f626a13abc7f4ba7
SHA13b277eafe4380275f83c72a67b3095b2cfcfc1a2
SHA2560d7a36d31693e68c6caf17425e81c243e618cd82fb3f6781b95bc4d70911eaeb
SHA5121c36c4d91dde6865e12ae0011e408623684528cf380931013ceb625957ea1cf3df5a536c689429177a628aa250d8b737d2aff2d87bd175e40f6da42c4a3e150c
-
Filesize
5KB
MD51bad82b018c6215648a8b4398be3f966
SHA1ba0fded59c12aa7b8704f651f230cf6dabc31a3a
SHA256104bca07e6b574f784b3ff3fda196e29e3f3ecf316481e2c66acee17ee549a02
SHA5120e4c7781ac0fa69277434ee41a33231a2fb0d4b207ece9d7ea1d23fd085806838357a1fc29a9a9993321010cabdb32e3fe0d8df22b02a9a9fd2d8353a6ab6406
-
Filesize
6KB
MD550f78d58a4fc12371659ad3154e73c57
SHA16779d3c8d36dbbebbf5ea859030b644a1bae5429
SHA2562930dd706aa3eb105d62ac49c0e7ca1e837b061184e30bcb47202f3a51294d58
SHA51279145cd52c9d2737db3c1b9cc96120629005fc4afa55e84467ba00179af187d2732b3adc91959c8db45e5f6c5153742e9cea88516b682b828ccc27967b591663
-
Filesize
1KB
MD5757cb6fa03cc7a95e1f72aa07ba8107b
SHA15b5cd2ff655b201dab84e38ddc414062e25a1d0e
SHA2565153e52d0f0cd155a5ef03774ec55f70bc0a44c3de922a04f1ba8153f26f3a05
SHA512050094a7b2073218a5ca926ac96f4dbb5c5f9dd4b67d6c131ac0cda11cb395bb22062146eb932c47fea7931493f4b33af310529d9a171bef50b9d560a776443b
-
Filesize
1KB
MD58538d8428996ec9e45504c174b6d70bc
SHA1ff9567562fdb01ae61688efebfe88a45a3cf8bb1
SHA256ef6740fcea65d139045698c0c76589771885d63c6249c3bda2d6f145db6f1497
SHA5126c6e5e420efc8191b93dd8d002444d3e88866e2a88ad13d6fefc6a593625b9323c6106a0298a640955a71660d53f48be02effba0be8ef9a1444a2090b2ba90ed
-
Filesize
1KB
MD5ddbcdef2777e782eb0beb28ff74be6b6
SHA14a3e96f7b141e2574308199b37824f0e5b63bab6
SHA25653351c0021700139eb07b3a30b6064765b897810f4568f6a1e0645295de284ef
SHA512d974072f55a5d93aea9031aec879d2013bae667c12744634b7490c651155f441d931c811a05f102b770895f7dc290b677de7faaf2d8fc8c9e8980d11b2bd9e74
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD50eb49bdd6fcf3f629424b2c1b07b8645
SHA1d72a4c3fd916237f840ea20bcede6df919c21246
SHA25606e34b050a49985dcbc2061f514716e09727cf4825e8e9a42447cb4394bdf976
SHA5129d8ae02e9b2cb29bada9a51d410d96115e8f6409308c4dcfb0bbf571d880efdb64fad41084bfd507b18470edca9dec243ed4d60cafcfffb2e49ff96dcd61fdf9
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e