Analysis

  • max time kernel
    1680s
  • max time network
    1685s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02-09-2024 05:41

General

  • Target

    https://www.roblox.com.bi/users/5445740091/profile

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com.bi/users/5445740091/profile
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff813783cb8,0x7ff813783cc8,0x7ff813783cd8
      2⤵
        PID:4396
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:3128
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2992
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
          2⤵
            PID:1672
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
            2⤵
              PID:276
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
              2⤵
                PID:2572
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                2⤵
                  PID:3120
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5000
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
                  2⤵
                    PID:1756
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
                    2⤵
                      PID:812
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
                      2⤵
                        PID:4936
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                        2⤵
                          PID:2816
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,12684560911357930461,8456152808951490391,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4780 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3124
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:1180
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3376

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            b4ae6009e2df12ce252d03722e8f4288

                            SHA1

                            44de96f65d69cbae416767040f887f68f8035928

                            SHA256

                            7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

                            SHA512

                            bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            4bf4b59c3deb1688a480f8e56aab059d

                            SHA1

                            612c83e7027b3bfb0e9d2c9efad43c5318e731bb

                            SHA256

                            867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

                            SHA512

                            2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

                            Filesize

                            51KB

                            MD5

                            588ee33c26fe83cb97ca65e3c66b2e87

                            SHA1

                            842429b803132c3e7827af42fe4dc7a66e736b37

                            SHA256

                            bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

                            SHA512

                            6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            2KB

                            MD5

                            8b3c9987ef0b9c5ca494562358a0453b

                            SHA1

                            89ce45bbd7000ada767e9397df19471d246e68b2

                            SHA256

                            7dd310ce5ba8c8451797b100166a7789354cf3f97734b7e8f62fc24df43902b1

                            SHA512

                            fb3787eb65daec691e1653dfdea09e7ff1417d1839b96ed1d710dd3fe27cebb206c275b88498a3ebfe561277f46d181f7a3e23322a4e94c3d1b573847e2ff2ff

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            ec20b7c73862d7fb59c977e4e036c9ad

                            SHA1

                            d23a2f4623d51200c20d43ab61ea7308c9c86cc0

                            SHA256

                            0ff555a96b0d751ed76b3a154f28df7778cfb9629980dc1131ec57c80ed0195b

                            SHA512

                            f79991e5b214a9f342a9dd8362de65be4c9c129b191e6024e6497ab03c9324af5bcc7933db50cd43456c2a43d5558503b384c664dc3c274897a99d29595078f2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            c6450dd9a669139ecc48f4806e376080

                            SHA1

                            331118f068d99d6e20c4ceb97c449417f0a27e6b

                            SHA256

                            c7abb5e8d204243b20c03da2de6a0a9d5357dfa7bfd308747ef9fc870c735ec8

                            SHA512

                            5d318daa0ccb8d6692757059fef796744dba68a40a5a333d42b2ad6d2f5b06fc71a2cf3f5e799bd5157f436ae3513cbafdcc92bcf4f4302d69720aa6b24c8359

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            6bec1fb0eea4dc5b3587b85dff4abd26

                            SHA1

                            2917e972f49868e8c951d48136a28557f88ae274

                            SHA256

                            3b1e665a9dec78a632f6bced99ea1ffefd4c22a43050a2d7d657612c87193bfd

                            SHA512

                            a8fc6cef965051c4678c51dc2e2ecfd3afd807ab51c792cf8202f38dd95db839881df64824c2e886b8f07453add61ddd9c0fad2bcebf4c25710c738127edf14e

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            3292703d829b2cc893acc32554599c6d

                            SHA1

                            29879d7d09417daf5893ce1a31865bc852cccd4e

                            SHA256

                            97682530f61a3d79e07ef551d158e9e2366b01d1add3650d14c834000e629998

                            SHA512

                            a044ab04d6240ba205bfdda43e84e6f6aea2e9518b440852a30f5f22c2301067a23cd0aaf30e5261a8cc5cbc636e9cdf6f8a1d59db006cba68a385bdcdc84ae1

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            90a583f3c8caab2f38a1e0094dfc0a07

                            SHA1

                            bb6f3af07b4f054feb5f72751f33d913ece7fb92

                            SHA256

                            37d0363ccd8896674d0c9ad799059997c93e23b6146f9b0640963b54c4485c4a

                            SHA512

                            09f64badb2a02ad63f447f832620f7a1f3ddd392badc927f5ac8be6468f166d02a231c9d6886908accd299332fe2f4b11a2fbc12bbbd34b91eda643ac6b53703

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            4a4a4182611d77e49351c5e1811dd66f

                            SHA1

                            028767e6eb5e8fc2959ffbeb0da92600ad705998

                            SHA256

                            092d70915d4114ece6f3d1d393070ce4b4f5d4397f1f76c19819a4e7b648f254

                            SHA512

                            464ea95b5a3b335b68886a3cbc8e652766c41dfab3566c165ec674425bab6fa188c5498b0017e6470d65081253a6cfca946e8dbba4f191efd679478ab58f1373

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f433.TMP

                            Filesize

                            1KB

                            MD5

                            d97cad0f66842b256d0492e2bdf2b23a

                            SHA1

                            c90ac9d723ff0693194a8e57f78bb8770ec733fa

                            SHA256

                            54cfb77512b59bd5c26bde6d689ff372fa126e61969ea8fed567ea565a9b2a67

                            SHA512

                            d90cfc4d0894dc54c95d9ce62311f021d18406c05e25c242ce945136aac4753441ccd9b9146b5a8d3515437bfedf77d9e5f0fa3c1df80bf7eb9f7e721360acf2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            f380ff1fe882d63565341ea0e75a9547

                            SHA1

                            ade95308ca8414fb1b77de9df82144205cb3c0f4

                            SHA256

                            3cf73bc3f8b6f22b3f50389c88ebb55de4c43a18151b72a774de445465b89b2b

                            SHA512

                            c5d9db284982a664d20e91f66b26f7e683ab5410c062d148d04945c5df84fe383a797bce4c44a484dd977faaa3c5bfba4134763161fb2c442c0ff8fcff16a044

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            11KB

                            MD5

                            2c6c0dd29cdeda1cff06aff3fa19af17

                            SHA1

                            d993451514db4badfcc153e274401a8b6592bb02

                            SHA256

                            3731e6ce6a29b6b6d7cdee3e421b3bbb4c22eb32d0db9987875f278a35814ba2

                            SHA512

                            80ffd5d8ec74a233462db31fb02e68a2bfbe237b7d85256cec2d64fd7231961fd05f5cb9a292506e9321b99a1ae17251c41682535ef6dc75328d28994b3998af

                          • \??\pipe\LOCAL\crashpad_1916_ODAUVTAOUFOGBUUI

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e