Resubmissions

02-09-2024 07:22

240902-h7k22swdre 10

02-09-2024 05:46

240902-ggf5qstblj 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02-09-2024 07:22

General

  • Target

    https://www.roblox.com.bi/users/5445740091/profile

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com.bi/users/5445740091/profile
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x48,0x10c,0x7ffd6bbd3cb8,0x7ffd6bbd3cc8,0x7ffd6bbd3cd8
      2⤵
        PID:3348
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:2
        2⤵
          PID:1060
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2068
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
          2⤵
            PID:2816
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:3648
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
              2⤵
                PID:2328
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                2⤵
                  PID:3400
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1364
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:836
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                  2⤵
                    PID:1532
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
                    2⤵
                      PID:1336
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                      2⤵
                        PID:5012
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
                        2⤵
                          PID:3488
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,17505144678466773347,16200414726570991575,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1524
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3956
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3468

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                            Filesize

                            1KB

                            MD5

                            55540a230bdab55187a841cfe1aa1545

                            SHA1

                            363e4734f757bdeb89868efe94907774a327695e

                            SHA256

                            d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                            SHA512

                            c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                            Filesize

                            290B

                            MD5

                            d6eeca02f7ad8d14dce4a1608f6e0b49

                            SHA1

                            e8b5dc469a57b1e7f5d1e71a4f98ef1f3c551484

                            SHA256

                            9aade0e8b54bbeddd9908fe501b8a94693ac6b5b5e6504e77c7e470c0b410480

                            SHA512

                            3235b68a777d22fdaf94cadc928d3c79726934744214969a1b354506691cc5d0c73d49548c1414923281fbed7a07c468ef6b2f1e3fdc23c29793063102823bde

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            026e0c65239e15ba609a874aeac2dc33

                            SHA1

                            a75e1622bc647ab73ab3bb2809872c2730dcf2df

                            SHA256

                            593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

                            SHA512

                            9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            228fefc98d7fb5b4e27c6abab1de7207

                            SHA1

                            ada493791316e154a906ec2c83c412adf3a7061a

                            SHA256

                            448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

                            SHA512

                            fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            2KB

                            MD5

                            ef2c6a890ccf72d7a9df935f048e643d

                            SHA1

                            ba6e791c526423afead3b6314d3491968b2b55da

                            SHA256

                            6394ebdef364f0d3586e43d6018874a2ab55609278b5a8e27db6ebe0ec779870

                            SHA512

                            9228657aa93a8a184f0c18036a9353e980b511287cdb69dc74f15e2c546a4de8eff66ffccb3c203453433d7eae2d5263a4e6c4036c645c4710c92a877e6115bc

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            d6d0916457d1206560393249904a8b56

                            SHA1

                            9502612881e84334fe4174f0bbe5046a3ad6100c

                            SHA256

                            c55c582b9a4e38ca1340c15aae7994334bc94dcc1a87f02e1ffeac578b896174

                            SHA512

                            2c0bd751b735522c4c6ba5ac950ebd6c1dcb65bc220e4305168185c10b06309c8423f3f05a51fbd81f1033141c2e22d3464fa5c5cb9058065f8ab335ab3bad80

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            e4b5bdad784c328f59f25450cd200b35

                            SHA1

                            3363f7cedfff592a5b41f6aa804d6b769620d833

                            SHA256

                            ed0c9fed67a8169c22fa0eeb1ffe4c00fbe731e7c7f97f87003034fa5a58e86e

                            SHA512

                            e5d27c6a8c0e1079129c5cedfdb8e0ceec699d67950df6027a491db3a8ab76a7f368c1f7592ad6d4e4a6d734b3a6b226dab56aa837501f5466b545998923fd37

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            c2efa1be299ff36df20becf4825702af

                            SHA1

                            18d7e776949e9db2bf63930ed0bbbc7364138e7c

                            SHA256

                            d273d9f205f217f6e7039ccd361a0e7f50e5b0b306811f95935442813ac8982a

                            SHA512

                            07e2a7804131d2aa9056e73aa8170d70b78eafa9128173aa661641003ff7f944f4cf3f57fedfbb5c59f62a4f850669991177755bb62e4e8b7f042e708594096a

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            70d2a9578382085e2e4401a9637c6e82

                            SHA1

                            c6b83f9079c5f4c67cf1d3bd268c2baa4ea95b3f

                            SHA256

                            bd00dcc5cc6700ec06edc50a46aabd9772ee1c4da0d43d0688e68892bf89cb2b

                            SHA512

                            234e6e86583347bc8a8809c2176070e0dd530c255b7ed814b656ff1f78c087f0326906c91738a1f2deae2ee4bba0161f59b45912f983ae196f776b6847832c55

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1024B

                            MD5

                            72e28a3f3cd745b7bf7c56213af2825a

                            SHA1

                            8fa75d4b7bfb4b3b013636e202210e03694a0e80

                            SHA256

                            732aaf3726f8963751fab025a99a7abf7014d85d0c0cd968920d0bec93c8f419

                            SHA512

                            4494bbb9bc352fc2f6489aced7f1c4ce832fae283b13cccf61a31c401bd4d94dbe00d9dddfe4022b41b753b45a8b6e26065a4fea1e94bb186c842c769024e727

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            d77f65f56626fd71640d1a28d1419a95

                            SHA1

                            1b371143e10bdf69aed389b04ff30106d7dd1882

                            SHA256

                            bd4a3a016078577439651a41de710acc2187538f20614b3e92aa52b875b1c5ae

                            SHA512

                            441c930dda808fa2b02af2a1bda313776c4c2a1bafa3a0171021ab6705ce7af24e7425ec3a15234010633d82ddfb2d257cf0cfda60f3460ffbdc96fea8ef5b2f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fec3.TMP

                            Filesize

                            1KB

                            MD5

                            e94815674de76eb0295283d7c8246898

                            SHA1

                            297f9c3482d2ff035786c3c9fa416fc425b79b4f

                            SHA256

                            225961a2b9bcd0067d5372f544292d25f163dbdbf352b8ef408321a46251d8b9

                            SHA512

                            4cdeb2e4aac7bacddd593ccfcb31ffa2b0193ab7fbf1b59a724733b5da7acf319eb5891ec5cbb0815e73c190614c3d0f0fdc2506d8b0e4e0d523c64908a64bca

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            11KB

                            MD5

                            c62375ca330e216e7f5fb7a20b744d00

                            SHA1

                            3187702567d4baa1d0bbd33a1d3c59d823606e47

                            SHA256

                            c8cf0765c4c8c048affe193627f8cf3e0fe000013bca94494fc356235acfba85

                            SHA512

                            f1db68a164aa5a427f06377e207ae70b8bcc1ae980c101d1569101bb0bdabfc1571963f894a8a9de96e6e94e943c42720238d4a49e07676cdcb91c868ba06c6a

                          • \??\pipe\LOCAL\crashpad_2188_QBSLJHGORNAFCOTP

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e