Resubmissions

02-09-2024 07:39

240902-jg1kgswfpb 10

02-09-2024 07:35

240902-jex2ksvgql 10

02-09-2024 07:31

240902-jcgxksvgmn 10

Analysis

  • max time kernel
    145s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 07:35

General

  • Target

    https://www.roblox.com.bi/users/5445740091/profile

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com.bi/users/5445740091/profile
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0d9e46f8,0x7fff0d9e4708,0x7fff0d9e4718
      2⤵
        PID:2140
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
        2⤵
          PID:728
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2312
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
          2⤵
            PID:4916
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:3708
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:2032
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
                2⤵
                  PID:2272
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
                  2⤵
                    PID:1532
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3544
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                    2⤵
                      PID:4300
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                      2⤵
                        PID:4476
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                        2⤵
                          PID:3420
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                          2⤵
                            PID:732
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,10691770929509294512,5072492017335062667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:764
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1976
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3980

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              f9664c896e19205022c094d725f820b6

                              SHA1

                              f8f1baf648df755ba64b412d512446baf88c0184

                              SHA256

                              7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

                              SHA512

                              3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              847d47008dbea51cb1732d54861ba9c9

                              SHA1

                              f2099242027dccb88d6f05760b57f7c89d926c0d

                              SHA256

                              10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

                              SHA512

                              bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              2KB

                              MD5

                              c497dc3160345911358e24be4fe80e53

                              SHA1

                              084c11d9f1e1ad60d57b31c66beaafc1cb3ec8c1

                              SHA256

                              344b9debaa76414e53b4813c07910a657be683de07cb623a60ecdbf60d5f5ab1

                              SHA512

                              7c843cb3d75db05239a04f9b52a043c8ea614f3cad895cce958d93020c2cac31959e3b9aee300cddaab61d7b9dce1c767db5f2ba648d5641417160b22c09c782

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              31bc88d307108c9980ec5268a12302f1

                              SHA1

                              1cc6b395aa0c28cb99b02b181a3312a9bcbd0c48

                              SHA256

                              be509299b23dafab857ec7c977051652c34ea8a4b9c13b6d64034fcb41b82691

                              SHA512

                              6b7aebc54ad83299ae57aee054f679f531d97e7692635e8769030be702646e58a946dc795f1dbf770a0143f5a053ab8aa430c5345d4fddb3409f56c01b48fd5b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              cc4cc2211aa8fe847cc4b9f3950af7ba

                              SHA1

                              63332dd8dc113304a141a8afbe16a8cc42735219

                              SHA256

                              f7cff9d5f42f3f165944497a9cbc743360745e59c2b68e21283259c2e0cbbbcb

                              SHA512

                              b2667e6af94fa0b5272e402fe0bf02d7c6cc31e24cb1b24058b927b59f8b1f1fe348a099de41b3c0f4cf8dfb91226e8b3414fd1b02de0e4948ac342841781425

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              42a82da3fa437ce43a4f632de23df741

                              SHA1

                              340d18ebd6ec6e4dcceedab29086853036a5ea05

                              SHA256

                              67a4c974db2c649d82a6d5a12f6e10ef7f4b0e1825db43deb4a368caf4339d90

                              SHA512

                              dd7df3e1a4a5d0c7b49224130c6779c6c98cddc1c276e4a3cbf0c1e9e0e0c80a374fd8cdd3f151436ab2d8855aad94c92070c22a220d2945785698c24203ec9d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              13c0a9d59ec07befbd988e918a1ce1db

                              SHA1

                              9ef4906cb90bd113926f3a912f187aaa8f2623b7

                              SHA256

                              f8fb060bc8d0c82fe1bcd96c6c708327b7fe9d45beb65875463c4283ea751c9c

                              SHA512

                              92c1af7dc5c931df2173393acf273d80b7ee8924a87292a0467b724fd459529202b84a9549e6a7aaf7dbe0199968ac7a2804ae263a05711c5115368ae4b3702d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              20e3f5df4a34204560658afcb29831c9

                              SHA1

                              bef90c17401ca2f744adea56b4b15be112c0c9b1

                              SHA256

                              c7ecb6511500411d7051b02b91416989ee9538ce1cd5d45613334583438190c3

                              SHA512

                              e0fee6de5ddfdff30e8dbf28971bbe0ba66a9fc10cfe40e7141e132011f431f608cbeba4fc2263a404fba53115c47fb126dbe5ebdaf274bbbd8ac070b2dc8cd7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              79d44fd6b46544d6eff4b3c04fb76d08

                              SHA1

                              8c6d871d729c0714a23500e449214be3309e0682

                              SHA256

                              319cf47358c85321546e3b2c7c0035aac1f240a3432db3f57b8d9856280bb5ca

                              SHA512

                              dea6932e8d01ed059955840c1658c106c9e8a089f6d657bee5354faf0cb56a5adfd09db9e0a49d254bee82a018a26820b11c0da6757dd2ff46357fb078ee00a6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ef90.TMP

                              Filesize

                              1KB

                              MD5

                              aa73486910a80203166143ebfd9e66d6

                              SHA1

                              98984d9229b7ce4ab858ccfb721ae6efc611593d

                              SHA256

                              19da9013eea2da03517d3442b0e60260f6edea5630c482f6fbc54f4e0f053163

                              SHA512

                              b282267eb967c12cca4141f216a9e1ac3ce2146f4ddc032e05e1cf3b9ecb86de3d5c612e863c62c769e81afbf0c6fff5864264ec54af21489b6c0a15c9acb5e9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              b30cf0cd418442602dcc37305446dd7d

                              SHA1

                              6382523ae495109f076a90be7c6fd028905d3e98

                              SHA256

                              ace03ca39511a08598f694cd238af9db2f4b8795d7d4bbf7cdaf41d4913c5ff7

                              SHA512

                              bacde342bd84caafce25c45a9f83412364efa770653c14a0563ebf7b51467c6dbd3cf85b6deb5da5ce7ee0747b71f238d29e819ae1ae1b9c8f64f7072b2a8646

                            • \??\pipe\LOCAL\crashpad_4600_MQZZWXSAZBEUCNSA

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e