Overview

overview

7

Static

static

1

RobloxPlay...1).exe

windows7-x64

7

RobloxPlay...1).exe

windows10-2004-x64

6

Analysis

  • max time kernel
    39s
  • max time network
    41s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2024 04:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxPlayerInstaller (1).exe

  • Size

    5.6MB

  • MD5

    58de8886e5f8771990ddfc3d09eeec16

  • SHA1

    daf4387bab065c8a6dbff50a0c9f7beec6f40747

  • SHA256

    b6a2553a504032002396ffd960725d5514e3aa1e81185620cd03e1481e9b6ce1

  • SHA512

    e90c661051b2c8298abeae2d6a070a1547912d6cf3bb4892e30a583e5f906b043768934a85c76c45482c3326d93bc1090df3d4616824a7173fd2f061d81a2be3

  • SSDEEP

    98304:DMvEig8irqBV3hh+w8dynal9EgWhPbhiBs3HuARTMUV6evbR:wEiBiY3VnrgWlR1VtvN

Score
6/10
discoveryevasiontrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
    Filesize

    5.5MB

    MD5

    f9d1a553612f8203a5c246abffe99a18

    SHA1

    f82e4c089d3e702049eb354bdc935f6012394c26

    SHA256

    71f1dd2c68ec5d8e199004d99b807b079a257352987663d544c83b1dc34d0a28

    SHA512

    ba6d05d4da639a0b009d8146958c60b860ee043a8372a30796fb2169d2ceba13fbf0a4caf0a6120d3f28f58d7abbaa259591e85970a5a56940c8a01c2e313da8

    Download Submit