Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/09/2024, 17:55
General
-
Target
RobloxChromaRGBModSetup.exe
-
Size
2.8MB
-
MD5
dea5ad772d800f1306ddc562f9aa877c
-
SHA1
7cfd0429c3eec3ad87af9a5ad6be4079d4d07cd8
-
SHA256
c39ed858478de61af49aa465cead803ed4442c890973e2656b2d24c946c5d466
-
SHA512
c8b23aec26eff38358a8685598609863f3d2d8f030a01a13211e3c4b74f48fc126f8805348f351e5beb389f1b7b19ee6cccc30501b0d7362cd7238e17937c5f7
-
SSDEEP
49152:4cW4fjCmDE9tIGt/VbvhgPgdlB8ceq2Khoto14t81meZRHaTXXt:4X47C6uz5VbBB/eqvid81meZRMnt
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxChromaRGBModSetup.exe"C:\Users\Admin\AppData\Local\Temp\RobloxChromaRGBModSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9OS4K.tmp\RobloxChromaRGBModSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-9OS4K.tmp\RobloxChromaRGBModSetup.tmp" /SL5="$50210,2207760,821760,C:\Users\Admin\AppData\Local\Temp\RobloxChromaRGBModSetup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Razer\RobloxChromaRGBMod\WPF_RobloxChromaMod.exe"C:\Program Files (x86)\Razer\RobloxChromaRGBMod\WPF_RobloxChromaMod.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
311KB
MD5b44f7673eaff7239b4c97acc0ee37ac1
SHA1bf5e52cf01c1a1f753c4a6077ed9bff33c5cc557
SHA256f7fd55ada77825d42d89873da7905317688c8da79bcb15598e128a6624202131
SHA512ad137927acca92511d05ea4249f71821bb69cda8f291f2941bbd085210205e74b51e66c1abd3631e9676239b16b8045bd5def420d09915d6e75c01f33d135d75
-
Filesize
103KB
MD587b6ab47f70d56d18dad9fd98bad17f8
SHA1be2d15ac63a0ea7870943db65623a4510026c627
SHA256c1427682593f67ebe068dc5d9fb3b66b1915408bcf2e64bf599f86480f15cdcb
SHA51254bdf53a29fe12fe551233e86de6c6c638a021876f4cde8d4353acbbaf8212dabe3d1fbed3fbefad4cbc0bc2719257526a16e52a662f4725c9c4ced2682ec6a5
-
Filesize
182B
MD5c6376b7cf21791bee55ce91ce487b80b
SHA1ea7cc1b2e62a65fc26e026ae8b70f90e5b9fc839
SHA256eb217cd4aaffd7c0cc720e9bb92f5e8d4199bd678df9e8dff7a07182d3568081
SHA512c4413cfb89838b48b913f2383c53e5933ca0820f2c31ab7d378bebd2dd7a7ffbed8221c20c7ce08657c3a3281eee8d0d1a7aeed6fd3bb9f68374f09e63ca5de2
-
Filesize
2.5MB
MD55cf3c3207a7d76e3caea8380a1764290
SHA110dd78bfecc481d9226abc005763de22796c1bb8
SHA2566b137f95890783fbd7255e8872b7236e1a5e9bdb319cda508ff94b36abdd0bd7
SHA512a4c5ad5fef2a637809ff610fb9127ce86a94f0ae930c9ccaf4dca01813001f0d7dc899089a73b79da925e87b9d1d76bdd4fce6d675f37def4b867019b0899b62
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
7.7MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
672KB
-
Filesize
856KB
-
Filesize
856KB
-
Filesize
856KB