Extracted

• • Target

    RobloxPlayerInstaller.exe

  • Size

    6.6MB

  • MD5

    74515548bb70650c0176df71d7e108f4

  • SHA1

    1892ea497636c4c2641427bc2fd466c531d0cd95

  • SHA256

    6e0dea6726076158e4569745c0793202dfd6fbcc377117898c4c29f5be2a08fd

  • SHA512

    0272691263875c882265709300b40f4d1dc62e13699ace6fa547457389c8a9f8a7a6e4902914f2c813669db80d980d8fc8bfccfbd1aff4158444cd2d238ef99b

  • SSDEEP

    98304:ozv10T8Mzg6x2QdfIO36jg0bI9oWhZBRgY8qteGO/dDQ4oKCMLF8:M6wM06x2cBQIVPgYQlDoKfLS

  Score

  10^/10

  wannacrydefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojanworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1