General
- Target RobloxPlayerInstaller.exe
- Size 6.7MB
- Sample241113-fa359awgrj
- SHA256 9f205a55a45a2a45d2ebb98afb21499b191a4b2e26f4311568d0337b32faa1ca
Malware Config
Targets
-
- Target RobloxPlayerInstaller.exe
- Size 6.7MB
- SHA256 9f205a55a45a2a45d2ebb98afb21499b191a4b2e26f4311568d0337b32faa1ca
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Downloads MZ/PE file
Event Triggered Execution: Image File Execution Options Injection
A potential corporate email address has been identified in the URL: [email protected]
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1