Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/11/2024, 14:22

General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    6.8MB

  • MD5

    91563396f82674c0b8a13a5bd4faa2cc

  • SHA1

    becfde376e3053a2593640e8fbb743890077ed07

  • SHA256

    c4e4b832dfab883152602b2ffef83f57281ebd8d08b3b8b12540f580fe0526d0

  • SHA512

    07ee5e4084c24885ce735e93c314700dfaad96bf1b65e63a36a9c14c9f91a14fb6d4e26a534627e6a0df9416ce6a80f0539af3e50d5606489638a36b6da95e09

  • SSDEEP

    98304:Mcv+QirHeUqMuUP0vjg9bJnAVxlVvq0waHsdRblAH4qPSAupG+udFJp0:HpirHeUqOYkJSqcHsdRbgPQpB83a

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:1984

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

          Filesize

          6.8MB

          MD5

          7478745f2ffdcebdb1c5ccbd482312b8

          SHA1

          6f754125fdea66ca783875f7c6c0f96be14211d3

          SHA256

          ae19ae02450f9e885abbed2e40fbabf9992acf61fd206d6ec0da8fcc2ecfeecb

          SHA512

          9ff8e19eb3471d69654a9a83fdc62f9d340dfee344a1cc89802ab4924921edc2c4b1e4f6573143ac61cb61d970d6150ae694369c90ba453cfeb63966d85bf352

        • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\c261fa92769bc5ab6443aade831bdc18

          Filesize

          7.0MB

          MD5

          c261fa92769bc5ab6443aade831bdc18

          SHA1

          60c313b138fdc767d1b6108e6ce5c800ac1f4bf1

          SHA256

          c6f1c59442953fb894b7414e2bc7c494d379df20a81bef8a974afec150e0cab5

          SHA512

          85f433f98441707bffb7d071e8dd20c77766244cc649b6887f43cc01e6d791f70a87f83d836a6f20d35c148327f466e184b3db7ae8db20fab9d3f36efc675e35