d0af716bd0939e74b9d64872e76da049ff30f1a199c64c3e9c5a5c99b587f015

General

Target

RobloxPlayerInstaller (1).exe
Size

6.6MB
Sample

241128-dt389ayrcj
MD5

5088d91c1e88554a4139566f37384d89
SHA1

e900d1005911601082896ca5bda4b033d8f87bd2
SHA256

d0af716bd0939e74b9d64872e76da049ff30f1a199c64c3e9c5a5c99b587f015
SHA512

61bdf2070ba5dae8a8b0cd43f8e3e8aa7559bbd60797e27cc1b9ce4d99e260806b81e1e3c56159eacf4865c0af42a98b53dc9c4ce498f06af62ae9e97396a314
SSDEEP

98304:AxvXWL7mlkPO0CsJZhaT4KVOGZvPRABKnMphs/g1WwxS9TQ+PYnIoE9/tyF5C3:aG3mlOO7sjUDJz1g1WW+PtoQ/k63

Score

8^/10

Malware Config

Targets

- Target
  
  RobloxPlayerInstaller (1).exe
- Size
  
  6.6MB
- MD5
  
  5088d91c1e88554a4139566f37384d89
- SHA1
  
  e900d1005911601082896ca5bda4b033d8f87bd2
- SHA256
  
  d0af716bd0939e74b9d64872e76da049ff30f1a199c64c3e9c5a5c99b587f015
- SHA512
  
  61bdf2070ba5dae8a8b0cd43f8e3e8aa7559bbd60797e27cc1b9ce4d99e260806b81e1e3c56159eacf4865c0af42a98b53dc9c4ce498f06af62ae9e97396a314
- SSDEEP
  
  98304:AxvXWL7mlkPO0CsJZhaT4KVOGZvPRABKnMphs/g1WwxS9TQ+PYnIoE9/tyF5C3:aG3mlOO7sjUDJz1g1WW+PtoQ/k63
Score

8^/10

adware defense_evasion discovery evasion execution exploit persistence phishing privilege_escalation stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Possible privilege escalation attempt
  exploit
- A potential corporate email address has been identified in the URL: currency-file@1
  phishing
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1