Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
02-12-2024 17:24
General
-
Target
roblox.exe
-
Size
27KB
-
MD5
ece47f6a290117baac1abe8e972fe774
-
SHA1
b4b330dfd2054f0ce2341b8e3c3425adf260615d
-
SHA256
f25582f73b8557d509b7b9d0fc598bf8dfe4591aeeca8e360bcd3e984a5ac5a6
-
SHA512
834a382c09c53e97406762c278a2541adac1d5466bb37a74315022d44e8ebbe1425c914e783afb4af425446f72a087177c0641d12fab013b88dd424eea781b9e
-
SSDEEP
384:lLEUcMLkeA08lfShrk2Ig9BPEBRXM+AQk93vmhm7UMKmIEecKdbXTzm9bVhcaz6:lVRq1ShZB+A/vMHTi9bD
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\roblox.exe"C:\Users\Admin\AppData\Local\Temp\roblox.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\roblox.com"C:\Users\Admin\AppData\Local\Temp\roblox.com"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\roblox.com"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5ece47f6a290117baac1abe8e972fe774
SHA1b4b330dfd2054f0ce2341b8e3c3425adf260615d
SHA256f25582f73b8557d509b7b9d0fc598bf8dfe4591aeeca8e360bcd3e984a5ac5a6
SHA512834a382c09c53e97406762c278a2541adac1d5466bb37a74315022d44e8ebbe1425c914e783afb4af425446f72a087177c0641d12fab013b88dd424eea781b9e
-
Filesize
1KB
MD545553c9f5b5be8590f4cf6b9807141db
SHA1d830703c83753d9d34554939b500989c6094d0d5
SHA256b82108c64f7acea33e9273d191f76deb9eab7c59471380c91874527c6b8788a5
SHA5128b662ddaf4e8886b7224fbe59f164a44398dcd3d70dccc5cbec5c8ea4009a617fb577297427fd663086f68cb5295c5d4cef66d6c0f874476207c8a9dccb8d7df
-
Filesize
1KB
MD521eaf37b395f05f15f3e138ecf593548
SHA11da480a35399a2d377b0fd2f0a6a09d619fcf15c
SHA256341a111b2a2b7b3e69a1bf867476d222ef423a3128afaaadfa1bbe091196c524
SHA512ac34ab428d5971afe19aca423df8c361350ee1a455f2c1a4760a65a0f08566b2a166c3f3f72c194cdd19e572dd7ffa2a6314d31c3946973e055e63672f9dbf63
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB