Analysis
- user interaction
yes - max time kernel
40s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 15:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RobloxPlayerBeta.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
900 seconds
General
- Target RobloxPlayerBeta.exe
- Size 121.3MB
- Sample260504-sezd3set6t
- SHA256 ac2a19c57b09b421d9a68d2e3106a8cb75b31a84f712fcae7a6522811b98f410
- MD5 d178f90f88af0198ed34cc492943fa64
- SHA1 3b10d00c063a9a93c5897836e0a1d792ecd4ae50
- SHA512 0035870f288f66758668bb2d1c7a8fdab80aaccf848a4ef5b8171bb4e252db35d7863e438a1933a08a99437a9e3adb68c481dd0d570f51703cf2c35edf960f3c
- SSDEEP 1572864:dTYBE29DOHtTphRSIU7ya7kDFG40bj9nPFpXVwNxUYt0wZjx4EBi:FYBxCNTJSrFkenJG0ojx9
- TLSH T1AB580297F3579AD2F5859234DC1B81426321EC707622239725F8F31E9EBEAC94FA2C50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1732 taskmgr.exe Token: SeSystemProfilePrivilege 1732 taskmgr.exe Token: SeCreateGlobalPrivilege 1732 taskmgr.exe Token: 33 1732 taskmgr.exe Token: SeIncBasePriorityPrivilege 1732 taskmgr.exe - Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe - Suspicious use of SendNotifyMessage 56 IoCs
pid Process 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerBeta.exe"1⤵PID:2064
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1732