26e1a099cee323d3639cb05a4cacdfba97661b461a737ef80a63d3263e1b6f49

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxCorp.crt
Size 1KB
Sample260620-aks55scs8p
SHA256 26e1a099cee323d3639cb05a4cacdfba97661b461a737ef80a63d3263e1b6f49
MD5 184d30f698873305eae277ddca706aef
SHA1 4589ec98cfebeb164524510fe55cacbb57473b91
SHA512 53375503ce5d484c6017b99d49f0a755e34b161fd2b026a09046a5576bfd7b9a29fa3cfbab8f4ec5ffee81655bf185e85be8df258348f500dd6ae8a23c1bdb32
TLSH
T195310AA58DF10D91A8AFD0C8F1BF12100C04417067A997776D973C8557FA9A5222C9DD
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion spyware trojan

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3488	rundll32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263882467010838"	rundll32.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\SystemCertificates\REQUEST	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\036F1153F3849CC3947636280137A0A18534DB99	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\036F1153F3849CC3947636280137A0A18534DB99\Blob = 040000000100000010000000bf22c4d9438a745832f647ef305c41270f0000000100000020000000e57fe7526af35c2f4c112e1e3f54765ce7c90ddef76ebb9d183f953f2556878b1400000001000000140000009124dd1acb0bf637a80621ddf2655606141eb869190000000100000010000000fbaa393c87b05662a9803d18a97a86de030000000100000014000000036f1153f3849cc3947636280137a0a18534db995c0000000100000004000000000800002000000001000000340400003082043030820318a003020102021441ff1b82263291f45e7bc74d0b53a03d90e2f6ba300d06092a864886f70d01010b05003081ad311b301906035504030c12526f626c6f7820436f72706f726174696f6e311b3019060355040a0c12526f626c6f7820436f72706f726174696f6e311b3019060355040b0c12526f626c6f7820436f72706f726174696f6e3112301006035504070c0953616e204d6174656f3113301106035504080c0a43616c69666f726e6961310b3009060355040613025553311e301c06092a864886f70d010901160f696e666f40726f626c6f782e636f6d301e170d3235303630393133323133375a170d3335303630373133323133375a3081ad311b301906035504030c12526f626c6f7820436f72706f726174696f6e311b3019060355040a0c12526f626c6f7820436f72706f726174696f6e311b3019060355040b0c12526f626c6f7820436f72706f726174696f6e3112301006035504070c0953616e204d6174656f3113301106035504080c0a43616c69666f726e6961310b3009060355040613025553311e301c06092a864886f70d010901160f696e666f40726f626c6f782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bf41df2db9be7d13dca4a11da6aec2eaf9dd8c947b35fa833ab503d598a3f08e37dd23b535a0bb7eaeebf32357d30a7767c19b5617d00976f746b948de78b5a50542c771eb8a83cffd5103e8f120387d6903ebd0717ca2c60e2f49968a08e3cb8ad64d13f7f3820b506872681852d17cfb51326849db429200864e47710f51e32d7c490a614603dd3009b85919a822154faac4534eb46e185b3ff06adad3678f080c526eb8068bc17dcd9f470583f77e719580aff900969c63502bf6711a53d79ea7c8d4c141ff15aff053c359ac569afd027af0cb1be2d4ec7a5819262e14e240e9437a23b6d00a8d86c3f836013fc8aaad0c524ec3f755352097e0b5bd4b4b0203010001a3463044300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303301d0603551d0e041604149124dd1acb0bf637a80621ddf2655606141eb869300d06092a864886f70d01010b0500038201010050907a65e2feb074a90903691a2675dfe825d83a7a35c4e44e950d9c032eb6cc4074fe1cf65e4cd623ab45c0d14abb4e75c74d5e3880d2b0ea223c1428dbf828001dfb8fe6c5e660d1c85574570ee3b02a3536c98a73a2082282d95dcfe8596c88aba3e163ebd6332cc22cbb464fd6de08ffe259b94f9c3ec0c4bb803d328be7a6f8a40fc5043453160e5496ff2e85ab7b3e37816e207359e83cbd4194dd3fe6177c3603d58c62352e8c0010016310beaacb6e16172d7b732dbb37f74e4731a38798557f189fd96c4d3e3771ddc1f39ce64ffad96c09f3b43ac17a746599884c53002258846d9407243b13bf44238971629a9820e4063c560d21c637a1a70d9e	rundll32.exe

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\RobloxCorp.crt
1⤵
- Badlisted process makes network request
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads