ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684

Analysis

user interaction
yes
max time kernel
124s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox Evon Exploit V4 UWP_97099406.exe
Size 583KB
Sample260620-tebtfsg16s
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5624	ContentI3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Evon Exploit V4 UWP_97099406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ContentI3.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\OperaGXStable	Roblox Evon Exploit V4 UWP_97099406.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Roblox Evon Exploit V4 UWP_97099406.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\OperaStable	Roblox Evon Exploit V4 UWP_97099406.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Roblox Evon Exploit V4 UWP_97099406.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	Roblox Evon Exploit V4 UWP_97099406.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
612	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
612	NOTEPAD.EXE
612	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 612	2132	Roblox Evon Exploit V4 UWP_97099406.exe	89
PID 2132 wrote to memory of 5624	2132	Roblox Evon Exploit V4 UWP_97099406.exe	91

C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_97099406.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_97099406.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  - Suspicious use of SetWindowsHookEx
  PID:612
- C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
  "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ContentI3.exe

Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Size 3.8MB
SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
MD5 bf6eed6cdc17a0130189a33a55ef5209
SHA1 e337f5a0931f69c464f162385f1330b4d27b372f
SHA512 90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d
SSDEEP 98304:QOlxyx1rYP44YaQqtGeIEAGoZXvFYfyCu:QOS7dqtGeIhGQXNYfRu
TLSH
T119166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 d4c9ad91e616b7a5a4dbb515398fe1904355b89ef6b7aa4522d8fb62e82f450b
MD5 d0a0ac35acacbac84622505efb388bd4
SHA1 d7283c5bdb3fd98a4289b6dcacde72a0d816e800
SHA512 c9ecb1357609bde1273d565f86868c972957b157477e0e0f02016f24b32d0d4209e82b65944cd11749efe68ce94a737c680688aa694516ac2a5f7eb079b63739
TLSH
T1B3A0022565C0314959568E4C759455D058924483056DE276CE78F6460526A0220F254A
MD5 SHA1 SHA512 TLSH