141f51142daab5de076291fbc88b6778786578623710f85f2543802b21863bb5

General

Target
WEAO-LIVE-WindowsPlayer-version-90f2fddd3b244ff6.zip
Size 311.3MB
Sample260708-ag6basgt3y
SHA256 141f51142daab5de076291fbc88b6778786578623710f85f2543802b21863bb5
MD5 55810a0155c01126cc16a12fda5e11dd
SHA1 5c7f53729b3274d1c4ce1e4c5d03b2a1d39419c3
SHA512 13f34b900200204366fcf3c6b22a207b5aac47c262d85fa20424565966f7f339e98a8f67a495f6f0afcb7b3bfe46d084e7de24037a06cab71ea07972e8d6de8a
SSDEEP 6291456:TAOvLZrIBYbLQuWrVI/vZFxqoAEcqrrfHgR8JCl:TDvlrUQbWAvpWEcqr8RC0
TLSH
T194F8BF0BF7814A72C95E4236C8E76720F335E4681FE287D7269C62247DB33985E731A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WEAO-LIVE-WindowsPlayer-version-90f2fddd3b244ff6.zip
- Size 311.3MB
- SHA256 141f51142daab5de076291fbc88b6778786578623710f85f2543802b21863bb5
- MD5 55810a0155c01126cc16a12fda5e11dd
- SHA1 5c7f53729b3274d1c4ce1e4c5d03b2a1d39419c3
- SHA512 13f34b900200204366fcf3c6b22a207b5aac47c262d85fa20424565966f7f339e98a8f67a495f6f0afcb7b3bfe46d084e7de24037a06cab71ea07972e8d6de8a
- SSDEEP 6291456:TAOvLZrIBYbLQuWrVI/vZFxqoAEcqrrfHgR8JCl:TDvlrUQbWAvpWEcqr8RC0
- TLSH
  T194F8BF0BF7814A72C95E4236C8E76720F335E4681FE287D7269C62247DB33985E731A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery spyware trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  AppSettings.xml
- Size 150B
- SHA256 bb11dd79ccb2f8cfd6fbbcceb7553cf99482939731c87cdbdd7ccef65d32fa1e
- MD5 943b86210840b55eb9a04d12e0c52c4a
- SHA1 57eb826831dc9f12cdc70e00b072319146b58f21
- SHA512 395b185b1230012e3e52700e05b16cee18b57ac5f8703148ba49c9a59c7425faec415efe756c463f9d53884909a64f7c0967bc3f43ba9baf0fd4e36125e7014b
- TLSH
  T14EC02BB04370C0149390CE14873DFA00A39039B100504084E8D1384A0FC45C013D33A3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral2
- Target
  RobloxCrashHandler.exe
- Size 12.6MB
- SHA256 89d5bc70e0f4f348558d6445da7d92e937e9c1f6969c50dffa157639927dc23e
- MD5 ba5798167308c96318abd087e6e84e43
- SHA1 55af416f87c1e2b9bbb502b854bfe2fcd5ddbbb0
- SHA512 7dbf6d23b382a175c12b81f314f793926a969324a883db4eaa6bf62869636060974b927d4999b3073041d69c85a4de7b8b0f645e1f960ab0faa3c82e6c936814
- SSDEEP 196608:CTY5CdJd57L6JYHZWGvpyG0Bwi34OjoSh4n1:qd12aZWGvpAwi34OMln
- TLSH
  T1B0D68D6A62FC00E8D47BD17CC6469617E7B1B41603709BDF1AA086EA1F63BE41E7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  RobloxPlayerBeta.dll
- Size 21.0MB
- SHA256 8de528761da86f52ac2d5ec42c30f5f6cc95895872a2576dacba58f7f96d5037
- MD5 f9a891abf4d7aa498d5bf56c61b5ccf9
- SHA1 cecf82b5b2840ab7fb672bbc01fa0f23e90c20c9
- SHA512 bfc9244e97a7565da932ebc312a72f4fb0ee8ae67d862e564b02a21522b4ee3524bf749c395807dc69d3a5d32581b07cf1b3661f480c2614876281fe338815b6
- SSDEEP 98304:k/9ag/2tOYgW24W3L1k4WMSFeZ7yLHpP+ZSfaJobT79F4aSPL3M6OPOUS9MMBtmI:k/9MOCOLYFeZ7+gemI6OZSFOfR3VIfJ
- TLSH
  T1FA27BF8EB9D20F94D5615070E05F1BE3EA36318C4A5C2EB78AE50261367369D264EF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  RobloxPlayerBeta.exe
- Size 129.5MB
- SHA256 53cda3f4cbbb3d01462f3635ee05d76a4af05ed5c35dddda10cd0eb3a836e4c5
- MD5 31899eb16a223c34772d0325365779d3
- SHA1 278467a2ea8df4ca10cb28b4ef462568323527a6
- SHA512 f2e83b181e7a69f671bb50f105c80b07d995f5e09d61e530d6817d466e8ae5a9c01087e4be3e1275beedb33946c464705ab8af9858b5ed9f231062d2debba045
- SSDEEP 3145728:yyLJdLilJhuWHzSMVISZ00+OaZF79qo/oEWsaqrrfHgR8J+MjxcC8:nLQuWrVI/vZFxqoAEcqrrfHgR8JCV
- TLSH
  T1065812D3B74259D2E54992399C0E86902621FC74AA1213CF74E8B31EDEFA38D9F97D10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5
- Target
  WebView2Loader.dll
- Size 162KB
- SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
- MD5 e2f9d2ef3446e70b50de50f577c6939e
- SHA1 48e7721704249cebd1267280459b7b36ce99e177
- SHA512 f5d7790bb2eacc78405a91a65adc0f30a248542de22ed10cfe91bc87e4f953a93d738281c13480a070681e7169fca6ec49e20c5fb7b89d76f3a9bad912c6d87d
- SSDEEP 3072:erQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tv+EtJfy2aQutH:gMMTlTRTzWiThTNTFSzjiBM2h9P5oZNr
- TLSH
  T190F35B4772E5407BE16A8274C9A34A11E77774510B60ABEF03A4477A1F23BD4EE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  WebView2RuntimeInstaller/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 c4985b3d50104c12a535e45eca320c1dd462041ece252468386ef0b17788be71
- MD5 7683171b0278b98339bff83ae892bf9a
- SHA1 f8383cce192083d0621b8967d6f32e32164137e7
- SHA512 0754568f6e51d5a1282c6c857a835da0a6684d6a1d8bf65088b79415e7533b275274548c2b07e632e2447b223e3359f60e2a1b6a25a09c6d37d2ece55e50bb58
- SSDEEP 24576:iiEMM3pwHzmIo1hnBXCKn72OwS3Npq5tQMKSRToKiJky7BzkX:iiEl3qTmtbMK7EOfW3vMKa7Bzi
- TLSH
  T1A275221079D18072E1F32A3085F49BB11EBABD210F7299DF17949E1D1E349E3D63A72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7