Overview

overview

9

Static

static

7

WEAO-LIVE-...le.dll

windows10-2004-x64

1

WEAO-LIVE-...le.dll

windows11-ltsc_2024-x64

1

WEAO-LIVE-...er.exe

windows10-2004-x64

1

WEAO-LIVE-...er.exe

windows11-ltsc_2024-x64

1

WEAO-LIVE-...ta.dll

windows10-2004-x64

9

WEAO-LIVE-...ta.dll

windows11-ltsc_2024-x64

9

WEAO-LIVE-...ta.exe

windows10-2004-x64

9

WEAO-LIVE-...ta.exe

windows11-ltsc_2024-x64

9

WEAO-LIVE-...er.dll

windows10-2004-x64

1

WEAO-LIVE-...up.exe

windows10-2004-x64

6

WEAO-LIVE-...up.exe

windows11-ltsc_2024-x64

6

WEAO-LIVE-...ds.vbs

windows10-2004-x64

5

WEAO-LIVE-...ds.vbs

windows11-ltsc_2024-x64

5

WEAO-LIVE-...ler.js

windows10-2004-x64

3

WEAO-LIVE-...ler.js

windows11-ltsc_2024-x64

3

WEAO-LIVE-...ols.js

windows10-2004-x64

3

WEAO-LIVE-...ols.js

windows11-ltsc_2024-x64

3

WEAO-LIVE-...ct.exe

windows10-2004-x64

1

WEAO-LIVE-...ct.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    WEAO-LIVE-WindowsPlayer-version-145f189a6a974303.zip
  • Size 156.5MB
  • Sample260807-mtardack7x
  • SHA256 c9f81f2e156f3a35115cfc03711dccd9e32d5c5f916b02508356b762f6b9d3c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarethemidatrojan

Malware Config

Targets

    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/Module.dll
    • Size 1.8MB
    • SHA256 1b15a029609f340b9027921bab172aa88c0e38c954f045baa1da53b08c061f18
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxCrashHandler.exe
    • Size 12.6MB
    • SHA256 c218deaeef57f460f4e18958d2561227c3bac61362ef7a4d15ada3ee16a11797
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxPlayerBeta.dll
    • Size 18.9MB
    • SHA256 67d36d7f49eac6e53fc1344b0e5a17609dda25df1086dd9ad7bbaa3d05cbd339
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan
    behavioral5behavioral6
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxPlayerBeta.exe
    • Size 134.1MB
    • SHA256 46c0e6bc67f78d2898616702d270ad4625a6bdf3fb0afbafe4e6c4af0a2981bd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    adwaredefense_evasiondiscoveryspywarethemidatrojanpersistenceransomware

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery
    behavioral7behavioral8
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/WebView2Loader.dll
    • Size 162KB
    • SHA256 a8a6cd8d6df1f913671bcd96b6298b6f53fd066a84ae891e4d865bc1b8e8e9e4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/WebView2RuntimeInstaller/MicrosoftEdgeWebview2Setup.exe
    • Size 1.6MB
    • SHA256 c4985b3d50104c12a535e45eca320c1dd462041ece252468386ef0b17788be71
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceprivilege_escalationadwaredefense_evasionransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral10behavioral11
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/avatar/scripts/humanoidAnimateR15Moods.rbxm
    • Size 10KB
    • SHA256 ac5225c386dc84bc8883de79115d6c71e28cbf1d5c67a16f0aa19fd586d04c1d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral12behavioral13
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/configs/PerformanceConfigs/rofiler.js
    • Size 398KB
    • SHA256 de31d57d7886b0c52fb24a7dd74d623d9a2e50da97fff5c101c800b8a0243604
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral14behavioral15
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/configs/PerformanceConfigs/rofiler.tools.js
    • Size 360KB
    • SHA256 fc0d76162b08c3a86dde415d0e428a7fea5350537fc6aeab71ca25a482c0980b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral16behavioral17
    • Target
      WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/inject.exe
    • Size 55KB
    • SHA256 8072938a42757db90032185c4890b011123da399c2505a7667a596126ebe9a89
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral18behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Visual Basic

1
T1059.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

3
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Network Service Discovery

1
T1046

Peripheral Device Discovery

2
T1120

Query Registry

10
T1012

System Information Discovery

9
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

themida
Score
7/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

defense_evasionthemidatrojan
Score
9/10

behavioral6

defense_evasionthemidatrojan
Score
9/10

behavioral7

adwaredefense_evasiondiscoveryspywarethemidatrojan
Score
9/10

behavioral8

adwaredefense_evasiondiscoverypersistenceransomwarespywarethemidatrojan
Score
9/10

behavioral9

Score
1/10

behavioral10

discoverypersistenceprivilege_escalation
Score
6/10

behavioral11

adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespyware
Score
6/10

behavioral12

execution
Score
5/10

behavioral13

execution
Score
5/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

Score
1/10

behavioral19

adwarepersistenceransomwarespyware
Score
8/10