Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3/Free Robux Generator.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3/Free Robux Generator.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 3/Free Robux Generator.exe
- Size 35.0MB
- Sample261107-tj267sfc92
- SHA256 f031fa29afc3f96efd858de47a3b475970a6aa888fbc188ab977d493fd43f4c8
- MD5 8273993f53d761022b010d5eddced81e
- SHA1 e3e0ecdb3cde72abae42c9f764c12d6184b272e1
- SHA512 f27cd4c863a40c0db3c3919d3a73efd3bd6b941baadafd24f594879687448d44408ddf7c9698bd6b2ee2f5a3246a3458302955f97aafdf174ab17a8b0cdd1cb3
- SSDEEP 786432:hrAB66vKI6tGsebVnUnQo45cXEjIDMA1h:BSvAtGsebxUnmCeI4A7
- TLSH T1CB873351E4F08168C4B2103B65B999F327385D310334ABE7E2D12DAF79E77C939BA0A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
pid Process 3264 Free Robux Generator.exe 3264 Free Robux Generator.exe 3264 Free Robux Generator.exe 3264 Free Robux Generator.exe 3264 Free Robux Generator.exe 3264 Free Robux Generator.exe 3264 Free Robux Generator.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Free Robux Generator.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3060 taskmgr.exe Token: SeSystemProfilePrivilege 3060 taskmgr.exe Token: SeCreateGlobalPrivilege 3060 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3060 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3\Free Robux Generator.exe"C:\Users\Admin\AppData\Local\Temp\3\Free Robux Generator.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3264
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\8fa980b2-bf1e-4765-bb90-a8fa4a566060.FusionApp\KcButton.mfx
- Size 40KB
- SHA256 94cea0df9febe19fc2e1a905bd7df0bdab63797a42a7006f14bc8838003e5a45
- MD5 b848bbf535366b6053f7bc8ab87fc5e0
- SHA1 19d8a51062201531ff58c898925e53490c22213e
- SHA512 cc6df5fb9ef537a255faefb890ffd07556bffec5abd6a914afeb004b77dede2db21dce1179a36b8641e7150e8c466345a58288835722639c1fbb7e5665122543
- SSDEEP 384:3rIlaI9/J7NBiwulWwnTXnk2Fp1ARNq1O1wLPw3p8/F9U+SX8wVAvBjKA:3rIl3xNBST3xFTAAqwfaWvBjKA
- TLSH T179035B82C254A4EDDA071634D17F2B3BE63CE9EB98049D635128DE3C6C66223F81E757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8fa980b2-bf1e-4765-bb90-a8fa4a566060.FusionApp\cctrans.dll
- Size 141KB
- SHA256 55e75e784e436cccd978192fba869656f879f0f126e99b375c3849c99872ec56
- MD5 ce3a36f85d2ea504b6d19c5f366c3f47
- SHA1 972629c730b65c17ac2c751aafeb612d0c7432f2
- SHA512 c6df293b4373552c3165ac27f2070973a8278bc72001a8c10f300ea30699a03811dc6a84864ff22aaa2b35d1ec75d41ceb2a8fee85b5404d4a5bbfd8333f248c
- SSDEEP 3072:EjqYJijkm4k6wR/NQzjFEgYfriCJ+7NgGWb9UetPTztsYsRn:UqoY4sNQFE1fJZNTZxg
- TLSH T11FE35B00BAA08830E6FB543D08B5DBA52B7E79A4CFB08DDB2B54177D4E702C15F35A1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8fa980b2-bf1e-4765-bb90-a8fa4a566060.FusionApp\kcedit.mfx
- Size 32KB
- SHA256 1fb56c1a5fb313c8c51fead10472566328c9260aacc72aa8dde8d345acf53203
- MD5 62f67209e7995da3f14f4b697235a99b
- SHA1 158248b41de5449ef647a2caeda431dc544aa59d
- SHA512 3857939c51b5045030df233393597b9b56a0534a2ea570d748a002b19b0b20de16b0d5181cf9eb6180d24b4de0a159e21275d12bdc7673a3f891ce155db42325
- SSDEEP 384:w1Ye/oItJWae34vFRVBX5xDEECeyHoPy0KYKmI:ivQ2JBrL50eqoHKY1I
- TLSH T146E2B202ABA20811E5F69D357C7FB776A5B7BD821A3AD5074520DD3D2932607EC2CB23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8fa980b2-bf1e-4765-bb90-a8fa4a566060.FusionApp\mmf2d3d9.dll
- Size 1.1MB
- SHA256 3cde7a9181ab63a42cd3535d279d0ab1397b7b78fa3ddddef832757ab2024101
- MD5 72bb9180f8905c0da95566b778cdac5e
- SHA1 e96145e8120514092b35f67f1f120b958997f921
- SHA512 c2c8d8c74c53a78545e69f27a7fe1a6d1291888158962e93e16e6ec9950f86e74c68bd2eb50d04db0bff58e8dc93455aa384245991c5afe34abee36fef53710f
- SSDEEP 24576:EE6cfv6jilsTCw8RCmttZtcJPFGySBDmXA4HwLSJcl:CyA8omXGSFmdkl
- TLSH T14135BE51F292C036C0AB23710657A3B932BDAF251D7585CB1A88BDBA3F345E147293DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8fa980b2-bf1e-4765-bb90-a8fa4a566060.FusionApp\mmfs2.dll
- Size 510KB
- SHA256 6c9ff6036404e71b0bc2c12bc739eeef0d9200925f5796487af2aa4ef5c5ef97
- MD5 1e0e5acec2f2d3567c40491e39aa8f50
- SHA1 101ec3bbd32c005b12b38c0f7988faa9329a019f
- SHA512 80bbdd2dcc44494a53b14098b7e99db7c20b40650938454105b423e70906ad7371274ed73d3fccd114b9396112a695aebf37f6916976a972154cd562d10e01de
- SSDEEP 12288:tl2w5SNFe2TMNMfeZJyxqNEQ8W7zf+IL2SUoOHxwVoipcVDNLTrgLiFs+:edNFe2TMNMG4qNEQ8W7zGWYd1DLTEWy+
- TLSH T198B4AE10B982C231E4EA51B28AFDBFBE152C677047B858D75B4859BD1D301E32F3266B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8fa980b2-bf1e-4765-bb90-a8fa4a566060.FusionApp\ultimatefullscreen.mfx
- Size 86KB
- SHA256 111c61d9e54b037a2c492b89cf6a82c62f81712fb9fd64a91c9dfc9486887349
- MD5 d9ae994eadde0d3418aedda4f712dc33
- SHA1 402e8ca669a4fd6ff69399b7e08d2707f216c68f
- SHA512 0c6b0a6df08ef8ecbd2bbbc1dd4534f42ea4f440eed45c98647d712945fd71b5fe484f1a76388724a82a6acb2b98e73efcbf82f0d3a329890215d0eecac20c9c
- SSDEEP 768:O0tk38+IToRb7/6GLKB/XR0haFH2KhLBhpJVt7EnV1F4TkedlsHAqED+nLF1XJwg:O0tk6+KJOhoL/pJAn54TkJHpZKTXh6V
- TLSH T156834A13B1E0B331F8961A39D47E27631A7EAC225BB552CB5B9CC53A5E903D009B436F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8fa980b2-bf1e-4765-bb90-a8fa4a566060.FusionApp\waveflt.sft
- Size 8KB
- SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
- MD5 57ea61dd14314ef155e80c6a0be8a664
- SHA1 963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
- SHA512 cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
- SSDEEP 96:vLor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6N/8cKH+ewp:v26Dj9t2ubTVdGJgOcGvw
- TLSH T16FF11B12A7A500F5F8DD0B7134B7627BE875FA285B11C24FC580DE6C0C301E2D928BAB
- MD5 SHA1 SHA512 SSDEEP TLSH