URL:

https://s3.amazonaws.com/setup.gametest2.robloxlabs.com/version-c779580ecbd9426c-Roblox.exe

Full analysis: https://app.any.run/tasks/fd144b68-3077-41b3-bf1e-683254ace3ba
Verdict: Malicious activity
Analysis date: April 02, 2024, 07:35:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

458428824895102C9AFCD25B8C53A5AC

SHA1:

0E9B047C691E41C36D4B1DBEDDEA1EF1ACC3F2A7

SHA256:

93CFA4688A97858378AE7C87F6850621040C6B54A338D2C6395B1BC9B536B5B5

SSDEEP:

3:N8H7WtWARuTAWFcJbTIFAGhcdGMOHmn:2H90uMIczdGMv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • RobloxPlayerLauncher.exe (PID: 1264)

  • SUSPICIOUS

    • Reads the Internet Settings

      • RobloxPlayerLauncher.exe (PID: 2112)
      • RobloxPlayerLauncher.exe (PID: 1124)
      • RobloxPlayerLauncher.exe (PID: 1264)

    • Reads security settings of Internet Explorer

      • RobloxPlayerLauncher.exe (PID: 2112)
      • RobloxPlayerLauncher.exe (PID: 1124)
      • RobloxPlayerLauncher.exe (PID: 1264)

    • Process requests binary or script from the Internet

      • RobloxPlayerLauncher.exe (PID: 2112)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3964)
      • iexplore.exe (PID: 3956)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1308)
      • RobloxPlayerLauncher.exe (PID: 2112)
      • RobloxPlayerLauncher.exe (PID: 1124)
      • RobloxPlayerLauncher.exe (PID: 1264)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3956)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1308)
      • RobloxPlayerLauncher.exe (PID: 2112)
      • RobloxPlayerLauncher.exe (PID: 1124)
      • RobloxPlayerLauncher.exe (PID: 1264)

    • Application launched itself

      • iexplore.exe (PID: 3956)

    • Manual execution by a user

      • explorer.exe (PID: 2372)
      • cmd.exe (PID: 2504)
      • wmpnscfg.exe (PID: 1308)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3956)

    • Create files in a temporary directory

      • RobloxPlayerLauncher.exe (PID: 2112)
      • RobloxPlayerLauncher.exe (PID: 1264)
      • RobloxPlayerLauncher.exe (PID: 1124)

    • Checks proxy server information

      • RobloxPlayerLauncher.exe (PID: 2112)
      • RobloxPlayerLauncher.exe (PID: 1124)
      • RobloxPlayerLauncher.exe (PID: 1264)

    • Reads the machine GUID from the registry

      • RobloxPlayerLauncher.exe (PID: 2112)
      • RobloxPlayerLauncher.exe (PID: 1124)
      • RobloxPlayerLauncher.exe (PID: 1264)

    • Creates files or folders in the user directory

      • RobloxPlayerLauncher.exe (PID: 1264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
8
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe explorer.exe no specs wmpnscfg.exe no specs cmd.exe no specs robloxplayerlauncher.exe robloxplayerlauncher.exe robloxplayerlauncher.exe

Process information

PID
CMD
Path
Indicators
Parent process
1124RobloxPlayerLauncher.exe -qC:\Users\admin\Downloads\RobloxPlayerLauncher.exe
cmd.exe
User:
admin
Company:
ROBLOX Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1, 6, 0, 492
Modules
Images
c:\users\admin\downloads\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1264RobloxPlayerLauncher.exe -debugC:\Users\admin\Downloads\RobloxPlayerLauncher.exe
cmd.exe
User:
admin
Company:
ROBLOX Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 0, 492
Modules
Images
c:\users\admin\downloads\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1308"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2112RobloxPlayerLauncher.exe -serviceC:\Users\admin\Downloads\RobloxPlayerLauncher.exe
cmd.exe
User:
admin
Company:
ROBLOX Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Version:
1, 6, 0, 492
Modules
Images
c:\users\admin\downloads\robloxplayerlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2372"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2504"C:\Windows\System32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3956"C:\Program Files\Internet Explorer\iexplore.exe" "https://s3.amazonaws.com/setup.gametest2.robloxlabs.com/version-c779580ecbd9426c-Roblox.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3964"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3956 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
19 829
Read events
19 583
Write events
195
Delete events
51

Modification events

(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31098064
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31098064
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
3
Suspicious files
9
Text files
16
Unknown types
13

Dropped files

PID
Process
Filename
Type
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_5C7AA733A26CC779AF88EBB5B7FEEFA4binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_5C7AA733A26CC779AF88EBB5B7FEEFA4binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\RobloxPlayerLauncher[1].exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
46
DNS requests
25
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3964
iexplore.exe
GET
304
23.32.238.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92967c53a8c0ec29
unknown
—
—
unknown
3964
iexplore.exe
GET
304
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?36ca310eb28aaa33
unknown
—
—
unknown
3964
iexplore.exe
GET
200
108.138.2.107:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
—
—
unknown
3964
iexplore.exe
GET
200
18.66.142.79:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
—
—
unknown
3964
iexplore.exe
GET
200
18.66.142.79:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
unknown
—
—
unknown
3964
iexplore.exe
GET
200
18.245.65.219:80
http://ocsp.r2m01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM48cPMe9XwQUgbgOY4qJEhjl%2Bjs7UJWf5uWQE4UCEAqFHNMUTb3%2B%2FNnQWmcy9Rg%3D
unknown
—
—
unknown
3956
iexplore.exe
GET
304
23.32.238.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3ffc3fbc5b315e52
unknown
—
—
unknown
3956
iexplore.exe
GET
304
23.32.238.225:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?719f0b64dcb4a601
unknown
—
—
unknown
3956
iexplore.exe
GET
304
23.32.238.217:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31055eca6ea3b32e
unknown
—
—
unknown
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3964
iexplore.exe
54.231.229.208:443
s3.amazonaws.com
AMAZON-02
US
unknown
3964
iexplore.exe
23.32.238.240:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3964
iexplore.exe
23.32.238.235:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3964
iexplore.exe
108.138.2.107:80
o.ss2.us
AMAZON-02
US
whitelisted
3964
iexplore.exe
18.66.142.79:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
unknown
3964
iexplore.exe
18.245.65.219:80
ocsp.r2m01.amazontrust.com
—
US
unknown
3956
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
s3.amazonaws.com
  • 54.231.229.208
  • 52.217.164.48
  • 16.182.68.248
  • 52.217.129.40
  • 52.217.119.80
  • 52.217.206.176
  • 52.217.225.112
  • 54.231.230.32
shared
ctldl.windowsupdate.com
  • 23.32.238.240
  • 23.32.238.235
  • 23.32.238.208
  • 23.32.238.226
  • 23.32.238.210
  • 23.32.238.209
  • 23.32.238.224
  • 23.32.238.217
  • 23.32.238.232
  • 23.32.238.225
  • 23.32.238.241
  • 23.32.238.176
  • 23.32.238.178
  • 23.32.238.171
whitelisted
o.ss2.us
  • 108.138.2.107
  • 108.138.2.173
  • 108.138.2.195
  • 108.138.2.10
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.66.142.79
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.66.142.79
shared
ocsp.r2m01.amazontrust.com
  • 18.245.65.219
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ephemeralcounters.api.gametest2.robloxlabs.com
  • 127.0.0.1
  • 49.13.77.253
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
—
—
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://s3.amazonaws.com/setup.gametest2.robloxlabs.com/version-c779580ecbd9426c-Roblox.exe