10d68e96b17fe89e1672bb3df965728067c38107ea3c988dbf0210248fc4d1e6

Resubmissions

12-01-2025 15:47

250112-s792aaykcy 10

12-01-2025 14:03

250112-rcpw7avncy 10

Analysis

max time kernel
133s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox HWD/Scripts.py
Size

12KB
MD5

c559ad84688d4b3550b8efbaa58418a8
SHA1

1daa2ca0f301ee28c7e9c3d0c596592bad077701
SHA256

1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
SHA512

1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
SSDEEP

48:G22222222222222222222222222222222222222222222222222222222222222n:2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5080	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Roblox HWD\Scripts.py"
1⤵
- Modifies registry class
PID:3520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads