176ef5684ea6a3576ff8a2f04bb69cd64c35ac672e358a10fc82877ce1369d3a

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 20:26

Target
inferno/inferno/Source/Roblox/Cache/Cache.h
Size 1KB
Sample260525-y79cmsat4x
SHA256 176ef5684ea6a3576ff8a2f04bb69cd64c35ac672e358a10fc82877ce1369d3a
MD5 33fc794a952eeb48609d1a9bc04edf60
SHA1 3d8c1e6e116882e227027229c8864a417820eab2
SHA512 190d5567a9a3b0c31099ae27cb12e5b8a5bfe313f9e0f15768bbf57d14394bfbc433f7d297920ad9f318bbc571c6077c8d0d301b2db877e642f1c210e0221a79
TLSH
T123317B4636BCE9492CA2C0B6B1B719E3F81830E0976351A0F44DF0BC716641EAF759F9
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\inferno\inferno\Source\Roblox\Cache\Cache.h
1⤵
- Modifies registry class
PID:748

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact