1517b64bd4e4dd23516881bb6495944a60547e590eef50664be4e7edcd5104ed

Analysis

max time kernel
899s
max time network
478s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extra/roblox.onnx
Size 11.6MB
Sample260731-atfleaaa45
SHA256 1517b64bd4e4dd23516881bb6495944a60547e590eef50664be4e7edcd5104ed
MD5 aa358b723aad2c4b927d681ef9a6c302
SHA1 4972fb38c3668d12239313ff5d68db9c61d0d882
SHA512 8e09756651e70fa9ac2145f54781c1f2966d258fc255ac4b5c58eb11d3b5ba15dbbb3dc9851142669fa25f9df4bc8481554788d912c8073f16cb411cf1022c75
SSDEEP 196608:WtrNw6shde2PB+r3uogPW/gPG2dYJK9HN5YXZOIKzOCETk/Jp52a:OTKe2PBQ3wP4Y1z9HN5YgxbSk/b5V
TLSH
T14DC63377CE4F1DBC7CFC261DA3570B0E4A4A7ABEA79481A16052A419784E530EBD02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5364	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5172	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\extra\roblox.onnx
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2624

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads