f8b7a16b67c731eee671d089b91127d64933a891e4c8680e3e2a2f9cc37a8444

Analysis

max time kernel
298s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-fr
resource tags

arch:x64arch:x86image:win10v2004-20260911-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
13/11/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxExternal-base-main/External/src/app/session.h
Size 166B
Sample261113-rd3vfacv41
SHA256 f8b7a16b67c731eee671d089b91127d64933a891e4c8680e3e2a2f9cc37a8444
MD5 863ae2750fd3a5e8e1f5a562853eff5a
SHA1 56162246e8325aee5dbb481f5a1de8c33937edb6
SHA512 1fb5e859ab06254ea27c047f8ef21a57c63c34e0b5ae447c6b256b51a8e56931766fb06dd015517641ed30adc6c41dbfd4fb4b3506c3cd167b7e8f1ffc448a05
TLSH
T1FEC08CA2B2F6DAF9483ECD52DA27C0B10A8420BA2E01C0B3774B2BE1260885E4029642
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1432	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1228	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RobloxExternal-base-main\External\src\app\session.h
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads