d945aee4718785b5bbdbc575d76a16ef60bd65cbfed47ef53e7ced99b580371d

Analysis

max time kernel
298s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20260911-fr
resource tags

arch:x64arch:x86image:win10v2004-20260911-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
13/11/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxExternal-base-main/External/third_party/lua/Makefile.bat
Size 7KB
Sample261113-rd3vfacv41
SHA256 d945aee4718785b5bbdbc575d76a16ef60bd65cbfed47ef53e7ced99b580371d
MD5 cb951dfd92bf057dab4d54b755dcb364
SHA1 89d0cd58d7976f31acaab1d22017900bdf6e2d54
SHA512 ff96568ab0e60584727baf384bb35e25c4935bf6005d08fbdaae3ff32989b3e5e1d3a991d1166a99bc998efbf8b799093622fedfa830530c29f7e408e6b566ef
SSDEEP 192:3tfSfES/HJ7Qu2k2QW262d2+2u2Y2H2D2E2QY2j2ak2Y27V2u2e27WX:3IfE4JEu3HWxKbfR8sBHYK0L2VzRjX
TLSH
T138F120DF180D6FE46440C4A4A88968077AC24FC59F3E92ABED474815F4BC39F60B6A36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	cmd.exe
File opened (read-only)	\??\a:	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1904	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RobloxExternal-base-main\External\third_party\lua\Makefile.bat"
1⤵
- Enumerates connected drives
- Executes a command shell one-liner
PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads