d945aee4718785b5bbdbc575d76a16ef60bd65cbfed47ef53e7ced99b580371d

Analysis

max time kernel
298s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxExternal-base-main/External/third_party/lua/Makefile.bat
Size 7KB
Sample261113-rd3vfacv41
SHA256 d945aee4718785b5bbdbc575d76a16ef60bd65cbfed47ef53e7ced99b580371d
MD5 cb951dfd92bf057dab4d54b755dcb364
SHA1 89d0cd58d7976f31acaab1d22017900bdf6e2d54
SHA512 ff96568ab0e60584727baf384bb35e25c4935bf6005d08fbdaae3ff32989b3e5e1d3a991d1166a99bc998efbf8b799093622fedfa830530c29f7e408e6b566ef
SSDEEP 192:3tfSfES/HJ7Qu2k2QW262d2+2u2Y2H2D2E2QY2j2ak2Y27V2u2e27WX:3IfE4JEu3HWxKbfR8sBHYK0L2VzRjX
TLSH
T138F120DF180D6FE46440C4A4A88968077AC24FC59F3E92ABED474815F4BC39F60B6A36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	cmd.exe
File opened (read-only)	\??\a:	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6032	cmd.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C019A5B62381 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000263bf26d51023645bc9d5eb8fa7fca1c000000000200000000001066000000010000200000004d3b1f9050b970f6de3e11a5ef0295cab3ef7e380ad61c4f85a0968856a53de7000000000e8000000002000020000000dfec76a60d5e6d92d6ce09fb0ac2f2e936ed3658a03549fb51486e17c67f1bfc8000000034fa0d6590324199677de0cfdb518d875698648deb98cff0ad9970acdc576f4942530d226188ff7f2c80441979a01a427e12b4a36fbfd87a871cc094c7eb2e1e43117569a98e5b1a6af54b0495eaf30d2aba4f1e1a80e6f8d512887b40c97185edb347c81f23020222b68f47e66039e5d567f973f7a7a3f2e94b3b658b72ad1640000000b780f83f6ea449009756f3fc53ac115c873e88a1bf4e053571c598cd7ca9861d130e8689de636aee87eaafa39dd64c47ed78ea73906d9ba8b932462efc8ea6da	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000263bf26d51023645bc9d5eb8fa7fca1c00000000020000000000106600000001000020000000e48472dcc0aaae3c4b0666b4cd83ad00a55111048a055d6b16449f1b6015f4b3000000000e8000000002000020000000f903dc64d6603badd247bed042b1ac3d58a54a10d8207a7ab1cd6f5dc987e2b9700f0000ea5564b7273296ef887b4b6ce1f694d7340a0e75089338bdd50f00bf2031548864281266d492f3649efa555fb4fb13309eccfa1ba9ff5c71a8d3226192f267db28bdd2253787cf4a86af85e71a6205be94e4e608d60f39d2fa2c3ce71ecbd55c1ba10a2b528399a58c4b134949966cac88acf310e0210a91613dca60f85e16127d68b32139665a8bbdffb136fb875df23bbab2641bd765325bc07831f561dc923a5b22598163e4fa9c90ade3966b0cd69058b25419183b005f9493bdfd4fbabe6197c68aea85ddeac69fc4076898b037563321c089f4ac41a1ca2821dc721bf17d9183c560ea5d46dac66abc374cb2b87b32ef04fec06f59d116e1ac599c7b2f08640a5eb3db4b10985dacb9445eaa6d74b4af61a911636b6f7798993cd9cb4b08f7f71f45b0c748e9cc2e39eedcecea39103a035d46c40203f8a9e6d5330f4d4e5bc85ad31e7cc9f8d6fc00a0b1f57c7910c0676cefd48f32c9ae31bb127ffc9eac052d6362fa0d93e17d3f9ebf0f0cfd0844a9ffe0c439d6084559eb0d9d16f28f49a3913928b8cf7daf1cd2330226ef847e163939c1cce82d4e48495c400c2b175fa7d71ae20c51f5be0dfa6358daf5d9eae891b9976e9e92e9e14add5004cc5e239b4d2c13a83523e28d253dc659a3684dcbd2c0f1c35709cc7381ea7c73c8839b9a34489bbd9d70e81a03de79b748be2d7ea2c45642b54a6ef38431a7162b76077abc932d97af8d225e1efa7a2eae270bbed54132d48eeb841e06e29032d353df8c2af2369801db214d2dd07c0678e3184ce77efac4020d77324d3f4261555066e34aeb6de895bbc9225963a5af2730011fb890ef2cc244f389e97faca24e3f7606e440c6bdb69223bc928e9df6436d19f4a2b9ac9a8cef21409edeca03443543633b0d30175404225184245c0815cc375082ea53350a3ab0c79fc88d344873181fd13e7efa94e45bb68f477218a6b6cffd05817ed205d9871e4d261594321d49f3293089dbfc93424cefcb3093e44d0d34f188e74d94846ad6368acc43284d12471df3bebd9e1f8679feec13114e973f65364e07faa2a60387766e838ef369b3a731fbc35bc2b87b527d5700db15963f94132c3e10650a4a13f2102bf428bc34a1ec206dcbe27bbff1cb21588656b648edef26da034da098705b2e208df4d218c98a0fff9fa2251845a25a88c6172a7b3b0a717dc7d4ed6f7caed9840cb917287f05d3703a819ff4dfb5e42f735a0d623d47da9d625e5ae84a108b4dd5ff816fca8073ba8d1c22a74912b0b8e0db8760dfb3774084ffbc99a69b71a35b30a2a6e154604f06248bd4a12cb5266337254a35783d9f31d895a3714e0db69c735f3f69c3c1e493b541ff766efbf621ad9054a3abf8e28667289c44a58a014b7e38e04c4a0216300d423b75776e549a560862f2a44eb93d5353cfe2375db8030479669a23c3db0fcef736384e8d1c5f7074d9f3c7f6aa89e27dcd58bd0967a5d859ae500f86d06e4a95a852821b4e907b030ce4c7eef2fc98b0adbbe9a6d0e1a6e5078ebcf6b35e8dfcdf7f67e5fb5ece543d4a8e8f69abe7fc3ed429bf4b0ea9044e0e4033fb428ca092b518d5e97d1d1c12839293a62f2e7c92dcf77e5f349fb55fd881b7c2c1530525b13b17c447d09904dfcd9c354b3776815390ba6d039eaae07d1b2090082549d3417a7e8e8ce4a8f891b8f07359412edf93ccac57184bcbfdba992a7499027be7e5b9e024c18bad1e743ef7a84df7473a93ef58d9d04d7fac11c86a35e5f88343597e8b1b2389f32cc5d7636228c06d2acf283ecb92ff2bfc4ee312a0c4cfd4086d8f2d47b259f18ca8b1c70fe7374e7ea3eade2f7d05e5f746ff69824713e5067e588dddc40ec9cc7e18f83304328b40489fe4eb42a530d186d92feff94ca501728568b48ac46d59bb5f08ad153eb0faba1d50b10efed29b5ed096bd62cc9633c165625fb9d736936352aa425fbb04563c1206b541813ff57b97be641b567f1c888aea0616ff9d9ec53b442c282153aed2c76701eb21813afdb622016d08f5d975ae24ebaebe3ea07a5657cf7475139d06515bec88782a93d3902325725ec77ba53fec27e5bb4f70574f5faf42cd32201cd2bef9c63918a50cb6a72c19759a4e8fe1f43152fbb9e49a29a8fb3ab723dc02d7db41cb6ebe5b3789ccd3ed572a4f75822533d604141b25c20121ddf7dc2edfaa2a4619859e64f8a46529bcdda480ffbb18dcfbedfe9d8c2746b993c0012e8ebc893b22aacc2aa8b186fede52db42725e320d82553c21a08300f9999ddc5016062f3b96ce3104296873853973ba0b68c82a809954d3e0dcdd4b42cf522e0cc0ac8b06b790e052379b661b65c12b31ee300475dae3571d52ed16275572d4bb253e22c0446492f0f06c271666ee82d9a4ef476b22235d275415c3730aa6464862243ffaf449494197f2213becdb185ca4006d9cc7757553037d2b65fe0b49c87d1d445045191bf7d618a699b8de3461af66b884eaea7c8df3a2270c7eb63bec25722805c3515055f447908acbb41531d5a2b6371cb8d226bfb02f1d287ee73de3e5738e976ee7fb4df847134ef87f25752067fa4abd4b37f0c29e2f130c90d93f85ebe730831daafb180e4a8666111f237ea03f6c9dc055041cd4802fbcddc77ba9e33504baddff92de2a7568f938f769ea8b11bb4cb4c48ddafa9a4004f48b34c8a0df484391637d271fa0850a728057e53abdccb3604a366b9250a8424c4424af9f7942b50b2623bc76ae8f41972167234b6b161e595133f347864f14867afa950e5fd17f85e74ae757275ba30c9b2526f07c06ed46c73e52533dffdf7722a8d4d377bee069767892b50419333a003bf331dcbfdb0f87d7ed0d0396e7da67637f5a3bfcd4428479208b2e7e39daca54fc98c6a80b8c2d94127ee954809fd7ad7389afeb923a0a3b7fcdca6fc2a10b5b54dc4f6e3e5b2cb3c1d453e79bc00a1555e5395240c0730a96ec0fd9b775d217ea88aa390037d904b6a24a408f1dfc34fb69070a9d26f0bd00f2b47332b57d59c43e4402825dcb3ab9dd5f173a3b13294726707d140b1852c8bb8956a63b351614f57deb6fa62c0ae5baf83cb9b045b343d434ea63a181875239760b16a0d4a1c1d2ba6c550688908ee9a851e6389e88948280f759cec219d85a3e5d6acaa076d84d853cc7876e90d6e846d5d0083dbeccca2bff081516507949eb6cc00ea8c69fdfe49bc50e9da7f374b5fc99123a14d115ce9b7aa72af225e07e86737bf1d965f182b74147ffa8447cc4b4f682c8dbaa12c25fa8dc7ad2d8988f64b51cff0123e39b3637ebe2ea0ea711ad1adee444db5fb003e6098eac4a5e5d04047324e02262196488df399007f6e429b6d2a2cec720f10277afedd4af377025a21303b06c5722fa59700f5bf5686462b88bc4e1177bfee1dd6208694c69e412b90be25689f2e239b137e88ae2885cfaf1233f183175c2ebb5f459f611c09919114082b395771959d540cde390993f6c9983778a19fa170e96ae8f90daa58f78c6caf16e7aabc51a89e8c4ecfd3395e183dec604a6e8b346068c886bb52286a8d632a07f7f71126bd8a4c7e94f784093b40095833436e375c422affd5c3a0d5b68bd1f614a7512a44b5e7f0642b33306b1709ba4915793efc1a894cccabb5e9e79357c98448143657e0a3c4da5c116e4e59c4f8b88be7beb7ac0bfd88479467c957ca797bbc8e624a377f0655d75829b26b35ce95bc25045d9cc536a7418f1bd154b021de4ab0d0fb64e1f4e981b73867a75d8e29c5ba21a53250a632e7411e456ece838384007e9fcbb5ff6e97fb0c8b93331f9e7559e5fc960b23f6a6983817ba28f72e6e32648f4d22a6cedacd30c2a0ec19f66c94aafb8694c01629994399cdbb478cba8a806252914a172609c4cd49ffc66a299dbed83ec60cd88a5c4d9119de8491c9d73125b4f4a5f40dfbcc12eff50b880f2d1c95b87139711d74a56f888979a1d142f3942bd3a05889ec34e2dfcfc380cf630505da92c43bf5ec6f7cd2cb0713d649e60c9a54d3daba3423a003aae5d8e61d92cb6762b45ce7b504160c3d2b52e4f47ce19cc3bd6ffe3422d65bfe453bc199cb415f679819e51d23f46bad3e9628fb19ee48f7b2121b7365dcde5e3bd7fb1e43f8a6b86a85f6085fc1251e6a57f5d4ecdc7d8b8497de0487860da3b1f10440fe38c7b01b02f2c94fb8d7373fd37c041c028208b043217f79b28773402de64c22280b1ed98cfc63c8c3958b103eeb0acd74a6858749b61f3e98790da01806319007ead27e888335b681a80c8840f7dfb5bd620382e359bdfab610e6b1060fcf517c0cd67cfc0382f061b7b5ca9a88adae886b44a591198b32405816927fd406515518dc82b97c395f4fec0672a9d3ed7d477c39487d4301f0cad8155fe0ac16f479f6fcf64f0afb470b7df688d9959db9af94db72118d74f8ba20d9b57047f75de41913f614f2b0b0b55a425f3edc2ad6a9e5e506cfbce78b7c4b2bbb11e3168f381caecb9863e241b7842fe97d4acd242ff80c04ac99d92ce58fd1a0c6fac2e1c898a905d208edad3f23a187002624fd5071139b32ef3ca34ca33445cbe29d489d873f3d2af79f14f96f1d72b4c236d5987281f25593585b0f949a74a3d0ac6b5c33c0c535b499b254e4117ce4ff5057cef2598e29ba73a332971e41274e8df331d381abe0bcb957fee7433be455b9249aae2c1e95eed0bdb0069fb54af8ff2a1ea6cc1ae5f48cbaf876ccbcb6528b1696675932ae9957c6f31b5d17914ed408c023b171cd4ece528b4c04828ce73e7cb007d1345866187061f422ff77e0bf77cc644d919659c5c9873f54f69a75220b02223106be75d1d657456c8ecfc98c93a237ad591ac2e382c58c98f91927783a6d16af3cdc4bad7829ae3e4dee1daa4027cedbde1c115b36a904f24736ad00e4d3abee232fd2b68df2bd1f31e7f5ee0d49250a549c39077471310c351b4035466810ed7133527a6d6bc58acc19047fa28b82ad2a19cf7d4c4ce33641503e15c3287609dee3eb8ab0df82f721e46c9d885389c965f79df314df652945982e2649ec4ca8fe12f6562b76428c7f293d938cbdc7cabf6961ad18396f576711eec5eab9eac1e4fedbf683b5b49ba0f1cbacf48d57add3e85446596f7baa5b7ecbfee12aef37231c14bef3e0c120fc0cf346336eb87d2b5f34c477c562780b07cdaeac4a4945d232dfd12bc530bd12b43d9a546f13e6bf2089d8e8f08b199316753cb8a9eb04ac71c3941188480d4cdf709bdc83946bdc8f07c480ecdbc149bfa2dcfb84ed2fe7ed9c6e6934161873225581829f0d1cf92a636a82ea4740859cf812d289f42ba55426febfecd0ee535ad8241d64aa4be6c8f8b5434ca91eec014fd1b6f53a290dd98d1907551ba9ea8fca8d1ad8f119fed8c2e6993272ba34d9215539b2535857b38d806cbaafd811878e75fe7f9bfc1cb743f5a0e75df979d85cbc1536a0830a8cff411bb34597d0b8cf35ac9f10b8684d9a6e6e581b00d57b6c2c65632e85a3fa73ae3734866a8f26665001318132242e6bdc5dc762ce161e5855a5040000000ad2ed3997776ce6ac41a36f8d6a79e12591fb6a415b2f027a6d38d714c2b5c247ef49d7435407bcbaa4c7db26b54e90c2284326a6271a1a72b96e8eb5430635e	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\DeviceId = "0018C019A5B62381"	svchost.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RobloxExternal-base-main\External\third_party\lua\Makefile.bat"
1⤵
- Enumerates connected drives
- Executes a command shell one-liner
PID:6032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads