Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
12-01-2023 05:00
General
-
Target
MODELMAPEO-IBRA2022-Mina2v3/mapEditorScriptingExtension_c.lua
-
Size
904B
-
MD5
c009e7d2de47023221d16f327aa42e13
-
SHA1
867dc48a545f0a254f22fdec9e8213321455aff2
-
SHA256
c604d1f481eff1691a27d6500345ae7683cea9a77884102f6a3724a3f3029eae
-
SHA512
d32df90ad9ab061396aac610e6f15481dac864d5b47e0e1017ff6b62238cc8222de122872f0def95874aa6d44b39a24aee92f8ef025cf9e9f13cd0463ffcd050
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MODELMAPEO-IBRA2022-Mina2v3\mapEditorScriptingExtension_c.lua1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx