Overview
overview
10Static
static
10Synapse X.zip
windows10-1703-x64
1Synpase/wo..._1.mid
windows10-1703-x64
1Synpase/wo...ia.mid
windows10-1703-x64
1Synpase/wo...ne.mid
windows10-1703-x64
1Synpase/wo...s.json
windows10-1703-x64
3Synpase/wo...ibutes
windows10-1703-x64
3Synpase/wo...DME.md
windows10-1703-x64
3Synpase/wo...n.toml
windows10-1703-x64
3Synpase/wo...er.png
windows10-1703-x64
3Synpase/wo...age.js
windows10-1703-x64
1Synpase/wo...x.toml
windows10-1703-x64
3Synpase/wo...e.toml
windows10-1703-x64
3Synpase/wo...i.rbxm
windows10-1703-x64
3Synpase/wo...pp.lua
windows10-1703-x64
3Synpase/wo...er.lua
windows10-1703-x64
3Synpase/wo...ew.lua
windows10-1703-x64
3Synpase/wo...ar.lua
windows10-1703-x64
3Synpase/wo...le.lua
windows10-1703-x64
3Synpase/wo...en.lua
windows10-1703-x64
3Synpase/wo...ut.lua
windows10-1703-x64
3Synpase/wo...IDI.js
windows10-1703-x64
1Synpase/wo...ng.lua
windows10-1703-x64
3Synpase/wo...ler.js
windows10-1703-x64
1Synpase/wo...te.lua
windows10-1703-x64
3Synpase/wo...id.lua
windows10-1703-x64
3Synpase/wo...ise.js
windows10-1703-x64
1Synpase/wo...al.lua
windows10-1703-x64
3Synpase/wo...til.js
windows10-1703-x64
1Synpase/wo...ad.lua
windows10-1703-x64
3Synpase/wo...nt.lua
windows10-1703-x64
3Synpase/wo...a.json
windows10-1703-x64
3Synpase/wo...2.json
windows10-1703-x64
3Analysis
-
max time kernel
127s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
01-04-2023 06:49
Behavioral task
behavioral1
Sample
Synapse X.zip
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Synpase/workspace/midi/Spooky_Scary_Skeletons_1.mid
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
Synpase/workspace/midi/Undertale_-_Megalovania.mid
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
Synpase/workspace/midi/We_Are_Number_One.mid
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
Synpase/workspace/rostruct/cache/release_tags.json
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/.gitattributes
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/README.md
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/extension.toml
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/img/midi-folder.png
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/package.js
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/roblox.toml
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/selene.toml
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Assets/ScreenGui.rbxm
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/App.lua
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Controller.lua
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Preview.lua
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Sidebar.lua
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/FastDraggable.lua
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/FastTween.lua
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Input.lua
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/MIDI.js
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Song.lua
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/TaskScheduler.js
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Date.lua
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Maid.lua
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Promise.js
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Signal.lua
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/TableUtil.js
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Thread.lua
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/init.client.lua
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/init.meta.json
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
Synpase/workspace/zeeroxms2.json
Resource
win10-20230220-en
General
-
Target
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/roblox.toml
-
Size
158KB
-
MD5
b92a0b2989979674e12999026c4643f9
-
SHA1
a1d0285d8c0ac758dccf325238602922a0b83b86
-
SHA256
b77794f8888a54510809bc047e272c9635fbe64996e57cf83f2e98464cd5b0ef
-
SHA512
71d1aafb774c7f93a39e575f6913127fb9c5e6e385d7dc2b7969264a828398da4477650962dc7db420a1b8cd4dbf5028c8f3c961fb44e46ac2f52416749900c9
-
SSDEEP
3072:Fjnp8AfQk85AEnI0e0odPIIJgg5vJud8aeLvUQCgbHYlc2OgD89N:Fjnp8AfQkSAEnI0e0odPIIJgg5vJud9W
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4476 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Synpase\workspace\rostruct\cache\releases\richie0866-midiplayer-LATEST-ZIPBALL\roblox.toml1⤵
- Modifies registry class
PID:3160
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4476