Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
01-04-2023 06:49
General
-
Target
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/selene.toml
-
Size
173B
-
MD5
d3fc0e116a36d7fe0354efaa66ce4722
-
SHA1
3d3942f888455bcf8f65806ff2ed831bf1d9e569
-
SHA256
7ab5e46ff74b730c13b2a920c7caca48cc678022f95aba5ed3fcfe060e36e9b5
-
SHA512
63b0f5962a736640376150c4ac03a4fc56b08f22d856fb82682529e096fab72877f291bebb52b35e844835eff1bae623e688d7f6bb26b3333368622a3abb53cb
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Synpase\workspace\rostruct\cache\releases\richie0866-midiplayer-LATEST-ZIPBALL\selene.toml1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx