Overview
overview
10Static
static
10Synapse X.zip
windows10-1703-x64
1Synpase/wo..._1.mid
windows10-1703-x64
1Synpase/wo...ia.mid
windows10-1703-x64
1Synpase/wo...ne.mid
windows10-1703-x64
1Synpase/wo...s.json
windows10-1703-x64
3Synpase/wo...ibutes
windows10-1703-x64
3Synpase/wo...DME.md
windows10-1703-x64
3Synpase/wo...n.toml
windows10-1703-x64
3Synpase/wo...er.png
windows10-1703-x64
3Synpase/wo...age.js
windows10-1703-x64
1Synpase/wo...x.toml
windows10-1703-x64
3Synpase/wo...e.toml
windows10-1703-x64
3Synpase/wo...i.rbxm
windows10-1703-x64
3Synpase/wo...pp.lua
windows10-1703-x64
3Synpase/wo...er.lua
windows10-1703-x64
3Synpase/wo...ew.lua
windows10-1703-x64
3Synpase/wo...ar.lua
windows10-1703-x64
3Synpase/wo...le.lua
windows10-1703-x64
3Synpase/wo...en.lua
windows10-1703-x64
3Synpase/wo...ut.lua
windows10-1703-x64
3Synpase/wo...IDI.js
windows10-1703-x64
1Synpase/wo...ng.lua
windows10-1703-x64
3Synpase/wo...ler.js
windows10-1703-x64
1Synpase/wo...te.lua
windows10-1703-x64
3Synpase/wo...id.lua
windows10-1703-x64
3Synpase/wo...ise.js
windows10-1703-x64
1Synpase/wo...al.lua
windows10-1703-x64
3Synpase/wo...til.js
windows10-1703-x64
1Synpase/wo...ad.lua
windows10-1703-x64
3Synpase/wo...nt.lua
windows10-1703-x64
3Synpase/wo...a.json
windows10-1703-x64
3Synpase/wo...2.json
windows10-1703-x64
3Analysis
-
max time kernel
33s -
max time network
182s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
01-04-2023 06:49
Behavioral task
behavioral1
Sample
Synapse X.zip
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Synpase/workspace/midi/Spooky_Scary_Skeletons_1.mid
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
Synpase/workspace/midi/Undertale_-_Megalovania.mid
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
Synpase/workspace/midi/We_Are_Number_One.mid
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
Synpase/workspace/rostruct/cache/release_tags.json
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/.gitattributes
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/README.md
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/extension.toml
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/img/midi-folder.png
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/package.js
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/roblox.toml
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/selene.toml
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Assets/ScreenGui.rbxm
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/App.lua
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Controller.lua
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Preview.lua
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Sidebar.lua
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/FastDraggable.lua
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/FastTween.lua
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Input.lua
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/MIDI.js
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Song.lua
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/TaskScheduler.js
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Date.lua
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Maid.lua
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Promise.js
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Signal.lua
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/TableUtil.js
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Thread.lua
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/init.client.lua
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/init.meta.json
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
Synpase/workspace/zeeroxms2.json
Resource
win10-20230220-en
General
-
Target
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Components/Controller.lua
-
Size
4KB
-
MD5
80a831ab6505bd61d6f798b314ec6c7b
-
SHA1
4956cb08df436f00f00112e915fc580bc6cbb460
-
SHA256
074d7c8738f6205add801ca30b3ebdbbc3059f10d8b7be1f66c8cb51ad84864d
-
SHA512
224b6ba45c86c4c95b8f2e11031f55ea80d030669cb5d9faf60c1c006d94824660fb66a248e6fb7250fc5581cc85fe9de9b6fc664bbb90da8179554749f4f751
-
SSDEEP
48:HBd+6nK8MK+ibvx2dErmTnZ2mRQx8Hd/BRcrm+mWZF2OFz2kOLUyjiyC8/uCklRY:h46KkUdEanZ26dfcL5WC8WCyhbiNA4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
OpenWith.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3824 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Synpase\workspace\rostruct\cache\releases\richie0866-midiplayer-LATEST-ZIPBALL\src\Components\Controller.lua1⤵
- Modifies registry class
PID:2568
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3824