Analysis
-
max time kernel
136s -
max time network
169s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
01-04-2023 06:49
General
-
Target
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Maid.lua
-
Size
3KB
-
MD5
f7a648f108a89e24a7a988cb77dfb589
-
SHA1
6c2e89d4b90e56eb33f86eb6a8a2acba0170c162
-
SHA256
e59b66fc1b03c9bf30b4811417d000e1196dc582495ac5d35f2c639bf8a5385e
-
SHA512
31912937b216d6f17011627d0cf0ec6ff976be460a7cd30e19a8de379b4f24b7342c2f6cdaf373c72741c9964f79ecc9974ced6a471bc86a77efbf9c2a96b998
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Synpase\workspace\rostruct\cache\releases\richie0866-midiplayer-LATEST-ZIPBALL\src\Util\Maid.lua1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx