Analysis
-
max time kernel
133s -
max time network
182s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
01-04-2023 06:49
General
-
Target
Synpase/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/init.client.lua
-
Size
151B
-
MD5
5f703c83c0784930290ef6483a8a54e4
-
SHA1
3c44daca9845384fdc62594c58be70a672fcb95b
-
SHA256
1078aa3122e28f12e4e9f0310d0697fe0e1cc1592b6fe0d20fe2214035d7afa6
-
SHA512
40945d1604317b6630612273cade2174783d4143194e7573fe869321fe70f567079471736b788819ab280a06c33acf6dd5aca10f034409c65a10997ef9d3a74d
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Synpase\workspace\rostruct\cache\releases\richie0866-midiplayer-LATEST-ZIPBALL\src\init.client.lua1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx