aec88e349dbac86d97dcd4b82f0e8eab389475fa87790052fc8b060f6f0d8408

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
898s
max time network
425s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
luajit-decomp025/jit/dis_arm.lua
Size 18KB
Sample260418-byb98aev9x
SHA256 aec88e349dbac86d97dcd4b82f0e8eab389475fa87790052fc8b060f6f0d8408
MD5 d88a1fe93c99df8ca0a20f464c80a0a1
SHA1 c761f5c72913e90a28c8bca0a6a77f3df1bfb546
SHA512 3087b52d4cfc512135090143cb5f17f99121ed3a1ab6d4e23b0b20f27331348246a6437036d22258d69042e39efd0a35b4c0c209b30eccca17b526f6e666ee38
SSDEEP 384:Tqvq43yvuwhUyapA729MqjAJ0RqJJjo8WSzdsxHVb8FydjKnqQkf:Tqvq43yGwhwA729dA2RqJJjo8WSqxHtZ
TLSH
T1D8922C246C26082DB217D2715CC72904FF3CA51BAACBF926724C94E06F1DA5E85FE67C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
328	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\luajit-decomp025\jit\dis_arm.lua
1⤵
- Modifies registry class
PID:3024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-1-0x0000020429A70000-0x0000020429B1F000-memory.dmp

Download

memory/3024-0-0x00000284307A0000-0x000002843084F000-memory.dmp