1612334e56b6183cb258771733674044467f1d44e450d88d55f006a83a5b35b7

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2060160.lua
Size 263B
Sample260425-dclb4sdt61
SHA256 1612334e56b6183cb258771733674044467f1d44e450d88d55f006a83a5b35b7
MD5 2c95f618a452c8c621eef7205769b64f
SHA1 6b690718d786b73ddac953c7f5d42beb9be04748
SHA512 18a830ce8b056f6b8cc086590327ce636bb1dcdf9f18675769956b1f70a7fda4db8d8d84d7cb86f09bf966eaed5e57c92186d768ce993c80fd917f8a7064c2a6
TLSH
T1E1D02BE70F1CA51C53414EAD674B201277DE044A75CF20306CC672CD220D631DE5CC8C
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3088	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2060160.lua
1⤵
- Modifies registry class
PID:4884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3088-1-0x000001D17CF40000-0x000001D17CF71000-memory.dmp

Download

memory/4884-0-0x000001B0D18F0000-0x000001B0D1921000-memory.dmp