Overview

overview

8

Static

static

3

LuaTools-w...up.exe

windows10-2004-x64

8

LuaTools-w...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    108s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LuaTools-win-Setup.exe
  • Size 10.9MB
  • Sample260709-ejgsyadt3z
  • SHA256 3b44f4ecaf1a9a6d86c0a6691035159d4156c7a14dfdca976aacafa1aa044c5d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
      "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe" --veloapp-install 1.1.0
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4844
    • C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
      "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4620
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2956
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2948
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CommunityToolkit.Mvvm.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\CommunityToolkit.Mvvm.dll
        • Size 143KB
        • SHA256 19b2144fed9600d58a742a5a4a5fd7b10d4d0d2c2e79f5d8019307cf5657044f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.deps.json
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.deps.json
        • Size 36KB
        • SHA256 ffecde88f746ad3bb09e5caa552a5eace7640d88f2f48794342414327348c496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.dll
        • Size 736KB
        • SHA256 80428fbd1145a412ee496a3f6262fb4cac105c76a7a968dfd68c8f4a9e8ffb34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.exe
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
        • Size 242KB
        • SHA256 0031f20a61bab74a594c6867f1a3c8442e1cdeca5917b9db46f0b7dfcec1b37a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LuaTools.runtimeconfig.json
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.runtimeconfig.json
        • Size 582B
        • SHA256 545cf61b0e7c5672e3da3db0945c85b28c2dc3d453c649b793c6271b26cab521
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft.Extensions.Configuration.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Abstractions.dll
        • Size 26KB
        • SHA256 3700bf75d75ceef47ebd6df7df9bafb9f7b7dcf22fc537f227db72ccf74c476d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.Binder.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Binder.dll
        • Size 41KB
        • SHA256 efc13893ebfa02cc7e49ac13cfef68517c4441a33210d67956e7488b8e6b277d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.CommandLine.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.CommandLine.dll
        • Size 23KB
        • SHA256 a1c8c9728b0dc64dcd975f82d013a1b7bc0c0133e46a94f29044f16cad6072b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.EnvironmentVariables.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
        • Size 21KB
        • SHA256 bbb26aacd4ba67351d3740106bbcc5544827d98d91b48109362988147ae7963e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.FileExtensions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.FileExtensions.dll
        • Size 26KB
        • SHA256 1830c601c1b155c54fbd3a6844453dae87af14eafe763942939d06905035130f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.Json.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Json.dll
        • Size 25KB
        • SHA256 e106f8bc13df7168294b95a6cdbceaba47b8eb7e562940eb4ef038db6fb1f2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.UserSecrets.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.UserSecrets.dll
        • Size 24KB
        • SHA256 a310bcdd868dafc0efce5b03a68cd7af5d4fa0d06509ed4b5c51ddc1758e9791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Configuration.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.dll
        • Size 42KB
        • SHA256 7a883c57d00808ca9b5d11bfaa2c5d21f714ed7560e781d7313d65b09b88b6c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.DependencyInjection.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.Abstractions.dll
        • Size 63KB
        • SHA256 c2a34d5259e6d6c0af43d9b926454105e80e7657dfed901d845100db254de89b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.DependencyInjection.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.dll
        • Size 92KB
        • SHA256 4d7fb7b6a171047984a8316b1a355c65e33350c343f4e0ea2f1233be457eb7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Diagnostics.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.Abstractions.dll
        • Size 29KB
        • SHA256 0a9e51f2d4861367908fa058da82b4a0deb6f85f6ba11d3c90b01c848b1fcdac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Diagnostics.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.dll
        • Size 34KB
        • SHA256 0842e20c25240aca53809e005776eb88f53a61128c632c4c6fa8685b9f66c4b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.FileProviders.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Abstractions.dll
        • Size 21KB
        • SHA256 02f38beb848fa01fcc55f0cf3982ca01e1a5aeba95933131a197ef602a130763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.FileProviders.Physical.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Physical.dll
        • Size 43KB
        • SHA256 e6073f96262a3c468c5024564fa02df0f36234242b392c8b658b81bb1b9d968a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.FileSystemGlobbing.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileSystemGlobbing.dll
        • Size 45KB
        • SHA256 965a5347b125d232361dd08027ab263ed1d042b0240ec4a4f29b7a0bfd74bb28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Hosting.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.Abstractions.dll
        • Size 51KB
        • SHA256 57c2528e1f2b3872976661686af9bcbd0612de7ee6b4ef4cfe92b746b27aa1b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Hosting.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.dll
        • Size 69KB
        • SHA256 ca135e4b48abc2effdb6fdf085837966c35f3a8a305744429009dde946d633c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Abstractions.dll
        • Size 64KB
        • SHA256 4ad4a3b2bed7f5f293f83cc2c46169b93a9863b89428f693a4f17863704f47aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Configuration.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Configuration.dll
        • Size 26KB
        • SHA256 ed0a70f939dc8779ee85802e926f138e284828ac14d44831ca68fdcd14450b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Console.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Console.dll
        • Size 73KB
        • SHA256 84ca5528a45074f18ae4234956de55d238a65be39f914f88293732dfd3889a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.Debug.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Debug.dll
        • Size 19KB
        • SHA256 ec47584ec7344dbe9b3ec5740cf493a8dbf346e467d6855e24be33555db11983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.EventLog.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventLog.dll
        • Size 24KB
        • SHA256 f70b8392447817a4d44acd5785e0bc029a2844d5445e05b98d95b237443339db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.EventSource.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventSource.dll
        • Size 33KB
        • SHA256 665d5316f601ed6dd9daa6d7534610ca3a7aa40e4d117c079ffb118ea2179b2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Logging.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.dll
        • Size 49KB
        • SHA256 48bd4a0d323e0ae85fa0469779bb13e92c4600b0a49dad6bcb891047c5e17caf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Options.ConfigurationExtensions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.ConfigurationExtensions.dll
        • Size 21KB
        • SHA256 3057894505e37852ac77ba70007a6b075980be4da9c3afcdb7a37e62750bda1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Options.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.dll
        • Size 62KB
        • SHA256 4e767f3c0bf37199a83b8697fc9431d907fe39b5f2763f83381865c89ea6545d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Extensions.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Primitives.dll
        • Size 42KB
        • SHA256 b5e8630df19605fec639873b86bdff6f9d424db88d181bb36a0bd641558c18ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.DiagnosticSource.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Diagnostics.DiagnosticSource.dll
        • Size 187KB
        • SHA256 d28e247dc8b6af02968b65fe6aae25c2ee689d2007268375d63347aeac0bea6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.Pipelines.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.IO.Pipelines.dll
        • Size 75KB
        • SHA256 a3c80d0bb52e0f5afc73638cfe5dc25e3470e5fdc0311745aebc8a4d4cfcba35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.ProtectedData.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Security.Cryptography.ProtectedData.dll
        • Size 37KB
        • SHA256 ce7f4b80de12f227ac637915470c5b6b6a5d716456835caaa0b1600c3cbdcb6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encodings.Web.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Encodings.Web.dll
        • Size 64KB
        • SHA256 8839f3cdeabd22f5952c4673367ea41c921aeb0ea26e18fb23906e2cac08298b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Json.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Json.dll
        • Size 660KB
        • SHA256 bb53577c13ab01f397585e4bb642a1a89f1af91b70eb385c7c05b82b9b912605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Velopack.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Velopack.dll
        • Size 261KB
        • SHA256 b35698f5f66978d7bfd0ab12a2a2899f05912d9a1890d5e64c2dce9bacf2662f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wpf.Ui.Abstractions.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.Abstractions.dll
        • Size 7KB
        • SHA256 f504e30e37a74936ac14f14de4ac43c291cb3964eda71cdcdd61f27cf15cb9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wpf.Ui.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.dll
        • Size 6.3MB
        • SHA256 3466432f74d1d1224a55f71b8dec7b2913039e01ee32b7304fd9668fb76b797d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.EventLog.dll
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\runtimes\win\lib\net8.0\System.Diagnostics.EventLog.dll
        • Size 171KB
        • SHA256 59fb8f95e34b4dbc41422e801ca9456da5ab70508d773e42e2ce1c60de38a88f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sq.version
        • Path C:\Users\Admin\AppData\Local\LuaTools\current\sq.version
        • Size 534B
        • SHA256 a03c6f0ccf21ae821e2908074c4b127b7f85a251b29914372f6e2d764f50154f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LuaTools-1.1.0-full.nupkg
        • Path C:\Users\Admin\AppData\Local\LuaTools\packages\LuaTools-1.1.0-full.nupkg
        • Size 6.5MB
        • SHA256 fcef9e966686de12cd1824c6bfa0bd2c056b9d90803b97dd70e2b3d0a8369d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        velopack_LuaTools.log
        • Path C:\Users\Admin\AppData\Local\velopack\velopack_LuaTools.log
        • Size 871B
        • SHA256 43e45a989652ef8d30862b677e8ee748fa1e7ead68f47c0c104ee611a2251bdd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LuaTools.lnk
        • Path C:\Users\Admin\Desktop\LuaTools.lnk
        • Size 2KB
        • SHA256 d98e9475d9710e6b02035bacbf67e454ca929d98556b634ea9cbe5a650e4d791
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2948-186-0x0000020714890000-0x00000207148B0000-memory.dmp
        Download

        memory/2948-171-0x0000020702F10000-0x0000020702F30000-memory.dmp
        Download

        memory/2948-148-0x0000020702A60000-0x0000020702A80000-memory.dmp
        Download

        memory/2948-140-0x00000207001E0000-0x00000207002E0000-memory.dmp
        Download

        memory/2948-149-0x0000020704000000-0x0000020704100000-memory.dmp
        Download