55086166cc20b312b83b66ccdfc84c9166250e5c08a5dc626196f31df4257773

Analysis

max time kernel
149s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lua-language-server/script/vm/init.lua
Size 489B
Sample260807-ppnhsafh42
SHA256 55086166cc20b312b83b66ccdfc84c9166250e5c08a5dc626196f31df4257773
MD5 cfde65cbfe8f0f8395ac20689b13bdf6
SHA1 ba575cb3b2a25ea545661f36c5bd2a08df43af87
SHA512 0541e02743acc2c77b2b0aa2b68395d49900bd285116bcd1d217510a006ab655fef864736f491803e69e7080737e85ca180188912808099d0b96e6e08b69d344
TLSH
T182F07CE0C3C6DE2E322C0BC892BC4052EE02C000482096A0D1BBF1DCA4CBDE08327DB8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4180	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4820	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lua-language-server\script\vm\init.lua
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads