8ad8226debd1a25d3f53396ab2dcce57bdc435c55a73bea3d0adf3bbb2a0940d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lua-language-server/script/vm/operator.lua
Size 14KB
Sample260807-ppnhsafh42
SHA256 8ad8226debd1a25d3f53396ab2dcce57bdc435c55a73bea3d0adf3bbb2a0940d
MD5 d645ccb8b17ec9809bed3f146b69d49b
SHA1 d47ed284730999848981ce62049cfcaea3d4b85e
SHA512 c811eab9ab9dd2f6b99e7a2c3ea0bfd290685af219f1ee76d9219cf19843d6de996cf3810c79dfe4281e8e4c4e1e2b9f71fc752c3db63d3a6ba3c814d9353c0a
SSDEEP 192:Mdwmc70uHIk300PjJN3InvJVWPVOEqIwea+Pvi1:MdPTuHIkh3yv8wea6i1
TLSH
T11262E157594A50362C7BC7EA8D9B0802D50101338A6C5C5EF5FC49907FB1F2EE2F9B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1392	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lua-language-server\script\vm\operator.lua
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads