ca2dbb3dd4f8594f67b16526f25b7da63151f84af8b084f0259d72dd4d1eaebf

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FC-26-Live-Editor-main/lua/auto_max_user_team_form_morale_sharpness.lua
Size 994B
Sample260912-vxgcbsfb29
SHA256 ca2dbb3dd4f8594f67b16526f25b7da63151f84af8b084f0259d72dd4d1eaebf
MD5 6983b0bc050f9b3ee8915179c0aebf85
SHA1 a7e3516989cd922907e76dbb1239582ea79af1ef
SHA512 0313e37420a13ac8c6c9b1b59c470a3afcf477b551897df3d1bc04aef5b0e8d40c6de9e2f77b9738092d768563cdd0ae57de174dee5d5de13ac54fd69765c018
TLSH
T1F911BA12515A0F7334ADDB1363D61506DF7941A300476320B6CE3DCC6BBC2AE53A3A6D
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3584	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3872	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FC-26-Live-Editor-main\lua\auto_max_user_team_form_morale_sharpness.lua
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads