ff87d820baf913ae59727dab8579b9f2d349b95bfb78aebcfeeb91cbce8c6ce3

Resubmissions

27-02-2023 04:37

230227-e83rpsbf3s 8

27-02-2023 04:25

27-02-2023 04:20

27-02-2023 04:14

12-02-2023 12:22

Analysis

max time kernel
137s
max time network
149s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-02-2023 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

scripting/citra.py
Size

3KB
MD5

17029cc3a1237a2760c266823a8a3937
SHA1

face198755f58583cb86f23638d2308f30ced85d
SHA256

7fef07e4a7d6dcd0b203b6a35cf9f41463c6658bcf67e95ebcb4ca440c9be11e
SHA512

41f1624ab9119cfdfa4a223fe4794a110dc0bbfedf3424a777a35d94a80e801c33a61701dc5cac7615edfdfa15c5da8e3e3668189506f87b5cd9763f759d6cb2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2512 OpenWith.exe

pid	process
2512	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scripting\citra.py
1⤵
- Modifies registry class
PID:5044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads