7e4070ca62251c07e24edfbe7610dc28763298f767a11cf17da9472f49e4012c

Analysis

max time kernel
63s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2023 14:11

Target

Citra-CXI-Maker-v1.1-20200616.7z
Size

606KB
MD5

3923f27b6f800622ffcd9f0a674420cc
SHA1

e778554f5f88dcd4af696bf69bc094322cf6bb84
SHA256

c80038ebad55d5a1b12bac2692bde7a8cd8dc971c974045b04e96423ce7a37a4
SHA512

c05134913e0bd502db904499e3f9d8ef806845a9404511282d3c80bd2012519b4295d6eac6dcf1a4ac805f4b8932fc8392cd9bc276a60f7b439c72799a46c665
SSDEEP

12288:EWNvYwQCBRzgS3r5jZ3qGTKgijDJn1aDqA+sd1d3z//hpHtNFAjELmhn1a/:EWB6CBRz33rVtTlONOqA+GZpHG1A

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3968	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Citra-CXI-Maker-v1.1-20200616.7z
1⤵
- Modifies registry class
PID:1000

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact