10a43796e911a7aa5b53111a7a91c30bb8b99539f46bd0e6a755fe55de819590

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
citizen/common/data/gta5_cache_y.dat
Size 1.1MB
Sample260730-e5mlbabg46
SHA256 10a43796e911a7aa5b53111a7a91c30bb8b99539f46bd0e6a755fe55de819590
MD5 d7fbc46dd2c50416ee638423af465d1b
SHA1 662d6582e41c82732f84fe81e4d7b3d463dbe409
SHA512 6a475b8cd831bed5a6a8a7a7bc623015f73f412d197b70266643f62802995761ce7ffc63f8376f08fe837a597a4def701247c934d2e5f8eb1878f675faddf620
SSDEEP 12288:jingcRtteSbkIpdQy5xhRBdBNpiwWWH0FLFS1tYvv+rWlvVxAU6zqo92wmGgfaNX:jiFN0kxhJgLFmtavR5nAfzqtn4aU
TLSH
T16635CF7BF3D20DF3F4D4AA7CD8893B59C115F676A7A685F3058D1E1D0A2E1E98A30428
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\citizen\common\data\gta5_cache_y.dat
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads