de69286d51e06c81c48506e385157debfcc51829914e49f46d4a98fd3b9296ac

Analysis

max time kernel
364s
max time network
428s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
08/01/2023, 00:16

Target

TGN_X_V5.8.0_Full_Release.rar
Size

22.4MB
MD5

35c13bc670c993041fdbf339250a8226
SHA1

ed8552a4aec0e87d5be9e32b79861db579a53042
SHA256

de69286d51e06c81c48506e385157debfcc51829914e49f46d4a98fd3b9296ac
SHA512

64f9492247b329ef38d27952eab53024fe6afcddc87b2c2187e7ec33da72aaa94c00382e185beafcf15d6c4cd26bc974ed650161d885393c75db69c347eff89a
SSDEEP

393216:iA+nZFIZsI2F6VT9va76rVhdKbdE3kJS8GKSes/IEuUvmwQoaqF0mAoX6OOGYJsQ:i9nZFOsK07QbdoW3n8GKS/cJHhDBoXfm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
384	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TGN_X_V5.8.0_Full_Release.rar
1⤵
- Modifies registry class
PID:4564

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact