Overview
overview
7Static
static
7TGN X V6.0...re.rar
windows7-x64
3TGN X V6.0...re.rar
windows10-2004-x64
3TGN X V6.0...GN.txt
windows7-x64
1TGN X V6.0...GN.txt
windows10-2004-x64
1TGN X V6.0...xe.xml
windows7-x64
1TGN X V6.0...xe.xml
windows10-2004-x64
1TGN X V6.0... X.pdb
windows7-x64
3TGN X V6.0... X.pdb
windows10-2004-x64
3TGN X V6.0...ax.xml
windows7-x64
1TGN X V6.0...ax.xml
windows10-2004-x64
1TGN X V6.0...er.txt
windows7-x64
1TGN X V6.0...er.txt
windows10-2004-x64
1TGN X V6.0...er.txt
windows7-x64
1TGN X V6.0...er.txt
windows10-2004-x64
1TGN X V6.0...nt.txt
windows7-x64
1TGN X V6.0...nt.txt
windows10-2004-x64
1TGN X V6.0...nt.txt
windows7-x64
1TGN X V6.0...nt.txt
windows10-2004-x64
1TGN X V6.0...ll.txt
windows7-x64
1TGN X V6.0...ll.txt
windows10-2004-x64
1TGN X V6.0...V2.txt
windows7-x64
1TGN X V6.0...V2.txt
windows10-2004-x64
1TGN X V6.0...el.txt
windows7-x64
1TGN X V6.0...el.txt
windows10-2004-x64
1TGN X V6.0...ol.txt
windows7-x64
1TGN X V6.0...ol.txt
windows10-2004-x64
1TGN X V6.0...ub.txt
windows7-x64
1TGN X V6.0...ub.txt
windows10-2004-x64
1TGN X V6.0...ub.txt
windows7-x64
1TGN X V6.0...ub.txt
windows10-2004-x64
1TGN X V6.0...V1.txt
windows7-x64
1TGN X V6.0...V1.txt
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
01-10-2023 17:26
Behavioral task
behavioral1
Sample
TGN X V6.0.6 - Microsoft Store.rar
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
TGN X V6.0.6 - Microsoft Store.rar
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
TGN X V6.0.6 - Microsoft Store/Solucion_errores_TGN.txt
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
TGN X V6.0.6 - Microsoft Store/Solucion_errores_TGN.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
TGN X V6.0.6 - Microsoft Store/TGN EXPLOIT X.exe.xml
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
TGN X V6.0.6 - Microsoft Store/TGN EXPLOIT X.exe.xml
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
TGN X V6.0.6 - Microsoft Store/TGN EXPLOIT X.pdb
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
TGN X V6.0.6 - Microsoft Store/TGN EXPLOIT X.pdb
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
TGN X V6.0.6 - Microsoft Store/bin/syntax.xml
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
TGN X V6.0.6 - Microsoft Store/bin/syntax.xml
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
TGN X V6.0.6 - Microsoft Store/bin/ver.txt
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
TGN X V6.0.6 - Microsoft Store/bin/ver.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
TGN X V6.0.6 - Microsoft Store/bin/ver/ver.txt
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
TGN X V6.0.6 - Microsoft Store/bin/ver/ver.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
TGN X V6.0.6 - Microsoft Store/scripts/Alt+Print.txt
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
TGN X V6.0.6 - Microsoft Store/scripts/Alt+Print.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
TGN X V6.0.6 - Microsoft Store/scripts/BloxHunt.txt
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
TGN X V6.0.6 - Microsoft Store/scripts/BloxHunt.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CBROKillAll.txt
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CBROKillAll.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CC Aimbot V2.txt
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CC Aimbot V2.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CTRL+Del.txt
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CTRL+Del.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
TGN X V6.0.6 - Microsoft Store/scripts/Click TP Tool.txt
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
TGN X V6.0.6 - Microsoft Store/scripts/Click TP Tool.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CocoHub.txt
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
TGN X V6.0.6 - Microsoft Store/scripts/CocoHub.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral29
Sample
TGN X V6.0.6 - Microsoft Store/scripts/Dark Hub.txt
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
TGN X V6.0.6 - Microsoft Store/scripts/Dark Hub.txt
Resource
win10v2004-20230915-en
Behavioral task
behavioral31
Sample
TGN X V6.0.6 - Microsoft Store/scripts/DexV1.txt
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
TGN X V6.0.6 - Microsoft Store/scripts/DexV1.txt
Resource
win10v2004-20230915-en
General
-
Target
TGN X V6.0.6 - Microsoft Store.rar
-
Size
17.6MB
-
MD5
b75b4b5704e663bc64e3d2e6f7fcc72b
-
SHA1
250fbc78e5d9ec2c0dacb39ba1a490e821bc9fed
-
SHA256
f2bbb460ddfb1a53d58969a666412307535f952dd28c0b056ee30bd18c606701
-
SHA512
04418c4faa964b9e1f371522d423d4a4aeb32e03a98f048473cb10edceda224e1ba8648febff564ce52cf4ec62b16cbf8f1e3664ec23731216e30ab14b8ba8b6
-
SSDEEP
393216:jfw5Ye/XtZHuwpaVhdKbdE3kJS8GKSesXn58xCkG1czf:U5/XtZHdMbdoW3n8GKSGeaT
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2672 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 vlc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2672 vlc.exe 2672 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2636 2008 cmd.exe 29 PID 2008 wrote to memory of 2636 2008 cmd.exe 29 PID 2008 wrote to memory of 2636 2008 cmd.exe 29 PID 2636 wrote to memory of 2672 2636 rundll32.exe 30 PID 2636 wrote to memory of 2672 2636 rundll32.exe 30 PID 2636 wrote to memory of 2672 2636 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\TGN X V6.0.6 - Microsoft Store.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TGN X V6.0.6 - Microsoft Store.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\TGN X V6.0.6 - Microsoft Store.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2672
-
-