f2bbb460ddfb1a53d58969a666412307535f952dd28c0b056ee30bd18c606701

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2023 17:26

Target

TGN X V6.0.6 - Microsoft Store/TGN EXPLOIT X.pdb
Size

139KB
MD5

8fdaa0e0dd6c50ab9737c1365eb174d2
SHA1

6e99e9698cc514017f218bea3df470bd98eba365
SHA256

3605e1af22e875918d0135e61042b2713fa0492ae206cee6f29d17acdd41a03b
SHA512

3de50ca187c1663ee92c20146266aaae2aff26125af48f57eb49b46bf1be9550d9c4e19c8d09e6cd44879f96a335c51d0e43d96d5e6d40f17c5d2b7b748c2acd
SSDEEP

768:El+/x+/k5jDM1Zd/DeSo462F40ieY/S84ExxrgTaUrfH07YjI24qaIUecd2tci0g:cs/R4dbIYjI2xUPd2zRCmeZ/Cd2m

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\TGN X V6.0.6 - Microsoft Store\TGN EXPLOIT X.pdb"
1⤵
- Modifies registry class
PID:4160

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact