259da693dd39c3d1b5405506769698d3c3e3ca6262396f7d2558ad326de72a8f

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2023 06:58

Target

GTA 5 - Stutter Fix/Copy All These into Game Directory/gpu_simulator.fkr
Size

314KB
MD5

683a0378279bfd010ace4b79176d59b8
SHA1

c67f0a4807417dc8f9eb00269990f7277802416d
SHA256

35a74516c3a33ed44a0131e5eb75c5c180a24e3157f386cc8b611090f7c63f18
SHA512

351e3dde797839cc06b86cc887e566d682cdd566dfdb993307380efdc3e37954e877f4fefceba73622a34dc39060f0dfd154ea3e5b7ace1a22a93aba8ede4c52
SSDEEP

6144:Ucxawg0klBbyoKz9Fg98KwxYozV3jVjV+b2F23GjnWyINlkZTfOA:UcxawJ2BuoKpqdwxvz/YyFdjnWLv0TfT

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3524	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\GTA 5 - Stutter Fix\Copy All These into Game Directory\gpu_simulator.fkr"
1⤵
- Modifies registry class
PID:2152

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact