d66577872ebf8ec7138102e46f35220fb823e502ece7a51b4989c961eb9549a3

Analysis

max time kernel
133s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 23:38

Target

TGN X/TGN EXPLOIT X_Secure/TGN EXPLOIT X.pdb
Size

89KB
MD5

aae5a9a897bd6426009ee9c404e71606
SHA1

3fdbc48c1f43b34380c6a1502c5ecf98b6bd14ca
SHA256

a8166948df4670f5177b3f808f299b84316c43e059ba085dce57dc477127c370
SHA512

ce9e57f0d1e77754b7037a3fb1435d980fb48c8f609000143c3b0478f656302054235f250e91c09a3b542230b62e5cdcb12ca7c2cd743a515e8b3f35c392d9ea
SSDEEP

1536:9IDPrvfO7zFcPHDIWfr/9X/ybqb4DBN63LnXDP4YWMB:SDvz/A+kB

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
884	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\TGN X\TGN EXPLOIT X_Secure\TGN EXPLOIT X.pdb"
1⤵
- Modifies registry class
PID:3124

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact