21b3665f3ad36166dad8a1b8494f74761f498d463a828e896e696e215cbbaab3

Analysis

max time kernel
302s
max time network
1537s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05-07-2024 03:07

Target

GTA5TunersGenZ 5.32/donottrace.txt
Size

104B
MD5

a2e60a2f01f69d0da415c58f25c37e5b
SHA1

fa1a0d6183fee10de5fa4c554370556217e3af26
SHA256

dc9354ccf9667d1e5ca13d6468ba2c258256042d7c25e6d91ade7f8e2a2ff3bf
SHA512

ce7f5f8365d2ef3da14d4123cc7ef053a7f99e8f98d47e6c5967f267b8ec7fdac2da993d0fc26df8eb2face176ba56b7359ba1f29f021e1dfdd561b15efe64af

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2608496357-2693146533-2740208290-1000_Classes\Local Settings cmd.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1584 wrote to memory of 4200 1584 cmd.exe NOTEPAD.EXE
PID 1584 wrote to memory of 4200 1584 cmd.exe NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2608496357-2693146533-2740208290-1000_Classes\Local Settings	cmd.exe

description	pid	process	target process
PID 1584 wrote to memory of 4200	1584	cmd.exe	NOTEPAD.EXE
PID 1584 wrote to memory of 4200	1584	cmd.exe	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\GTA5TunersGenZ 5.32\donottrace.txt
2⤵
PID:4200

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance