2f17f244be362f270aaa266d8bb050af33fc3abcafe7986fe30bfca4583436fd

Analysis

max time kernel
107s
max time network
33s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
23-04-2023 00:28

Target

Tragamonedas/Tragamonedas/cfg/fcockt2.cfg
Size

2KB
MD5

b7f92cac23e41b9f513963160fef792e
SHA1

7e19eedcefab9f155ca1e780ba5b707a08b767f7
SHA256

495d5da502bdc14c395a985b6af32033bc07d8df7a6c616f5df62623d7922a11
SHA512

88a100115b9d2253b000eb6652a94ece7a9b4b6b53812b8508b35cb7403e22dafb6a06834484b0cf801b70439aa59afaeec5646e633ce31c5c043449cc7f1f25

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
536	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 536	1932	cmd.exe	29
PID 1932 wrote to memory of 536	1932	cmd.exe	29
PID 1932 wrote to memory of 536	1932	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\fcockt2.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\fcockt2.cfg
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:536

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact