2f17f244be362f270aaa266d8bb050af33fc3abcafe7986fe30bfca4583436fd

Analysis

max time kernel
124s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23-04-2023 00:28

Target

Tragamonedas/Tragamonedas/cfg/fcockt_8.cfg
Size

2KB
MD5

e063e35cdb022f4ab0fcf1a06c9b1242
SHA1

1d9aaee26b70a166ef20155ce1b2b62fa139d7d8
SHA256

24362e3c24296f743ce767640bdf7b7123c9769f7796e7077eafc780109a9165
SHA512

1816edc0a4d2fd04bdd65b19184c920e6f6bc432f820a44163fb89a92c81148c6e359678b2d7138f10328da60ab3015a3637d23f4b8b06fbe6dba0b2a292c55c

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\fcockt_8.cfg
1⤵
- Modifies registry class
PID:532

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact