2f17f244be362f270aaa266d8bb050af33fc3abcafe7986fe30bfca4583436fd

Analysis

max time kernel
92s
max time network
35s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
23/04/2023, 00:28

Target

Tragamonedas/Tragamonedas/cfg/garage_5a.cfg
Size

2KB
MD5

5f59b958643afcb8c8a54cf6c7692f6a
SHA1

32cd7dfe5a6eae0912d79ea198a7493bc338efe3
SHA256

c98c0c013b684bd7338ee9066454ed34de978e19ec13c63a9e6d3328e4ef4224
SHA512

dae6ab3c5ab2fe463d906f181addc50df0456a50772aa4a0f1cde965a58d4d1016c39a3b764cd4a6ccd29926f87bea57b7042be37e419b7b163a5a9bb746b9cd

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1800	596	cmd.exe	29
PID 596 wrote to memory of 1800	596	cmd.exe	29
PID 596 wrote to memory of 1800	596	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\garage_5a.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\garage_5a.cfg
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact