2f17f244be362f270aaa266d8bb050af33fc3abcafe7986fe30bfca4583436fd

Analysis

max time kernel
100s
max time network
35s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
23/04/2023, 00:28

Target

Tragamonedas/Tragamonedas/cfg/island2_3.cfg
Size

3KB
MD5

1d864a1c1ee0c48cb96f12df50814379
SHA1

42ff4c621a627626aaff7ab6a18b9237b4108b0b
SHA256

0353717385215624350d5dc64029b34cd4dfb9b2e9974fa830ef87e9342be4f9
SHA512

7af1c6f99416b2910adfb9667eed1b2f99e81caddd593dad1c2690c37e72266ac49f8a7e340a6cfa3aa41a9442c669df827630f3bd95abafa8c3aae034e698e0

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1780	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1780	948	cmd.exe	29
PID 948 wrote to memory of 1780	948	cmd.exe	29
PID 948 wrote to memory of 1780	948	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\island2_3.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\island2_3.cfg
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1780

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact