2f17f244be362f270aaa266d8bb050af33fc3abcafe7986fe30bfca4583436fd

Analysis

max time kernel
102s
max time network
31s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
23/04/2023, 00:28

Target

Tragamonedas/Tragamonedas/cfg/keks_2b.cfg
Size

2KB
MD5

fab9022ca9e962f570070592696110bb
SHA1

fb07da8decd01bb6edcc3b2d4f98e3d67cb404b1
SHA256

449f0899aad4dc2726bfa0129513f5d7ead533fef0b0b107c20240581a2d99a3
SHA512

1c0946053d6219a5da9cc680fd0bfd583a2d038c7fae61372e6078f6654343c86fa037aea3cfe9ebc9ab652e98f8b002ffc17d87ab851f0fe78367d1e3e5d3ab

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1488	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1488	1748	cmd.exe	29
PID 1748 wrote to memory of 1488	1748	cmd.exe	29
PID 1748 wrote to memory of 1488	1748	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\keks_2b.cfg
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\keks_2b.cfg
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1488

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact