2f17f244be362f270aaa266d8bb050af33fc3abcafe7986fe30bfca4583436fd

Analysis

max time kernel
139s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23/04/2023, 00:28

Target

Tragamonedas/Tragamonedas/cfg/keks_2b.cfg
Size

2KB
MD5

fab9022ca9e962f570070592696110bb
SHA1

fb07da8decd01bb6edcc3b2d4f98e3d67cb404b1
SHA256

449f0899aad4dc2726bfa0129513f5d7ead533fef0b0b107c20240581a2d99a3
SHA512

1c0946053d6219a5da9cc680fd0bfd583a2d038c7fae61372e6078f6654343c86fa037aea3cfe9ebc9ab652e98f8b002ffc17d87ab851f0fe78367d1e3e5d3ab

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4716	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tragamonedas\Tragamonedas\cfg\keks_2b.cfg
1⤵
- Modifies registry class
PID:2032

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact