29cf266079de80dac853d1d7c5d4c83eadb1d6f9cd8733605414d66413fba31d

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 03:40

Target

TGMacro.exe
Size

811KB
MD5

5b0add532473a8b98e0196c02100e0ec
SHA1

117f9df4899f2e1f61495a9c2ca80fd8321b8ad9
SHA256

29cf266079de80dac853d1d7c5d4c83eadb1d6f9cd8733605414d66413fba31d
SHA512

07bea3d594c19243e4edc535dcfd7e6c398796c48b7fb5ee8fb8c33eb47c0b095045ce1bbdd9037e325ca8990227b18bdeaf6717a456eb64007743b11fc1d636
SSDEEP

6144:nn9zSMD2+54J9ooi1c0gymFEymFEymFEymFEymFixWr4ymJ+T:nn9154J9oB1FLsssszMrTV

Score

1^/10

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TMacroProjectFile\shell\open	TGMacro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TMacroProjectFile\shell\open\command	TGMacro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TMacroProjectFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TGMacro.exe\" \"%1\""	TGMacro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tmacroproj	TGMacro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tmacroproj\ = "TMacroProjectFile"	TGMacro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TMacroProjectFile	TGMacro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TMacroProjectFile\ = "TGMacro Project File"	TGMacro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TMacroProjectFile\shell	TGMacro.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	TGMacro.exe

memory/2760-0-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/2760-1-0x0000000000840000-0x0000000000910000-memory.dmp

Filesize
832KB

Download
memory/2760-2-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/2760-3-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2760-4-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2760-5-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2760-6-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download