99122719fc1e5666605b784e46fec867dc8dc36902e23c816c4ee747e76f678a

Analysis

max time kernel
138s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 08:39

Target

2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe
Size

7.8MB
MD5

ff2b2cbcb294fc5592e46eb078d4ceca
SHA1

8864789e094c11a9a3f8421b418198e76b3f62a5
SHA256

99122719fc1e5666605b784e46fec867dc8dc36902e23c816c4ee747e76f678a
SHA512

aa1b303bd82d7518a70e0082895ab757914a7955fa8fb17bd7370f1069b34094d8212a1cfd3610f7df4a30620f570c2334ee24e562983c1722d41213ca54c30d
SSDEEP

98304:J3op7ZAU5uTtBXhgYPBnqPDFDLEmG5Xj:J3oVZ/stdhpxqBDomG5z

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2296	tgp_daemon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3228	2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2296	3228	2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe	83
PID 3228 wrote to memory of 2296	3228	2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe	83
PID 3228 wrote to memory of 2296	3228	2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-29_ff2b2cbcb294fc5592e46eb078d4ceca_megazord.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\ProgramData\tgp_daemon.exe
  "C:\ProgramData\tgp_daemon.exe"
  2⤵
  - Executes dropped EXE
  PID:2296

C:\ProgramData\tgp_daemon.exe

Filesize
1.4MB

MD5
8fe874ed2eea302d1692b902f03e9fb9

SHA1
e6fee79bf92b88df25840cd760891fce1e4ff172

SHA256
112ac2470d42728e7f94dd65127c2af5c1c274462ae5be1671c3d67f7d4f75d8

SHA512
dffa9e03c3f1370b738a7e93022a5b909b059b242c1a5b0024559b8d0dcfd73e0ab5a0c122d21ec2937a095cdedc1302a40f265fa363292cbcaa1422711b8614

Download Submit