39e1780e7003dfbeb31a0b0c1d1c9c72c7eeaafa30cd1408757b9ceb56916e93 | Triage

Analysis

max time kernel
157s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 15:28

Sharing

Report Analysis Logs

General

Target

TKLord.exe
Size

128KB
MD5

38c8fa7c3ffa3b28dda7b3eb83d60d3b
SHA1

527ee22d5fa6997abf0cec31f4efc756bfecc0f3
SHA256

623cbe4ab3a3c1e1ed85cabf12eb0a8e3d52880e513ea92742356ecbf320f8a4
SHA512

9f14da3f1b4074c9d2170c607fa958db42d4d80fde3ae370c549656fa05e79c5e440e039057c4e5348fc416bb01be9370499fdcfe840c2466de86f27689c390e
SSDEEP

1536:CHGwpIKPQZP/l3biuTJX+iKcqbiuTJX+iKc:Cmwil3biuTJX+iKRbiuTJX+iK

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1048	TKGC.exe
1048	TKGC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1048	1616	TKLord.exe	90
PID 1616 wrote to memory of 1048	1616	TKLord.exe	90
PID 1616 wrote to memory of 1048	1616	TKLord.exe	90

C:\Users\Admin\AppData\Local\Temp\TKLord.exe
"C:\Users\Admin\AppData\Local\Temp\TKLord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\TKGC.exe
  C:\Users\Admin\AppData\Local\Temp\TKGC.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads