05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256

Analysis

max time kernel
116s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2022, 12:37

Target

HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe
Size

104KB
MD5

b9c2b68d83fc3b348537e47cacaa7959
SHA1

f2fa509155e277f817aeab2d83c4d9fb3cb8febc
SHA256

05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256
SHA512

fa65cbbae72fe31156e12b04175b90f1ca4c8055ab383e8f4605404ce699ce0f59fd6a686f4e7787d0cdf3bb712b5b2bdc69f05352e73f2bbc41d6c6b7063f8f
SSDEEP

1536:HbTjlfjhJifmJytUc0vAaas4BCF5TycZ2iBpj6y994oJJC6WYNq7mr9fV7BimynB:7xjF7GsH5emTp4k/WYA7m/imynAa

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2028-135-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2028-137-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2028-138-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2028-140-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2028-142-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW TO RESTORE ENCRYPTED FILES.TXT	cvtres.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.dwt-qkc-48v	cvtres.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE ENCRYPTED FILES.TXT	cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87
PID 4460 wrote to memory of 2028	4460	HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe	87

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  2⤵
  - Drops startup file
  PID:2028

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\HEUR-Trojan.Win32.Generic-05e849afaf9291fb32caff88ea535c103660aa028d6d446ab0d2e97af5f7e256.exe.log

Filesize
313B

MD5
181f8ee43a58681f752dbbd9784192b2

SHA1
0f8f8bf12da0aba71899eb027d20c374d3c863af

SHA256
b87a19bc9d31616efc3ee1b3a5f8db72888ec82a9fd9cdc3b5d642f1de345e77

SHA512
42f7d9a88f003a3f6629648c120db7600dbd175c4b1bdb0240f6e76619566177c7a750a89ae38c97d746f13ee4bc5a6b39b7ab7f6d78fa4567e4a0b6b1a7f88d

Download Submit
memory/2028-135-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2028-137-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2028-138-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2028-140-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2028-142-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4460-133-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/4460-139-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download