21d04c62e49ca21daf3f98fa503edb61cee610ebd185e0b34cac4ba44638db19

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 17:52

Target

vnc-4_1_3-x86_win32.exe
Size

724KB
MD5

790856e8ae34f0ac3eb40e031cf7a47a
SHA1

fb500f585127ae25c3a5d2153d0740c2ac6fd946
SHA256

21d04c62e49ca21daf3f98fa503edb61cee610ebd185e0b34cac4ba44638db19
SHA512

e58f42cef0a515c1a4ae922af15ebc06bcd46e36607c5092e6811a97766dff04869c802368a5cfc290886972634de0024e31b93ac26aa7b6ca08ad4e08dd3110
SSDEEP

12288:E2UtLvkQcEYXOmVNEfTC21h9vEwhy0wsiqHElPScqKvnY3QyunoYcS5KB:E2UpCEYXVVmbC21hZ8psi7l8YaXas

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

vnc-4_1_3-x86_win32.tmp

pid process

4944 vnc-4_1_3-x86_win32.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4944	vnc-4_1_3-x86_win32.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

vnc-4_1_3-x86_win32.exe

description	pid	process	target process
PID 1128 wrote to memory of 4944	1128	vnc-4_1_3-x86_win32.exe	vnc-4_1_3-x86_win32.tmp
PID 1128 wrote to memory of 4944	1128	vnc-4_1_3-x86_win32.exe	vnc-4_1_3-x86_win32.tmp
PID 1128 wrote to memory of 4944	1128	vnc-4_1_3-x86_win32.exe	vnc-4_1_3-x86_win32.tmp

C:\Users\Admin\AppData\Local\Temp\vnc-4_1_3-x86_win32.exe
"C:\Users\Admin\AppData\Local\Temp\vnc-4_1_3-x86_win32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Users\Admin\AppData\Local\Temp\is-POTVP.tmp\vnc-4_1_3-x86_win32.tmp
"C:\Users\Admin\AppData\Local\Temp\is-POTVP.tmp\vnc-4_1_3-x86_win32.tmp" /SL5="$B0054,488918,53248,C:\Users\Admin\AppData\Local\Temp\vnc-4_1_3-x86_win32.exe"
2⤵
- Executes dropped EXE
PID:4944

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-POTVP.tmp\vnc-4_1_3-x86_win32.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-POTVP.tmp\vnc-4_1_3-x86_win32.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
memory/1128-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1128-145-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4944-144-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4944-146-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download