ec0ec7ce8ef71cb7e7d1c2418c47ad94cea8833db8578ccdf94271f8efed38d3 | Triage

Analysis

max time kernel
150s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 14:41

Sharing

Report Analysis Logs

General

Target

winvnc.exe
Size

2.9MB
MD5

7cd339f9be1417421acf8790c9738922
SHA1

c25eff4d9d2d5b55f1cc4ffc623354004565e8b9
SHA256

ec0ec7ce8ef71cb7e7d1c2418c47ad94cea8833db8578ccdf94271f8efed38d3
SHA512

f118ea660a51ff38abc20a9ad16f6505cf8a862df1b564829d9af06710e0c4b91d0abbedc4b852696acf0e807a25138d82c2fc518cd54c32dba92f513467b411
SSDEEP

49152:vAOdl4d7NHNUb75uEEbOyYWHxL9X5zT/dPUAUA/JH:El8DFWHTN

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
876	winvnc.exe
876	winvnc.exe
876	winvnc.exe
876	winvnc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
876	winvnc.exe

C:\Users\Admin\AppData\Local\Temp\winvnc.exe
"C:\Users\Admin\AppData\Local\Temp\winvnc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UltraVNC.ini

Filesize
1KB

MD5
577ce0ab27002409212933ba6639530f

SHA1
316b8e6593833da0240bfd17f0e9109b6aed5ed2

SHA256
97e3e033477d2d063a9a4d4e823e30f25fbb4899a79db481bc02be653c57ab76

SHA512
b1a79c1f5540cdc2f257239ffc3d2f2ad15dfd1de89abdc056bb3d67209f119e820a9ec65cabbd701001d97c381b419ccbbcb121a801b6c861172055946cb185

Download Submit