359f1986323fb89098109e3ad9f50a7a24eedc2252464695b8bf18e9a935f976

Analysis

max time kernel
90s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85c62afc096c6b60c29365ea585772a2.exe
Size

430KB
MD5

85c62afc096c6b60c29365ea585772a2
SHA1

142fa064605cb35dc4b8813fc5495bb2d9d758b3
SHA256

359f1986323fb89098109e3ad9f50a7a24eedc2252464695b8bf18e9a935f976
SHA512

1bad1997128e43bd32f268d96b21198dd05fd8781f06ab0c53999f34f1b4d4bf2f153063f54b0c2e4aece1a2cecbf7a3433778e65b872bda67cf724dfd75835d
SSDEEP

12288:k3psRRozCi7GeMK7kW6a7uGR2NhNnQdJD4Mp1xQWGIyZLbaiGUf:spsjoui7G7K7V7uGR2N3Qd9DQWpyFaQ

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
792	winvnc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4668-0-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/4668-46-0x0000000000400000-0x000000000048A000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4668-46-0x0000000000400000-0x000000000048A000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe
4668	85c62afc096c6b60c29365ea585772a2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 2280	4668	85c62afc096c6b60c29365ea585772a2.exe	85
PID 4668 wrote to memory of 2280	4668	85c62afc096c6b60c29365ea585772a2.exe	85
PID 4668 wrote to memory of 2280	4668	85c62afc096c6b60c29365ea585772a2.exe	85
PID 2280 wrote to memory of 1352	2280	cmd.exe	86
PID 2280 wrote to memory of 1352	2280	cmd.exe	86
PID 2280 wrote to memory of 1352	2280	cmd.exe	86
PID 2280 wrote to memory of 4972	2280	cmd.exe	87
PID 2280 wrote to memory of 4972	2280	cmd.exe	87
PID 2280 wrote to memory of 4972	2280	cmd.exe	87
PID 2280 wrote to memory of 792	2280	cmd.exe	88
PID 2280 wrote to memory of 792	2280	cmd.exe	88
PID 2280 wrote to memory of 792	2280	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\85c62afc096c6b60c29365ea585772a2.exe
"C:\Users\Admin\AppData\Local\Temp\85c62afc096c6b60c29365ea585772a2.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\find.exe
    find "Version 6."
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.exe
    winvnc.exe
    3⤵
    - Executes dropped EXE
    PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\helpdesk.txt

Filesize
2KB

MD5
c5d79b73d56dd2f4f35163b3cd174eb0

SHA1
f832ca036248c2dd2725b403cd37d59957e1306f

SHA256
7c1707f84643f813998537749ae64aa0c45f7ce857fabb2a08839895d1cee5fa

SHA512
2ad94e3d264b5298d137b10335f5fcb8053698f3a4db7b7e3da06ba7840cd393254eb8d3aa0aff3ed587b64643f482dc4152924a98af82bfe12fbfddf2241f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\logo.bmp

Filesize
84KB

MD5
a10eed94507ffe310eda8a1b32ff241d

SHA1
75612441d20751d8b98bfcc1b3ce8a76e73d7870

SHA256
8b39f539e91f99e4c80eed340d29dc264c90760e39f07f86c7ca7fa9c473d6a3

SHA512
c6de9567b641c4a05ab1b7f5832ed7cab55b9cf2a038c873da2088f6fb327e7657c375110e4ba6659eaad4f6ffc0384d3789e8ce929c9deb9af5b6920056d1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.cmd

Filesize
3KB

MD5
711bbca9abd1f9d3097b8faabd754e68

SHA1
66346488e22002d35c3769c6f0d52f5fa46b4921

SHA256
5dc1989e54e65d26d798ddfdd81156dd6fe62da059a52f15424cab97ef6292e9

SHA512
9d5b30e1c36df572284d2687feca795ccdb8eba4944b21a1c650c330e75afafa4771559ff77eacb0a35e419ab666d1cd541e224ee4b21116d130dff7c6ebf56d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SC_VNC_Temp_Files\winvnc.exe

Filesize
244KB

MD5
1cc077ecea12e9b484112d897da74a3b

SHA1
7fef071f41ddd1895b2723f9a526f53b6cd681c7

SHA256
db904b423b5b4b0a15a8c39851449a7f2a8271f318374ce2d6618cfab07b096f

SHA512
6cfc612f34170fc409969fff8f2ad3352b71c9d06c389276d0d7f01fcd3e4684c6016c7860fed6d020ad9713aaf86a9076719189047b8cf3e0d0d054718c23e4

Download Submit
memory/4668-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4668-46-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download