5fcee9da2e237df74b7c2619bde63db40c92c2e6c51bd483c86f83dcdfde1eab

Analysis

max time kernel
144s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/09/2024, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

hvnc_exec.exe
Size

438KB
MD5

7557af6f3185128c25aeb092dc335975
SHA1

f0866402529be2fdc0511305da069b69a8a35b8e
SHA256

5fcee9da2e237df74b7c2619bde63db40c92c2e6c51bd483c86f83dcdfde1eab
SHA512

de6375e57a674ac063aecd499d8b7ff01ebaaafb7352ce560a2468293b3d7f7b95a5ac53751728ef0578adcb5bf0518ce08f55cd7bd3edd1c13b0a4866301e9b
SSDEEP

6144:4hE8FrC1mJDf1nkhf2TO1WGf+CXhJyBl6mVLdWYrS+ZbHegrrHW3JkGYhtoLQvlN:1mHmEOQGZv+Zb33HMYHoLQrdQq

Score

6^/10

execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\hvnc_exec = "C:\\Users\\Admin\\AppData\\Roaming\\hvnc_exec.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4156	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4156	powershell.exe
4156	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	hvnc_exec.exe
Token: SeDebugPrivilege	4156	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4156	2868	hvnc_exec.exe	80
PID 2868 wrote to memory of 4156	2868	hvnc_exec.exe	80

C:\Users\Admin\AppData\Local\Temp\hvnc_exec.exe
"C:\Users\Admin\AppData\Local\Temp\hvnc_exec.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'hvnc_exec';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'hvnc_exec' -Value '"C:\Users\Admin\AppData\Roaming\hvnc_exec.exe"' -PropertyType 'String'
  2⤵
  - Adds Run key to start application
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e1zuuajk.433.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2868-27-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-51-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-10-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-20-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-63-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-61-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-67-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-65-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-59-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-57-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-55-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-53-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-0-0x00007FF823CB3000-0x00007FF823CB5000-memory.dmp

Filesize
8KB

Download
memory/2868-49-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-47-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-43-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-42-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-39-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-37-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-35-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-33-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-31-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-2-0x000000001AE30000-0x000000001AF0C000-memory.dmp

Filesize
880KB

Download
memory/2868-29-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-12-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-25-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-22-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-23-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/2868-18-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-16-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-14-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-45-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-8-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-3-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-6-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-4-0x000000001AE30000-0x000000001AF06000-memory.dmp

Filesize
856KB

Download
memory/2868-6260-0x00007FF823CB3000-0x00007FF823CB5000-memory.dmp

Filesize
8KB

Download
memory/2868-6261-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/2868-1-0x00000000001F0000-0x0000000000264000-memory.dmp

Filesize
464KB

Download
memory/2868-6279-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/2868-6278-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/4156-6272-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/4156-6273-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/4156-6274-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/4156-6277-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download
memory/4156-6270-0x0000020AF7360000-0x0000020AF7382000-memory.dmp

Filesize
136KB

Download
memory/4156-6271-0x00007FF823CB0000-0x00007FF824772000-memory.dmp

Filesize
10.8MB

Download