File name:

VNC-Viewer-7.7.0-Windows.exe

Full analysis: https://app.any.run/tasks/f5ce1713-fc45-4612-a0d4-9ae41a20354b
Verdict: Malicious activity
Analysis date: January 14, 2024, 15:37:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
vnc
policy
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C0E535279E6DD9719B3E6C61056B6985

SHA1:

E478432998C2033BC279A35E3A241ACDA8D1C765

SHA256:

7A3434FE3B26CA74B7B743BC195DBBECA3FB7CB56CCAF216C6BA39FAD0A334F8

SSDEEP:

98304:AvUyLBCdQ8EI/7mP09ANgcQTnzyaOisNAkHty4QJKYE6VFIMbz+oeW/xryZ4dG8s:bZRTXDXwihJGbK4D1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VNC-Viewer-7.7.0-Windows.exe (PID: 128)
      • msiexec.exe (PID: 2088)

    • VNCCLIENT has been detected (SURICATA)

      • vncviewer.exe (PID: 1984)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 2420)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2088)

    • Reads the Internet Settings

      • vncviewer.exe (PID: 1384)
      • vncviewer.exe (PID: 1984)

    • Application launched itself

      • vncviewer.exe (PID: 1384)

    • Connects to unusual port

      • vncviewer.exe (PID: 1984)

  • INFO

    • Reads the computer name

      • VNC-Viewer-7.7.0-Windows.exe (PID: 128)
      • msiexec.exe (PID: 2088)
      • msiexec.exe (PID: 2620)
      • vncviewer.exe (PID: 1984)
      • vncviewer.exe (PID: 1384)

    • Checks supported languages

      • VNC-Viewer-7.7.0-Windows.exe (PID: 128)
      • msiexec.exe (PID: 2088)
      • msiexec.exe (PID: 2620)
      • vncviewer.exe (PID: 1984)
      • vncviewer.exe (PID: 1384)

    • Create files in a temporary directory

      • VNC-Viewer-7.7.0-Windows.exe (PID: 128)
      • msiexec.exe (PID: 2088)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2088)

    • Application launched itself

      • msiexec.exe (PID: 2088)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2088)
      • vncviewer.exe (PID: 1984)
      • vncviewer.exe (PID: 1384)
      • msiexec.exe (PID: 2620)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1776)

    • Manual execution by a user

      • vncviewer.exe (PID: 1384)

    • Creates files or folders in the user directory

      • vncviewer.exe (PID: 1384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:11 12:32:35+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1190912
InitializedDataSize: 10396160
UninitializedDataSize: -
EntryPoint: 0x7b464
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 7.7.0.51227
ProductVersionNumber: 7.7.0.51227
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
CompanyName: RealVNC
FileDescription: VNC® Viewer Installer
FileVersion: 7.7.0 (r51227)
InternalName: vncviewer-installer
LegalCopyright: Copyright © RealVNC Ltd.
LegalTrademarks: RealVNC and VNC are trademarks of RealVNC Ltd and are protected by trademark registrations and/or pending trademark applications in the European Union, United States of America and other jurisdictions.
OriginalFileName: vncviewer-installer.exe
ProductName: VNC®
ProductVersion: 7.7.0 (r51227)
ProgramName: VNC® Viewer Installer
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start vnc-viewer-7.7.0-windows.exe no specs msiexec.exe no specs msiexec.exe vssvc.exe no specs msiexec.exe no specs vncviewer.exe #VNCCLIENT vncviewer.exe

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\AppData\Local\Temp\VNC-Viewer-7.7.0-Windows.exe" C:\Users\admin\AppData\Local\Temp\VNC-Viewer-7.7.0-Windows.exe—explorer.exe
User:
admin
Company:
RealVNC
Integrity Level:
MEDIUM
Description:
VNC® Viewer Installer
Exit code:
0
Version:
7.7.0 (r51227)
Modules
Images
c:\users\admin\appdata\local\temp\vnc-viewer-7.7.0-windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1384"C:\Program Files\RealVNC\VNC Viewer\vncviewer.exe" C:\Program Files\RealVNC\VNC Viewer\vncviewer.exe
explorer.exe
User:
admin
Company:
RealVNC
Integrity Level:
MEDIUM
Description:
VNC® Viewer
Exit code:
0
Version:
7.7.0 (r51227)
Modules
Images
c:\program files\realvnc\vnc viewer\vncviewer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
1776C:\Windows\system32\msiexec.exe /i C:\Users\admin\AppData\Local\Temp\vnc32.msi ProductLanguage=1033C:\Windows\System32\msiexec.exe—VNC-Viewer-7.7.0-Windows.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1984"C:\Program Files\RealVNC\VNC Viewer\vncviewer.exe" -child 23.148.232.36:6070 -hash bb9946d014521d4c0a78380bc5524cd87fd88af24727d6443183697b8f2fbc31 -sid S-1-5-21-1302019708-1500728564-335382590-1000 RealVNC.admin.vncviewer.launchpipe.316303053C:\Program Files\RealVNC\VNC Viewer\vncviewer.exe
vncviewer.exe
User:
admin
Company:
RealVNC
Integrity Level:
MEDIUM
Description:
VNC® Viewer
Exit code:
0
Version:
7.7.0 (r51227)
Modules
Images
c:\program files\realvnc\vnc viewer\vncviewer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2088C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2420C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2620C:\Windows\system32\MsiExec.exe -Embedding D9B75EC863B6DFA11731F5E9D0A3B6E9 E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
9 657
Read events
9 596
Write events
50
Delete events
11

Modification events

(PID) Process:(1776) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
73
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008543C5D72FB0D90164030000840D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
4000000000000000D1ABF1D82FB0D90164030000840D0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Enter)
Value:
4000000000000000D1ABF1D82FB0D90164030000840D0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Leave)
Value:
4000000000000000475C02D92FB0D90164030000840D0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Leave)
Value:
4000000000000000E57701DA2FB0D90164030000840D0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Leave)
Value:
4000000000000000E57701DA2FB0D90164030000840D0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
3
Suspicious files
12
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
128VNC-Viewer-7.7.0-Windows.exeC:\Users\admin\AppData\Local\Temp\vnc32.msi —
MD5:—
SHA256:—
2088msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2088msiexec.exeC:\Windows\Installer\e4dcd.msi —
MD5:—
SHA256:—
2088msiexec.exeC:\Program Files\RealVNC\VNC Viewer\SetupCache\VNC-Viewer-7.7.0-Windows-32bit.msi —
MD5:—
SHA256:—
2088msiexec.exeC:\Program Files\RealVNC\VNC Viewer\SetupCache\VNC-Viewer-7.7.0-Windows-32bit.msiKey —
MD5:—
SHA256:—
2088msiexec.exeC:\Windows\Installer\e4dd0.msi —
MD5:—
SHA256:—
2088msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{7a37521e-c90b-4eec-8b61-71900c583647}_OnDiskSnapshotPropbinary
MD5:7B9C3EFB0B381A64B799F8CF147D2213
SHA256:A6B159F61B3B2A1A7B0B52103725F458D2056F05576CFA3649D4435D0A24212F
2088msiexec.exeC:\Program Files\RealVNC\VNC Viewer\vncviewer.exeexecutable
MD5:7A16F4AC84A9109C3DF8E1CC5394E5DA
SHA256:9F974744355252FA5D89DE74FBC1B7B6472178547889115A3C92E34675C219CF
2088msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFC15AE2DBE5446F0A.TMPbinary
MD5:4FA8C14715B9E6C970EC86A43E13176D
SHA256:1AC63C54D6096416EFD1D7831A8482302450322005602AF0BA63B7F0C32A455A
2088msiexec.exeC:\Program Files\RealVNC\VNC Viewer\logmessages.dllexecutable
MD5:8DD2A1351EBC02B8156C48B1486076F6
SHA256:30EAAA98D0CE9CF2081C8B84BAA7863900AF47017D6D5BB7B093289A939B5983
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
15
DNS requests
1
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1384
vncviewer.exe
165.254.191.229:443
hb-c.services.vnc.com
NTT-LTD-2914
US
unknown
1984
vncviewer.exe
23.148.232.36:6070
—
—
—
unknown

DNS requests

Domain
IP
Reputation
hb-c.services.vnc.com
  • 165.254.191.229
unknown

Threats

PID
Process
Class
Message
1984
vncviewer.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] VNC negotiation was detected (ProtocolVersion message)
1984
vncviewer.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] VNC negotiation was detected (Server Security type - None)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VNC-Viewer-7.7.0-Windows.exe