3bae281a122628561deb145beffcb3b2c1b8ab51e0c96818ef7a1203738af5d4

Analysis

max time kernel
145s
max time network
142s
platform
windows7_x64
resource
win7-20220414-en
submitted
22/05/2022, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WsIR1.1(1).exe
Size

844KB
MD5

c76aecc1eb0b47fc261a80b9fc06fb75
SHA1

242f3cce8400a77ed62c99fe6f56e1d8b7cfa5b4
SHA256

3bae281a122628561deb145beffcb3b2c1b8ab51e0c96818ef7a1203738af5d4
SHA512

492d70c438c1cc9f0156d4f411f5f81e0357d27bfbc65da91f6a532e1d3fe8f38b1d826c6a3740dc61251e0486cc81999628a6ce8e9ed4a9206e0c1675c51379

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WsIR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WsIR.exe"	WsIR1.1(1).exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	WsIR1.1(1).exe
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	hearts.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\Hearts\desktop.ini	hearts.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\FreeCell\desktop.ini	FreeCell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1792	WsIR1.1(1).exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1424	AUDIODG.EXE
Token: 33	1424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1424	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1792	WsIR1.1(1).exe
1792	WsIR1.1(1).exe

C:\Users\Admin\AppData\Local\Temp\WsIR1.1(1).exe
"C:\Users\Admin\AppData\Local\Temp\WsIR1.1(1).exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1684

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
"C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe"
1⤵
- Drops desktop.ini file(s)
PID:432

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
"C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe"
1⤵
PID:2044

C:\Program Files\Microsoft Games\hearts\hearts.exe
"C:\Program Files\Microsoft Games\hearts\hearts.exe"
1⤵
- Drops desktop.ini file(s)
PID:1672

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe"
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-62-0x000007FEF5040000-0x000007FEF5171000-memory.dmp

Filesize
1.2MB

Download
memory/1672-61-0x000007FEF4D50000-0x000007FEF4E81000-memory.dmp

Filesize
1.2MB

Download
memory/1792-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1864-55-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download