Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-05-2022 06:11
Static task
static1
Behavioral task
behavioral1
Sample
WsIR1.1(1).exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
WsIR1.1(1).exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
WsIR1.1(1).exe
-
Size
844KB
-
MD5
c76aecc1eb0b47fc261a80b9fc06fb75
-
SHA1
242f3cce8400a77ed62c99fe6f56e1d8b7cfa5b4
-
SHA256
3bae281a122628561deb145beffcb3b2c1b8ab51e0c96818ef7a1203738af5d4
-
SHA512
492d70c438c1cc9f0156d4f411f5f81e0357d27bfbc65da91f6a532e1d3fe8f38b1d826c6a3740dc61251e0486cc81999628a6ce8e9ed4a9206e0c1675c51379
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WsIR1.1(1).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WsIR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WsIR.exe" WsIR1.1(1).exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
WsIR1.1(1).exehearts.exeFreeCell.exedescription ioc process File created C:\Users\Admin\Desktop\desktop.ini WsIR1.1(1).exe File opened for modification C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini hearts.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft Games\Hearts\desktop.ini hearts.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft Games\FreeCell\desktop.ini FreeCell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
WsIR1.1(1).exepid process 1792 WsIR1.1(1).exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1424 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1424 AUDIODG.EXE Token: 33 1424 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1424 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WsIR1.1(1).exepid process 1792 WsIR1.1(1).exe 1792 WsIR1.1(1).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WsIR1.1(1).exe"C:\Users\Admin\AppData\Local\Temp\WsIR1.1(1).exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe"C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe"1⤵
- Drops desktop.ini file(s)
-
C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe"C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe"1⤵
-
C:\Program Files\Microsoft Games\hearts\hearts.exe"C:\Program Files\Microsoft Games\hearts\hearts.exe"1⤵
- Drops desktop.ini file(s)
-
C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-62-0x000007FEF5040000-0x000007FEF5171000-memory.dmpFilesize
1.2MB
-
memory/1672-61-0x000007FEF4D50000-0x000007FEF4E81000-memory.dmpFilesize
1.2MB
-
memory/1792-54-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/1864-55-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmpFilesize
8KB