3bae281a122628561deb145beffcb3b2c1b8ab51e0c96818ef7a1203738af5d4

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22/05/2022, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WsIR1.1(1).exe
Size

844KB
MD5

c76aecc1eb0b47fc261a80b9fc06fb75
SHA1

242f3cce8400a77ed62c99fe6f56e1d8b7cfa5b4
SHA256

3bae281a122628561deb145beffcb3b2c1b8ab51e0c96818ef7a1203738af5d4
SHA512

492d70c438c1cc9f0156d4f411f5f81e0357d27bfbc65da91f6a532e1d3fe8f38b1d826c6a3740dc61251e0486cc81999628a6ce8e9ed4a9206e0c1675c51379

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WsIR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WsIR.exe"	WsIR1.1(1).exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	WsIR1.1(1).exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1684	WsIR1.1(1).exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1684	WsIR1.1(1).exe
1684	WsIR1.1(1).exe

C:\Users\Admin\AppData\Local\Temp\WsIR1.1(1).exe
"C:\Users\Admin\AppData\Local\Temp\WsIR1.1(1).exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads