General
- Target wnetwatcher_setup.exe
- Size 568KB
- Sample260628-ec33lae14v
- SHA256 2bc68f8823a76fae8ff360cbfcae2bcef7863305e0b700201ac7c0ea7c79f52f
Score
9/10
Malware Config
Targets
-
- Target wnetwatcher_setup.exe
- Size 568KB
- SHA256 2bc68f8823a76fae8ff360cbfcae2bcef7863305e0b700201ac7c0ea7c79f52f
Score7/10-
Loads dropped DLL
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 ac53840d019b746ab5dabaa40d7720c9a4487c861b155926454bf8b10bd0963d
Score3/10 -
- Target WNetWatcher.chm
- Size 27KB
- SHA256 4582303cdbf8ef07579c19c567a6ba04c7620aa35ecf553cd4489773681aba81
Score1/10 -
- Target WNetWatcher.exe
- Size 488KB
- SHA256 3295f058f7eb0ae972d078530a3003d48ca4df16f2538a73bce9497d0f688bf9
Score9/10-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target uninst.exe
- Size 46KB
- SHA256 cb20c7ff0d519038030763ceebac9136133ee69996c91055abd4db4239aef3b5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.