File name:

wireless-network-watcher-2-26.exe

Full analysis: https://app.any.run/tasks/e86d8aff-5995-493f-8c1a-8aea9586fd78
Verdict: Malicious activity
Analysis date: October 05, 2022, 01:50:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

200DF21C545FE0D0A94BD278669CEECC

SHA1:

6E540E61BE110D1D63C8C0FE082EBD3027D3D5D6

SHA256:

275A0BBC74B1EBB6BD53E2BB18FDBB9E5F7162B47A944BDAF4D5B893B9EE3A0A

SSDEEP:

12288:O62OZlTXpVjtdzDH3yyRLYJshjbYSQceCkL94yIyadUF:O3oDVjLHHCyREm5bQce9p4yIy+UF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Drops executable file immediately after starts

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Application was dropped or rewritten from another process

      • WNetWatcher.exe (PID: 660)

  • SUSPICIOUS

    • Reads the computer name

      • wireless-network-watcher-2-26.exe (PID: 3980)
      • WNetWatcher.exe (PID: 660)

    • Checks supported languages

      • wireless-network-watcher-2-26.exe (PID: 3980)
      • WNetWatcher.exe (PID: 660)
      • cmd.exe (PID: 3752)

    • Executable content was dropped or overwritten

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Drops a file with a compile date too recent

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Creates a directory in Program Files

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Creates files in the user directory

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Creates files in the program directory

      • wireless-network-watcher-2-26.exe (PID: 3980)
      • WNetWatcher.exe (PID: 660)

    • Creates a software uninstall entry

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Uses IPCONFIG.EXE to discover IP address

      • cmd.exe (PID: 3752)

  • INFO

    • Manual execution by user

      • cmd.exe (PID: 3752)

    • Checks supported languages

      • ipconfig.exe (PID: 2480)

    • Reads the computer name

      • ipconfig.exe (PID: 2480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2008-May-03 14:08:42
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 208

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2008-May-03 14:08:42
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
22836
23040
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45687
.rdata
28672
4496
4608
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.17797
.data
36864
110488
1024
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.7025
.ndata
147456
36864
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
184320
16864
16896
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.93495

Resources

Title
Entropy
Size
Codepage
Language
Type
1
6.26612
4264
UNKNOWN
English - United States
RT_ICON
2
5.9993
3752
UNKNOWN
English - United States
RT_ICON
3
6.24459
2216
UNKNOWN
English - United States
RT_ICON
4
5.01502
1384
UNKNOWN
English - United States
RT_ICON
5
6.16057
1128
UNKNOWN
English - United States
RT_ICON
6
3.34146
744
UNKNOWN
English - United States
RT_ICON
7
3.04232
296
UNKNOWN
English - United States
RT_ICON
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start wireless-network-watcher-2-26.exe wnetwatcher.exe no specs cmd.exe no specs ipconfig.exe no specs wireless-network-watcher-2-26.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.exe"C:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.exe—wireless-network-watcher-2-26.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
Wireless Network Watcher
Exit code:
0
Version:
2.26
Modules
Images
c:\program files\nirsoft\wireless network watcher\wnetwatcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1300"C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe" C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\wireless-network-watcher-2-26.exe
c:\windows\system32\ntdll.dll
2480ipconfigC:\Windows\system32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
3752"C:\Windows\system32\cmd.exe" C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
3980"C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe" C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\wireless-network-watcher-2-26.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
1 093
Read events
1 090
Write events
3
Delete events
0

Modification events

(PID) Process:(3980) wireless-network-watcher-2-26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NirSoft Wireless Network Watcher
Operation:writeName:UninstallString
Value:
"C:\Program Files\NirSoft\Wireless Network Watcher\uninst.exe"
(PID) Process:(3980) wireless-network-watcher-2-26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NirSoft Wireless Network Watcher
Operation:writeName:InstallLocation
Value:
C:\Program Files\NirSoft\Wireless Network Watcher
(PID) Process:(3980) wireless-network-watcher-2-26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NirSoft Wireless Network Watcher
Operation:writeName:DisplayName
Value:
NirSoft Wireless Network Watcher
Executable files
4
Suspicious files
1
Text files
4
Unknown types
4

Dropped files

PID
Process
Filename
Type
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\readme.txttext
MD5:—
SHA256:—
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.exeexecutable
MD5:—
SHA256:—
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.chmchm
MD5:—
SHA256:—
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Local\Temp\nsd9F5F.tmp\ioSpecial.iniini
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Local\Temp\nsd9F5F.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Local\Temp\nsd9F5F.tmp\InstallOptions.dllexecutable
MD5:3809B1424D53CCB427C88CABAB8B5F94
SHA256:426EFD56DA4014F12EC8EE2E268F86B848BBCA776333D55482CB3EB71C744088
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Local\Temp\nsd9F5F.tmp\StartMenu.dllexecutable
MD5:8262FBC2A172FF04146E7587649D7091
SHA256:AC53840D019B746AB5DABAA40D7720C9A4487C861B155926454BF8B10BD0963D
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\uninst.exeexecutable
MD5:—
SHA256:—
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft Wireless Network Watcher\Wireless Network Watcher.lnklnk
MD5:—
SHA256:—
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft Wireless Network Watcher\Wireless Network Watcher Help.lnklnk
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
1.100.168.192.in-addr.arpa
  • —
unknown
2.100.168.192.in-addr.arpa
  • —
whitelisted
190.100.168.192.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wireless-network-watcher-2-26.exe