analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

wireless-network-watcher-2-26.exe

Full analysis: https://app.any.run/tasks/e86d8aff-5995-493f-8c1a-8aea9586fd78
Verdict: Malicious activity
Analysis date: October 05, 2022, 01:50:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

200DF21C545FE0D0A94BD278669CEECC

SHA1:

6E540E61BE110D1D63C8C0FE082EBD3027D3D5D6

SHA256:

275A0BBC74B1EBB6BD53E2BB18FDBB9E5F7162B47A944BDAF4D5B893B9EE3A0A

SSDEEP:

12288:O62OZlTXpVjtdzDH3yyRLYJshjbYSQceCkL94yIyadUF:O3oDVjLHHCyREm5bQce9p4yIy+UF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Drops executable file immediately after starts

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Application was dropped or rewritten from another process

      • WNetWatcher.exe (PID: 660)

  • SUSPICIOUS

    • Reads the computer name

      • wireless-network-watcher-2-26.exe (PID: 3980)
      • WNetWatcher.exe (PID: 660)

    • Checks supported languages

      • wireless-network-watcher-2-26.exe (PID: 3980)
      • WNetWatcher.exe (PID: 660)
      • cmd.exe (PID: 3752)

    • Executable content was dropped or overwritten

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Drops a file with a compile date too recent

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Creates files in the user directory

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Creates files in the program directory

      • wireless-network-watcher-2-26.exe (PID: 3980)
      • WNetWatcher.exe (PID: 660)

    • Creates a directory in Program Files

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Creates a software uninstall entry

      • wireless-network-watcher-2-26.exe (PID: 3980)

    • Uses IPCONFIG.EXE to discover IP address

      • cmd.exe (PID: 3752)

  • INFO

    • Checks supported languages

      • ipconfig.exe (PID: 2480)

    • Reads the computer name

      • ipconfig.exe (PID: 2480)

    • Manual execution by user

      • cmd.exe (PID: 3752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2008-May-03 14:08:42
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 208

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2008-May-03 14:08:42
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
22836
23040
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45687
.rdata
28672
4496
4608
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.17797
.data
36864
110488
1024
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.7025
.ndata
147456
36864
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
184320
16864
16896
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.93495

Resources

Title
Entropy
Size
Codepage
Language
Type
1
6.26612
4264
UNKNOWN
English - United States
RT_ICON
2
5.9993
3752
UNKNOWN
English - United States
RT_ICON
3
6.24459
2216
UNKNOWN
English - United States
RT_ICON
4
5.01502
1384
UNKNOWN
English - United States
RT_ICON
5
6.16057
1128
UNKNOWN
English - United States
RT_ICON
6
3.34146
744
UNKNOWN
English - United States
RT_ICON
7
3.04232
296
UNKNOWN
English - United States
RT_ICON
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start wireless-network-watcher-2-26.exe no specs wireless-network-watcher-2-26.exe wnetwatcher.exe no specs cmd.exe no specs ipconfig.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1300"C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe" C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
3980"C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe" C:\Users\admin\AppData\Local\Temp\wireless-network-watcher-2-26.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
660"C:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.exe"C:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.exe—wireless-network-watcher-2-26.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
Wireless Network Watcher
Version:
2.26
3752"C:\Windows\system32\cmd.exe" C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2480ipconfigC:\Windows\system32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 093
Read events
1 090
Write events
3
Delete events
0

Modification events

(PID) Process:(3980) wireless-network-watcher-2-26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NirSoft Wireless Network Watcher
Operation:writeName:UninstallString
Value:
"C:\Program Files\NirSoft\Wireless Network Watcher\uninst.exe"
(PID) Process:(3980) wireless-network-watcher-2-26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NirSoft Wireless Network Watcher
Operation:writeName:InstallLocation
Value:
C:\Program Files\NirSoft\Wireless Network Watcher
(PID) Process:(3980) wireless-network-watcher-2-26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NirSoft Wireless Network Watcher
Operation:writeName:DisplayName
Value:
NirSoft Wireless Network Watcher
Executable files
4
Suspicious files
1
Text files
4
Unknown types
4

Dropped files

PID
Process
Filename
Type
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft Wireless Network Watcher\Wireless Network Watcher Help.lnklnk
MD5:9E1233EB2A9F8199C5DFEACFD01B63FC
SHA256:23BB96911865029F19F7ADA3AD74B367721DC5BA55BB328CA54DBAC5876673B7
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.exeexecutable
MD5:F6276C30E665630197EF2E41660F7894
SHA256:472B1B596C78D66C424589E41772E2832AA8E94D493C2C855B4A25F40A6B337D
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft Wireless Network Watcher\Uninstall.lnklnk
MD5:2F9DF4439E3437F041557520A6DB1E24
SHA256:72DE22E917879B29188E67A0FBAA44244EC0375A1B82F1CFF2FD6B08A06CAA61
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Local\Temp\nsd9F5F.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft Wireless Network Watcher\Wireless Network Watcher.lnklnk
MD5:8E604DB1E570F68F4FC8E3696EC2EA66
SHA256:4E144D3BF50C43B1C4DF0C0B3DCA8CF71ACF5A7FFC3A213C7BC2918D35EBEA8D
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\WNetWatcher.chmchm
MD5:64C6254A9905A76F7420DD15E0DE88DD
SHA256:BC47E35B7DD4BBC0C14A1EB3EE7BF1DE6D7B2CE935C2E254553FFA02D3814E3C
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\readme.txttext
MD5:7D5318C937B217BDCAC8BBC9819E63F6
SHA256:4B14080749D871FB7C583379A18E4E43D49EE7DFF99455578F8CF72FBAFF8A93
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Local\Temp\nsd9F5F.tmp\InstallOptions.dllexecutable
MD5:3809B1424D53CCB427C88CABAB8B5F94
SHA256:426EFD56DA4014F12EC8EE2E268F86B848BBCA776333D55482CB3EB71C744088
3980wireless-network-watcher-2-26.exeC:\Program Files\NirSoft\Wireless Network Watcher\uninst.exeexecutable
MD5:9B1245031E8BB61B4AAFB875AD3021C8
SHA256:9B02EEA2C18F79FA62C13AC6950A2BD3E2BE2489974087A8B10C150FCCC4CA62
3980wireless-network-watcher-2-26.exeC:\Users\admin\AppData\Local\Temp\nso9F4F.tmpbinary
MD5:2AEEBD2AFEA375574573DA1209728D61
SHA256:14613B6D0CA80565E7EBDF734293B61E6B78D7783BCE0D7949A6347CDA9F1016
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
1.100.168.192.in-addr.arpa
  • —
unknown
2.100.168.192.in-addr.arpa
  • —
whitelisted
190.100.168.192.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
wireless-network-watcher-2-26.exe