eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe
Size

48KB
MD5

97cac431f449341ebc8bce93d7a89228
SHA1

9dfd5550aa4b0f0c699372fc06334982a6b4fb08
SHA256

eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296
SHA512

50d609c43cb4aacd99db91cb98aed0a6072aa6c42a1393eabd8fb685bdd8487373720b59c5de41e599bdd1d6fe8f019e9ead8a8b49648adac2564421cc37c06c
SSDEEP

768:FEkxgX+7e1sKmiPcbWK2cvlvK+XFcr/rPF6IFRoPuuk5MR/7tfk1Fu7:KtWQsKpK2SvK+1ozd9nG/eu7

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
804	rwwnw64d.exe
3068	rwwnw64d.exe
2592	rwwnw64d.exe
612	rwwnw64d.exe
4928	rwwnw64d.exe
4896	rwwnw64d.exe
4916	rwwnw64d.exe
4216	rwwnw64d.exe
2736	rwwnw64d.exe
5004	rwwnw64d.exe
1328	rwwnw64d.exe
344	rwwnw64d.exe
3672	rwwnw64d.exe
3668	rwwnw64d.exe
5024	rwwnw64d.exe
3204	rwwnw64d.exe
1680	rwwnw64d.exe
2712	rwwnw64d.exe
1472	rwwnw64d.exe
4396	rwwnw64d.exe
3216	rwwnw64d.exe
4868	rwwnw64d.exe
4820	rwwnw64d.exe
4832	rwwnw64d.exe
5000	rwwnw64d.exe
1676	rwwnw64d.exe
4140	rwwnw64d.exe
728	rwwnw64d.exe
2988	rwwnw64d.exe
692	rwwnw64d.exe
4616	rwwnw64d.exe
4620	rwwnw64d.exe
2320	rwwnw64d.exe
4052	rwwnw64d.exe
1180	rwwnw64d.exe
4100	rwwnw64d.exe
4756	rwwnw64d.exe
4172	rwwnw64d.exe
1344	rwwnw64d.exe
2248	rwwnw64d.exe
4812	rwwnw64d.exe
2108	rwwnw64d.exe
932	rwwnw64d.exe
5056	rwwnw64d.exe
4852	rwwnw64d.exe
4540	rwwnw64d.exe
2216	rwwnw64d.exe
4044	rwwnw64d.exe
1032	rwwnw64d.exe
4460	rwwnw64d.exe
3700	rwwnw64d.exe
4940	rwwnw64d.exe
4888	rwwnw64d.exe
4904	rwwnw64d.exe
4960	rwwnw64d.exe
4688	rwwnw64d.exe
2720	rwwnw64d.exe
3036	rwwnw64d.exe
1900	rwwnw64d.exe
4568	rwwnw64d.exe
4740	rwwnw64d.exe
3472	rwwnw64d.exe
3968	rwwnw64d.exe
176	rwwnw64d.exe

Drops startup file 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk	rwwnw64d.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rwwnw64d.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File created	C:\Windows\SysWOW64\msnav32.ax	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File created	\??\c:\windows\SysWOW64\rwwnw64d.exe	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_19_09_22.log	rwwnw64d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command	rwwnw64d.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
812	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe
812	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe
804	rwwnw64d.exe
804	rwwnw64d.exe
3068	rwwnw64d.exe
3068	rwwnw64d.exe
2592	rwwnw64d.exe
2592	rwwnw64d.exe
612	rwwnw64d.exe
612	rwwnw64d.exe
4928	rwwnw64d.exe
4928	rwwnw64d.exe
4896	rwwnw64d.exe
4896	rwwnw64d.exe
4916	rwwnw64d.exe
4916	rwwnw64d.exe
4216	rwwnw64d.exe
4216	rwwnw64d.exe
2736	rwwnw64d.exe
2736	rwwnw64d.exe
5004	rwwnw64d.exe
5004	rwwnw64d.exe
1328	rwwnw64d.exe
1328	rwwnw64d.exe
344	rwwnw64d.exe
344	rwwnw64d.exe
3672	rwwnw64d.exe
3672	rwwnw64d.exe
3668	rwwnw64d.exe
3668	rwwnw64d.exe
5024	rwwnw64d.exe
5024	rwwnw64d.exe
3204	rwwnw64d.exe
3204	rwwnw64d.exe
1680	rwwnw64d.exe
1680	rwwnw64d.exe
2712	rwwnw64d.exe
2712	rwwnw64d.exe
1472	rwwnw64d.exe
1472	rwwnw64d.exe
4396	rwwnw64d.exe
4396	rwwnw64d.exe
3216	rwwnw64d.exe
3216	rwwnw64d.exe
4868	rwwnw64d.exe
4868	rwwnw64d.exe
4820	rwwnw64d.exe
4820	rwwnw64d.exe
4832	rwwnw64d.exe
4832	rwwnw64d.exe
5000	rwwnw64d.exe
5000	rwwnw64d.exe
1676	rwwnw64d.exe
1676	rwwnw64d.exe
4140	rwwnw64d.exe
4140	rwwnw64d.exe
728	rwwnw64d.exe
728	rwwnw64d.exe
2988	rwwnw64d.exe
2988	rwwnw64d.exe
692	rwwnw64d.exe
692	rwwnw64d.exe
4616	rwwnw64d.exe
4616	rwwnw64d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 804	812	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe	80
PID 812 wrote to memory of 804	812	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe	80
PID 812 wrote to memory of 804	812	eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe	80
PID 804 wrote to memory of 3068	804	rwwnw64d.exe	81
PID 804 wrote to memory of 3068	804	rwwnw64d.exe	81
PID 804 wrote to memory of 3068	804	rwwnw64d.exe	81
PID 3068 wrote to memory of 2592	3068	rwwnw64d.exe	82
PID 3068 wrote to memory of 2592	3068	rwwnw64d.exe	82
PID 3068 wrote to memory of 2592	3068	rwwnw64d.exe	82
PID 2592 wrote to memory of 612	2592	rwwnw64d.exe	83
PID 2592 wrote to memory of 612	2592	rwwnw64d.exe	83
PID 2592 wrote to memory of 612	2592	rwwnw64d.exe	83
PID 612 wrote to memory of 4928	612	rwwnw64d.exe	84
PID 612 wrote to memory of 4928	612	rwwnw64d.exe	84
PID 612 wrote to memory of 4928	612	rwwnw64d.exe	84
PID 4928 wrote to memory of 4896	4928	rwwnw64d.exe	85
PID 4928 wrote to memory of 4896	4928	rwwnw64d.exe	85
PID 4928 wrote to memory of 4896	4928	rwwnw64d.exe	85
PID 4896 wrote to memory of 4916	4896	rwwnw64d.exe	86
PID 4896 wrote to memory of 4916	4896	rwwnw64d.exe	86
PID 4896 wrote to memory of 4916	4896	rwwnw64d.exe	86
PID 4916 wrote to memory of 4216	4916	rwwnw64d.exe	87
PID 4916 wrote to memory of 4216	4916	rwwnw64d.exe	87
PID 4916 wrote to memory of 4216	4916	rwwnw64d.exe	87
PID 4216 wrote to memory of 2736	4216	rwwnw64d.exe	88
PID 4216 wrote to memory of 2736	4216	rwwnw64d.exe	88
PID 4216 wrote to memory of 2736	4216	rwwnw64d.exe	88
PID 2736 wrote to memory of 5004	2736	rwwnw64d.exe	90
PID 2736 wrote to memory of 5004	2736	rwwnw64d.exe	90
PID 2736 wrote to memory of 5004	2736	rwwnw64d.exe	90
PID 5004 wrote to memory of 1328	5004	rwwnw64d.exe	91
PID 5004 wrote to memory of 1328	5004	rwwnw64d.exe	91
PID 5004 wrote to memory of 1328	5004	rwwnw64d.exe	91
PID 1328 wrote to memory of 344	1328	rwwnw64d.exe	94
PID 1328 wrote to memory of 344	1328	rwwnw64d.exe	94
PID 1328 wrote to memory of 344	1328	rwwnw64d.exe	94
PID 344 wrote to memory of 3672	344	rwwnw64d.exe	96
PID 344 wrote to memory of 3672	344	rwwnw64d.exe	96
PID 344 wrote to memory of 3672	344	rwwnw64d.exe	96
PID 3672 wrote to memory of 3668	3672	rwwnw64d.exe	97
PID 3672 wrote to memory of 3668	3672	rwwnw64d.exe	97
PID 3672 wrote to memory of 3668	3672	rwwnw64d.exe	97
PID 3668 wrote to memory of 5024	3668	rwwnw64d.exe	98
PID 3668 wrote to memory of 5024	3668	rwwnw64d.exe	98
PID 3668 wrote to memory of 5024	3668	rwwnw64d.exe	98
PID 5024 wrote to memory of 3204	5024	rwwnw64d.exe	100
PID 5024 wrote to memory of 3204	5024	rwwnw64d.exe	100
PID 5024 wrote to memory of 3204	5024	rwwnw64d.exe	100
PID 3204 wrote to memory of 1680	3204	rwwnw64d.exe	101
PID 3204 wrote to memory of 1680	3204	rwwnw64d.exe	101
PID 3204 wrote to memory of 1680	3204	rwwnw64d.exe	101
PID 1680 wrote to memory of 2712	1680	rwwnw64d.exe	103
PID 1680 wrote to memory of 2712	1680	rwwnw64d.exe	103
PID 1680 wrote to memory of 2712	1680	rwwnw64d.exe	103
PID 2712 wrote to memory of 1472	2712	rwwnw64d.exe	105
PID 2712 wrote to memory of 1472	2712	rwwnw64d.exe	105
PID 2712 wrote to memory of 1472	2712	rwwnw64d.exe	105
PID 1472 wrote to memory of 4396	1472	rwwnw64d.exe	106
PID 1472 wrote to memory of 4396	1472	rwwnw64d.exe	106
PID 1472 wrote to memory of 4396	1472	rwwnw64d.exe	106
PID 4396 wrote to memory of 3216	4396	rwwnw64d.exe	107
PID 4396 wrote to memory of 3216	4396	rwwnw64d.exe	107
PID 4396 wrote to memory of 3216	4396	rwwnw64d.exe	107
PID 3216 wrote to memory of 4868	3216	rwwnw64d.exe	108

C:\Users\Admin\AppData\Local\Temp\eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe
"C:\Users\Admin\AppData\Local\Temp\eb0e6fb2638a3427cf07b123ae76a4c7fe71032d00f8d633649479aba161c296.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- \??\c:\windows\SysWOW64\rwwnw64d.exe
  c:\windows\system32\rwwnw64d.exe DWram
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:804
- - \??\c:\windows\SysWOW64\rwwnw64d.exe
    c:\windows\system32\rwwnw64d.exe DWram
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - \??\c:\windows\SysWOW64\rwwnw64d.exe
      c:\windows\system32\rwwnw64d.exe DWram
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2592
    - - \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:612
      - \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        6⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        8⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        10⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        11⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        12⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        13⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:344
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        14⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        15⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        20⤵
        Executes dropped EXE
        Drops startup file
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4868
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4820
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        25⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4832
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:5000
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        27⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        28⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4140
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        29⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:728
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        31⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        32⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4616
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4620
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        34⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2320
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        35⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        
        PID:4052
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        36⤵
        Executes dropped EXE
        Drops startup file
        Modifies registry class
        
        PID:1180
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        37⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4100
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        38⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        
        PID:4756
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4172
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        40⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        
        PID:1344
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        41⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2248
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4812
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        43⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        
        PID:2108
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        44⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        
        PID:932
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        45⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5056
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        46⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4852
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        47⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        
        PID:4540
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        48⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        
        PID:2216
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        49⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        
        PID:4044
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        50⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1032
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        51⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        
        PID:4460
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        52⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3700
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        53⤵
        Executes dropped EXE
        Drops startup file
        Modifies registry class
        
        PID:4940
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        54⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4888
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        55⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        
        PID:4904
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4960
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        57⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4688
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2720
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        59⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3036
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        60⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        
        PID:1900
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        61⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        
        PID:4568
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        62⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        
        PID:4740
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        63⤵
        Executes dropped EXE
        Drops startup file
        Modifies registry class
        
        PID:3472
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        64⤵
        Executes dropped EXE
        
        PID:3968
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        65⤵
        Executes dropped EXE
        Drops startup file
        Drops file in System32 directory
        
        PID:176
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        66⤵
        Drops startup file
        
        PID:344
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        67⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:3152
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        68⤵
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        
        PID:3740
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        69⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:984
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        70⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2852
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        71⤵
        Drops startup file
        Modifies registry class
        
        PID:4188
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        72⤵
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1784
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        73⤵
        Drops file in System32 directory
        
        PID:2652
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        74⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4564
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        75⤵
        Drops startup file
        Drops file in System32 directory
        
        PID:2712
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        76⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:764
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        77⤵
        Drops startup file
        Adds Run key to start application
        
        PID:3988
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        78⤵
        Drops startup file
        
        PID:4692
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        79⤵
        Adds Run key to start application
        
        PID:3380
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        80⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4396
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        81⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4028
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        82⤵
        Drops startup file
        Drops file in System32 directory
        
        PID:4528
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        83⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:1520
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        84⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2412
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        85⤵
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2768
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        86⤵
        Modifies registry class
        
        PID:2264
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        87⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:1076
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        88⤵
        Drops startup file
        Adds Run key to start application
        Modifies registry class
        
        PID:4056
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        89⤵
        Drops file in System32 directory
        
        PID:616
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        90⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1456
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        91⤵
        Adds Run key to start application
        
        PID:4116
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        92⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:448
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        93⤵
        
        PID:1864
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        94⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4132
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        95⤵
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        
        PID:1476
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        96⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1204
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        97⤵
        Drops file in System32 directory
        
        PID:1556
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        98⤵
        Drops startup file
        
        PID:2248
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        99⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:2916
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        100⤵
        Drops startup file
        Modifies registry class
        
        PID:2428
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        101⤵
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        
        PID:3084
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        102⤵
        Drops file in System32 directory
        
        PID:932
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        103⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4348
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        104⤵
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        
        PID:4268
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        105⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1768
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        106⤵
        Drops startup file
        Modifies registry class
        
        PID:3592
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        107⤵
        Drops startup file
        
        PID:1168
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        108⤵
        Drops startup file
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5104
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        109⤵
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        
        PID:1868
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3868
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        111⤵
        Drops startup file
        Adds Run key to start application
        
        PID:4604
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        112⤵
        Drops startup file
        Drops file in System32 directory
        Modifies registry class
        
        PID:5088
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        113⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2064
        
        \??\c:\windows\SysWOW64\rwwnw64d.exe
        
        c:\windows\system32\rwwnw64d.exe DWram
        114⤵
        
        PID:4548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk

Filesize
987B

MD5
45279d2c42a6275e2ff545e787d78e3e

SHA1
83ab5e4ae965669a139bb2d01f7e905f163f80d6

SHA256
24ba2032fee5820ea62bcd49d9e0f1ff9d61cc0874955a0c7f9ff4f6670ca3d8

SHA512
fc9605d8b68e8636c8bca81e06c4550f0a2539eb42f739ebf2637a107c8cfa8896feec67c8018360a2784113be54bea5e091bd2deb8dedab11caf58c995cc892

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk

Filesize
987B

MD5
52472a3884531d71fe7251d9e5b1baad

SHA1
0428aa2d2bb5609f904f42bbfa9d8b08cef3a04e

SHA256
ef7d4cffdb8e951197070016785b513ca7f281352ff49d0cc28bf6198d2042f1

SHA512
26b09bee886896a312db40eb7bb100e0e411541988c202379bbce9a71cc9c0b5cad2f6c86d3074c025985b63804f71b3c974ddf5f556da992ea62ddd553e15e4

Download Submit
C:\Windows\SysWOW64\msnav32.ax

Filesize
32B

MD5
3f9ab8d5e70b69ed8f844dfcfe3eb0d9

SHA1
c90abfcb42452487ae37820d4ce9e48a5c79fb9d

SHA256
f022e386f456dba47da9885457d2f5a1927d6922b27ef09012d8144b98f1dacd

SHA512
3ab6bb4c6496ceb077f59c7c47b95b643f144585fd56831a7e098765d0ec8c767489a7b8f13adcbfc6c9efc35d46a8331a93e61b53b56d1c4bb3acdd956b73e5

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
C:\Windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit
\??\c:\windows\SysWOW64\rwwnw64d.exe

Filesize
48KB

MD5
836b64bcab25d6dc6d097ccd3b569bd2

SHA1
91796cbf66d75a235bbb5e83e067ea9d76cfccbb

SHA256
ca388c2638abceb908b26a043026939f1198dfdeafe0de392e8b99e66410a173

SHA512
5a899c2f6913899a800076758a8ac6ee5bdb145a48b5c00c483cc45bd5216988277895c692b8dafe956ab591cb12f87f58a9182c36751b1a120436f5fd5cd799

Download Submit