Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
4fa98a44f4c4edbf0631c8d90e9287e8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4fa98a44f4c4edbf0631c8d90e9287e8.exe
Resource
win10v2004-20231215-en
General
-
Target
4fa98a44f4c4edbf0631c8d90e9287e8.exe
-
Size
56KB
-
MD5
4fa98a44f4c4edbf0631c8d90e9287e8
-
SHA1
cfa0833c274e01b097c4a4a0e644daa96d761164
-
SHA256
862720660bdab28c9473c00a3c064f6ad0b4124dc8d02064422cf970281f13e2
-
SHA512
a4bf469a330d3486f0d808c7ddd9af6ea2c23c585b8a3030d58b03f1ee481c5cb6863bd32db7fb72cfe03db1af797d3e0b3a4239d37efa209bd4df7d65cc51fc
-
SSDEEP
768:uEaz5G7MaEtbwQpeyjaSLyfOPT4xcsrRA9Xu/IC4X3i2AH350azknSRXJuRWQlhL:v4GYUWeypTUuuQj635cSRU3iN/ntN6
Malware Config
Signatures
-
Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk 4fa98a44f4c4edbf0631c8d90e9287e8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe -
Executes dropped EXE 64 IoCs
pid Process 2436 dwdsrngt.exe 2680 dwdsrngt.exe 2844 dwdsrngt.exe 2744 dwdsrngt.exe 2616 dwdsrngt.exe 2624 dwdsrngt.exe 516 dwdsrngt.exe 2816 dwdsrngt.exe 2940 dwdsrngt.exe 1892 dwdsrngt.exe 1876 dwdsrngt.exe 1900 dwdsrngt.exe 2520 dwdsrngt.exe 1732 dwdsrngt.exe 1664 dwdsrngt.exe 1592 dwdsrngt.exe 1604 dwdsrngt.exe 816 dwdsrngt.exe 2468 dwdsrngt.exe 2264 dwdsrngt.exe 1144 dwdsrngt.exe 1152 dwdsrngt.exe 1756 dwdsrngt.exe 1068 dwdsrngt.exe 1636 dwdsrngt.exe 1116 dwdsrngt.exe 1824 dwdsrngt.exe 2176 dwdsrngt.exe 2012 dwdsrngt.exe 1196 dwdsrngt.exe 1736 dwdsrngt.exe 2024 dwdsrngt.exe 1668 dwdsrngt.exe 2288 dwdsrngt.exe 2780 dwdsrngt.exe 2768 dwdsrngt.exe 2436 dwdsrngt.exe 2700 dwdsrngt.exe 2656 dwdsrngt.exe 2792 dwdsrngt.exe 2652 dwdsrngt.exe 2744 dwdsrngt.exe 1256 dwdsrngt.exe 2036 dwdsrngt.exe 624 dwdsrngt.exe 2664 dwdsrngt.exe 2840 dwdsrngt.exe 2920 dwdsrngt.exe 2940 dwdsrngt.exe 1920 dwdsrngt.exe 792 dwdsrngt.exe 2232 dwdsrngt.exe 548 dwdsrngt.exe 2520 dwdsrngt.exe 932 dwdsrngt.exe 856 dwdsrngt.exe 1412 dwdsrngt.exe 2400 dwdsrngt.exe 2532 dwdsrngt.exe 3000 dwdsrngt.exe 2140 dwdsrngt.exe 2412 dwdsrngt.exe 1036 dwdsrngt.exe 1048 dwdsrngt.exe -
Loads dropped DLL 64 IoCs
pid Process 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 2436 dwdsrngt.exe 2436 dwdsrngt.exe 2680 dwdsrngt.exe 2680 dwdsrngt.exe 2844 dwdsrngt.exe 2844 dwdsrngt.exe 2744 dwdsrngt.exe 2744 dwdsrngt.exe 2616 dwdsrngt.exe 2616 dwdsrngt.exe 2624 dwdsrngt.exe 2624 dwdsrngt.exe 516 dwdsrngt.exe 516 dwdsrngt.exe 2816 dwdsrngt.exe 2816 dwdsrngt.exe 2940 dwdsrngt.exe 2940 dwdsrngt.exe 1892 dwdsrngt.exe 1892 dwdsrngt.exe 1876 dwdsrngt.exe 1876 dwdsrngt.exe 1900 dwdsrngt.exe 1900 dwdsrngt.exe 2520 dwdsrngt.exe 2520 dwdsrngt.exe 1732 dwdsrngt.exe 1732 dwdsrngt.exe 1664 dwdsrngt.exe 1664 dwdsrngt.exe 1592 dwdsrngt.exe 1592 dwdsrngt.exe 1604 dwdsrngt.exe 1604 dwdsrngt.exe 816 dwdsrngt.exe 816 dwdsrngt.exe 2468 dwdsrngt.exe 2468 dwdsrngt.exe 2264 dwdsrngt.exe 2264 dwdsrngt.exe 1144 dwdsrngt.exe 1144 dwdsrngt.exe 1152 dwdsrngt.exe 1152 dwdsrngt.exe 1756 dwdsrngt.exe 1756 dwdsrngt.exe 1068 dwdsrngt.exe 1068 dwdsrngt.exe 1636 dwdsrngt.exe 1636 dwdsrngt.exe 1116 dwdsrngt.exe 1116 dwdsrngt.exe 1824 dwdsrngt.exe 1824 dwdsrngt.exe 2176 dwdsrngt.exe 2176 dwdsrngt.exe 2012 dwdsrngt.exe 2012 dwdsrngt.exe 1196 dwdsrngt.exe 1196 dwdsrngt.exe 1736 dwdsrngt.exe 1736 dwdsrngt.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\{2E-E8-8A-AC-ZN} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4fa98a44f4c4edbf0631c8d90e9287e8.exe CHD001" 4fa98a44f4c4edbf0631c8d90e9287e8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\{2E-E8-8A-AC-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHD001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\{E4-43-32-2A-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHD001" dwdsrngt.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log 4fa98a44f4c4edbf0631c8d90e9287e8.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification \??\c:\windows\SysWOW64\dwdsrngt.exe 4fa98a44f4c4edbf0631c8d90e9287e8.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_10_01_24.log dwdsrngt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm 4fa98a44f4c4edbf0631c8d90e9287e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 2436 dwdsrngt.exe 2436 dwdsrngt.exe 2680 dwdsrngt.exe 2680 dwdsrngt.exe 2844 dwdsrngt.exe 2844 dwdsrngt.exe 2744 dwdsrngt.exe 2744 dwdsrngt.exe 2616 dwdsrngt.exe 2616 dwdsrngt.exe 2624 dwdsrngt.exe 2624 dwdsrngt.exe 516 dwdsrngt.exe 516 dwdsrngt.exe 2816 dwdsrngt.exe 2816 dwdsrngt.exe 2940 dwdsrngt.exe 2940 dwdsrngt.exe 1892 dwdsrngt.exe 1892 dwdsrngt.exe 1876 dwdsrngt.exe 1876 dwdsrngt.exe 1900 dwdsrngt.exe 1900 dwdsrngt.exe 2520 dwdsrngt.exe 2520 dwdsrngt.exe 1732 dwdsrngt.exe 1732 dwdsrngt.exe 1664 dwdsrngt.exe 1664 dwdsrngt.exe 1592 dwdsrngt.exe 1592 dwdsrngt.exe 1604 dwdsrngt.exe 1604 dwdsrngt.exe 816 dwdsrngt.exe 816 dwdsrngt.exe 2468 dwdsrngt.exe 2468 dwdsrngt.exe 2264 dwdsrngt.exe 2264 dwdsrngt.exe 1144 dwdsrngt.exe 1144 dwdsrngt.exe 1152 dwdsrngt.exe 1152 dwdsrngt.exe 1756 dwdsrngt.exe 1756 dwdsrngt.exe 1068 dwdsrngt.exe 1068 dwdsrngt.exe 1636 dwdsrngt.exe 1636 dwdsrngt.exe 1116 dwdsrngt.exe 1116 dwdsrngt.exe 1824 dwdsrngt.exe 1824 dwdsrngt.exe 2176 dwdsrngt.exe 2176 dwdsrngt.exe 2012 dwdsrngt.exe 2012 dwdsrngt.exe 1196 dwdsrngt.exe 1196 dwdsrngt.exe 1736 dwdsrngt.exe 1736 dwdsrngt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2436 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 28 PID 2300 wrote to memory of 2436 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 28 PID 2300 wrote to memory of 2436 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 28 PID 2300 wrote to memory of 2436 2300 4fa98a44f4c4edbf0631c8d90e9287e8.exe 28 PID 2436 wrote to memory of 2680 2436 dwdsrngt.exe 29 PID 2436 wrote to memory of 2680 2436 dwdsrngt.exe 29 PID 2436 wrote to memory of 2680 2436 dwdsrngt.exe 29 PID 2436 wrote to memory of 2680 2436 dwdsrngt.exe 29 PID 2680 wrote to memory of 2844 2680 dwdsrngt.exe 30 PID 2680 wrote to memory of 2844 2680 dwdsrngt.exe 30 PID 2680 wrote to memory of 2844 2680 dwdsrngt.exe 30 PID 2680 wrote to memory of 2844 2680 dwdsrngt.exe 30 PID 2844 wrote to memory of 2744 2844 dwdsrngt.exe 31 PID 2844 wrote to memory of 2744 2844 dwdsrngt.exe 31 PID 2844 wrote to memory of 2744 2844 dwdsrngt.exe 31 PID 2844 wrote to memory of 2744 2844 dwdsrngt.exe 31 PID 2744 wrote to memory of 2616 2744 dwdsrngt.exe 32 PID 2744 wrote to memory of 2616 2744 dwdsrngt.exe 32 PID 2744 wrote to memory of 2616 2744 dwdsrngt.exe 32 PID 2744 wrote to memory of 2616 2744 dwdsrngt.exe 32 PID 2616 wrote to memory of 2624 2616 dwdsrngt.exe 33 PID 2616 wrote to memory of 2624 2616 dwdsrngt.exe 33 PID 2616 wrote to memory of 2624 2616 dwdsrngt.exe 33 PID 2616 wrote to memory of 2624 2616 dwdsrngt.exe 33 PID 2624 wrote to memory of 516 2624 dwdsrngt.exe 34 PID 2624 wrote to memory of 516 2624 dwdsrngt.exe 34 PID 2624 wrote to memory of 516 2624 dwdsrngt.exe 34 PID 2624 wrote to memory of 516 2624 dwdsrngt.exe 34 PID 516 wrote to memory of 2816 516 dwdsrngt.exe 35 PID 516 wrote to memory of 2816 516 dwdsrngt.exe 35 PID 516 wrote to memory of 2816 516 dwdsrngt.exe 35 PID 516 wrote to memory of 2816 516 dwdsrngt.exe 35 PID 2816 wrote to memory of 2940 2816 dwdsrngt.exe 36 PID 2816 wrote to memory of 2940 2816 dwdsrngt.exe 36 PID 2816 wrote to memory of 2940 2816 dwdsrngt.exe 36 PID 2816 wrote to memory of 2940 2816 dwdsrngt.exe 36 PID 2940 wrote to memory of 1892 2940 dwdsrngt.exe 37 PID 2940 wrote to memory of 1892 2940 dwdsrngt.exe 37 PID 2940 wrote to memory of 1892 2940 dwdsrngt.exe 37 PID 2940 wrote to memory of 1892 2940 dwdsrngt.exe 37 PID 1892 wrote to memory of 1876 1892 dwdsrngt.exe 38 PID 1892 wrote to memory of 1876 1892 dwdsrngt.exe 38 PID 1892 wrote to memory of 1876 1892 dwdsrngt.exe 38 PID 1892 wrote to memory of 1876 1892 dwdsrngt.exe 38 PID 1876 wrote to memory of 1900 1876 dwdsrngt.exe 39 PID 1876 wrote to memory of 1900 1876 dwdsrngt.exe 39 PID 1876 wrote to memory of 1900 1876 dwdsrngt.exe 39 PID 1876 wrote to memory of 1900 1876 dwdsrngt.exe 39 PID 1900 wrote to memory of 2520 1900 dwdsrngt.exe 40 PID 1900 wrote to memory of 2520 1900 dwdsrngt.exe 40 PID 1900 wrote to memory of 2520 1900 dwdsrngt.exe 40 PID 1900 wrote to memory of 2520 1900 dwdsrngt.exe 40 PID 2520 wrote to memory of 1732 2520 dwdsrngt.exe 41 PID 2520 wrote to memory of 1732 2520 dwdsrngt.exe 41 PID 2520 wrote to memory of 1732 2520 dwdsrngt.exe 41 PID 2520 wrote to memory of 1732 2520 dwdsrngt.exe 41 PID 1732 wrote to memory of 1664 1732 dwdsrngt.exe 42 PID 1732 wrote to memory of 1664 1732 dwdsrngt.exe 42 PID 1732 wrote to memory of 1664 1732 dwdsrngt.exe 42 PID 1732 wrote to memory of 1664 1732 dwdsrngt.exe 42 PID 1664 wrote to memory of 1592 1664 dwdsrngt.exe 43 PID 1664 wrote to memory of 1592 1664 dwdsrngt.exe 43 PID 1664 wrote to memory of 1592 1664 dwdsrngt.exe 43 PID 1664 wrote to memory of 1592 1664 dwdsrngt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fa98a44f4c4edbf0631c8d90e9287e8.exe"C:\Users\Admin\AppData\Local\Temp\4fa98a44f4c4edbf0631c8d90e9287e8.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0012⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0013⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0014⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0015⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0016⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0017⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0018⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0019⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00110⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00111⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00112⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00113⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00114⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00115⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00116⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00117⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1592 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00118⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1604 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00119⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:816 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00120⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2468 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00121⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2264 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00122⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1144 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00123⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1152 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00124⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1756 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00125⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1068 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00126⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1636 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00127⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1116 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00128⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1824 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00129⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2176 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00130⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2012 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00131⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1196 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00132⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1736 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00133⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
PID:2024 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00134⤵
- Executes dropped EXE
PID:1668 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00135⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2288 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00136⤵
- Drops startup file
- Executes dropped EXE
PID:2780 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00137⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2768 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00138⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2436 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00139⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2700 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00140⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2656 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00141⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2792 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00142⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
PID:2652 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00143⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2744 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00144⤵
- Executes dropped EXE
- Modifies registry class
PID:1256 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00145⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2036 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00146⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:624 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00147⤵
- Executes dropped EXE
- Modifies registry class
PID:2664 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00148⤵
- Executes dropped EXE
- Modifies registry class
PID:2840 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00149⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
PID:2920 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00150⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2940 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00151⤵
- Executes dropped EXE
PID:1920 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00152⤵
- Executes dropped EXE
- Modifies registry class
PID:792 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00153⤵
- Executes dropped EXE
PID:2232 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00154⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:548 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00155⤵
- Executes dropped EXE
PID:2520 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00156⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
PID:932 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00157⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:856 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00158⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1412 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00159⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
PID:2400 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00160⤵
- Executes dropped EXE
- Modifies registry class
PID:2532 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00161⤵
- Executes dropped EXE
PID:3000 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00162⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2140 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00163⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2412 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00164⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
PID:1036 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00165⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
PID:1048 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00166⤵
- Drops file in System32 directory
PID:1260 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00167⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:1512 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00168⤵
- Drops startup file
PID:1192 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00169⤵
- Drops file in System32 directory
PID:2200 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00170⤵
- Drops startup file
PID:2196 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00171⤵
- Modifies registry class
PID:572 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00172⤵
- Drops file in System32 directory
PID:2488 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00173⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2320 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00174⤵
- Drops startup file
PID:1560 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00175⤵
- Modifies registry class
PID:1216 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00176⤵PID:2252
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00177⤵PID:2732
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00178⤵
- Drops startup file
- Modifies registry class
PID:2708 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00179⤵
- Drops file in System32 directory
PID:2828 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00180⤵
- Drops startup file
PID:828 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00181⤵
- Drops startup file
PID:1960 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00182⤵
- Drops file in System32 directory
PID:2080 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00183⤵
- Drops file in System32 directory
PID:2812 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00184⤵
- Drops startup file
- Modifies registry class
PID:1076 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00185⤵
- Drops startup file
PID:2744 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00186⤵
- Drops startup file
PID:1256 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00187⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2036 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00188⤵
- Drops file in System32 directory
- Modifies registry class
PID:2864 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00189⤵
- Drops startup file
PID:1120 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00190⤵
- Drops startup file
PID:2948 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00191⤵
- Drops file in System32 directory
- Modifies registry class
PID:2480 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00192⤵
- Drops startup file
- Modifies registry class
PID:364 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00193⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2040 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00194⤵
- Drops startup file
- Drops file in System32 directory
PID:1708 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00195⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2232 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00196⤵
- Drops startup file
- Modifies registry class
PID:1720 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00197⤵
- Modifies registry class
PID:2520 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00198⤵
- Drops startup file
- Modifies registry class
PID:1664 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00199⤵
- Drops file in System32 directory
PID:1648 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001100⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:944 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001101⤵PID:2428
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001102⤵
- Drops startup file
- Drops file in System32 directory
PID:2116 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001103⤵
- Modifies registry class
PID:2144 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001104⤵
- Drops startup file
- Modifies registry class
PID:2124 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001105⤵
- Modifies registry class
PID:1072 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001106⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:1144 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001107⤵
- Drops file in System32 directory
- Modifies registry class
PID:1152 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001108⤵
- Drops startup file
- Drops file in System32 directory
PID:536 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001109⤵
- Drops startup file
- Drops file in System32 directory
PID:984 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001110⤵
- Drops startup file
- Drops file in System32 directory
PID:2760 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001111⤵
- Drops file in System32 directory
- Modifies registry class
PID:1996 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001112⤵
- Drops startup file
- Modifies registry class
PID:284 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001113⤵
- Modifies registry class
PID:2204 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001114⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:1196 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001115⤵
- Drops startup file
- Modifies registry class
PID:2104 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001116⤵
- Adds Run key to start application
PID:2256 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001117⤵
- Drops startup file
- Modifies registry class
PID:2320 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001118⤵
- Drops file in System32 directory
PID:1896 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001119⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2300 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001120⤵
- Drops file in System32 directory
- Modifies registry class
PID:2716 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001121⤵
- Drops startup file
PID:2836 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-