Analysis
- max time kernel
119s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 13:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe
- Size 74KB
- Sample260629-qdtfbsd19x
- SHA256 de3d6b5c82763022c14bee8e670378c805939aabb2c0cc5750fd14cd0de00fb8
- MD5 aff2a5e34a3e21aefd98022269c4019b
- SHA1 4d29da5979c1ca97677a026d2db756f7e278d718
- SHA512 71dea3f17f736bd30f13e2d61b6eb8b837a9281edddd52bd0a3860d729b692de9abb2ad88255afaf5ecaeae8c9a35fe2d24ba45255ad20d1acd8512a5bbad0f1
- SSDEEP 768:FsFl3VOcV1OEqy7igfh9zuwrZXA6Wl9Oy2nfUECHpXuRNFCik5TRo7tJMW/gv:FsBOppy7/hu4A6W+D3CEgdBW/gv
- TLSH T18D730B83AE598091E6559B70462D233FCA73A46E0B30D7A717D8DE3C78371C1AC396B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe - Executes dropped EXE 64 IoCs
pid Process 1976 rwwdw64d.exe 2892 rwwdw64d.exe 1536 rwwdw64d.exe 4684 rwwdw64d.exe 5872 rwwdw64d.exe 2896 rwwdw64d.exe 1748 rwwdw64d.exe 3536 rwwdw64d.exe 5644 rwwdw64d.exe 3796 rwwdw64d.exe 2528 rwwdw64d.exe 3940 rwwdw64d.exe 5460 rwwdw64d.exe 4772 rwwdw64d.exe 5276 rwwdw64d.exe 6008 rwwdw64d.exe 5172 rwwdw64d.exe 124 rwwdw64d.exe 5908 rwwdw64d.exe 6112 rwwdw64d.exe 1692 rwwdw64d.exe 1488 rwwdw64d.exe 1440 rwwdw64d.exe 1184 rwwdw64d.exe 5164 rwwdw64d.exe 4756 rwwdw64d.exe 3120 rwwdw64d.exe 4148 rwwdw64d.exe 2432 rwwdw64d.exe 2276 rwwdw64d.exe 4548 rwwdw64d.exe 1904 rwwdw64d.exe 4928 rwwdw64d.exe 2992 rwwdw64d.exe 1368 rwwdw64d.exe 3564 rwwdw64d.exe 2004 rwwdw64d.exe 3568 rwwdw64d.exe 1744 rwwdw64d.exe 2492 rwwdw64d.exe 1940 rwwdw64d.exe 1704 rwwdw64d.exe 5920 rwwdw64d.exe 4896 rwwdw64d.exe 2672 rwwdw64d.exe 2908 rwwdw64d.exe 2844 rwwdw64d.exe 3216 rwwdw64d.exe 4784 rwwdw64d.exe 5760 rwwdw64d.exe 2628 rwwdw64d.exe 1820 rwwdw64d.exe 5548 rwwdw64d.exe 2640 rwwdw64d.exe 3744 rwwdw64d.exe 3604 rwwdw64d.exe 5664 rwwdw64d.exe 3692 rwwdw64d.exe 1860 rwwdw64d.exe 5384 rwwdw64d.exe 3132 rwwdw64d.exe 3440 rwwdw64d.exe 3192 rwwdw64d.exe 6104 rwwdw64d.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-23-3F-FD-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe DWoli" 2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-23-3F-FD-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-23-3F-FD-DW} = "C:\\Windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-23-3F-FD-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File created C:\Windows\SysWOW64\msnav32.ax 2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log 2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log rwwdw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (int) \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (int) \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{2DFB521E-8114-480E-A315-B4D4FDBE960D} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (int) \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3804 explorer.exe 3804 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe Token: SeShutdownPrivilege 3804 explorer.exe Token: SeCreatePagefilePrivilege 3804 explorer.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1944 sihost.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe 3804 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1600 2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe 1600 2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe 1976 rwwdw64d.exe 1976 rwwdw64d.exe 2892 rwwdw64d.exe 2892 rwwdw64d.exe 1536 rwwdw64d.exe 1536 rwwdw64d.exe 4684 rwwdw64d.exe 4684 rwwdw64d.exe 5872 rwwdw64d.exe 5872 rwwdw64d.exe 2896 rwwdw64d.exe 2896 rwwdw64d.exe 1748 rwwdw64d.exe 1748 rwwdw64d.exe 3536 rwwdw64d.exe 3536 rwwdw64d.exe 5644 rwwdw64d.exe 5644 rwwdw64d.exe 3796 rwwdw64d.exe 3796 rwwdw64d.exe 2528 rwwdw64d.exe 2528 rwwdw64d.exe 3940 rwwdw64d.exe 3940 rwwdw64d.exe 5460 rwwdw64d.exe 5460 rwwdw64d.exe 4772 rwwdw64d.exe 4772 rwwdw64d.exe 5276 rwwdw64d.exe 5276 rwwdw64d.exe 6008 rwwdw64d.exe 6008 rwwdw64d.exe 5172 rwwdw64d.exe 5172 rwwdw64d.exe 124 rwwdw64d.exe 124 rwwdw64d.exe 5908 rwwdw64d.exe 5908 rwwdw64d.exe 6112 rwwdw64d.exe 6112 rwwdw64d.exe 1692 rwwdw64d.exe 1692 rwwdw64d.exe 1488 rwwdw64d.exe 1488 rwwdw64d.exe 1440 rwwdw64d.exe 1440 rwwdw64d.exe 1184 rwwdw64d.exe 1184 rwwdw64d.exe 5164 rwwdw64d.exe 5164 rwwdw64d.exe 4756 rwwdw64d.exe 4756 rwwdw64d.exe 3120 rwwdw64d.exe 3120 rwwdw64d.exe 4148 rwwdw64d.exe 4148 rwwdw64d.exe 2432 rwwdw64d.exe 2432 rwwdw64d.exe 2276 rwwdw64d.exe 2276 rwwdw64d.exe 4548 rwwdw64d.exe 4548 rwwdw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1976 1600 2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe 87 PID 1976 wrote to memory of 2892 1976 rwwdw64d.exe 89 PID 2892 wrote to memory of 4684 2892 rwwdw64d.exe 93 PID 1536 wrote to memory of 5872 1536 rwwdw64d.exe 94 PID 4684 wrote to memory of 2896 4684 rwwdw64d.exe 96 PID 5872 wrote to memory of 1748 5872 rwwdw64d.exe 97 PID 2896 wrote to memory of 3536 2896 rwwdw64d.exe 98 PID 1748 wrote to memory of 5644 1748 rwwdw64d.exe 99 PID 3536 wrote to memory of 3796 3536 rwwdw64d.exe 100 PID 5644 wrote to memory of 2528 5644 rwwdw64d.exe 101 PID 3796 wrote to memory of 3940 3796 rwwdw64d.exe 102 PID 2528 wrote to memory of 5460 2528 rwwdw64d.exe 103 PID 3940 wrote to memory of 4772 3940 rwwdw64d.exe 104 PID 5460 wrote to memory of 5276 5460 rwwdw64d.exe 105 PID 4772 wrote to memory of 6008 4772 rwwdw64d.exe 106 PID 5276 wrote to memory of 5172 5276 rwwdw64d.exe 107 PID 6008 wrote to memory of 124 6008 rwwdw64d.exe 108 PID 5172 wrote to memory of 5908 5172 rwwdw64d.exe 109 PID 124 wrote to memory of 6112 124 rwwdw64d.exe 110 PID 5908 wrote to memory of 1692 5908 rwwdw64d.exe 111 PID 6112 wrote to memory of 1488 6112 rwwdw64d.exe 112 PID 1692 wrote to memory of 1440 1692 rwwdw64d.exe 113 PID 1488 wrote to memory of 1184 1488 rwwdw64d.exe 114 PID 1440 wrote to memory of 5164 1440 rwwdw64d.exe 115 PID 1184 wrote to memory of 4756 1184 rwwdw64d.exe 116 PID 5164 wrote to memory of 3120 5164 rwwdw64d.exe 117 PID 4756 wrote to memory of 4148 4756 rwwdw64d.exe 118 PID 3120 wrote to memory of 2432 3120 rwwdw64d.exe 119 PID 4148 wrote to memory of 2276 4148 rwwdw64d.exe 120 PID 2432 wrote to memory of 4548 2432 rwwdw64d.exe 121 PID 2276 wrote to memory of 1904 2276 rwwdw64d.exe 122 PID 4548 wrote to memory of 4928 4548 rwwdw64d.exe 123 PID 1904 wrote to memory of 2992 1904 rwwdw64d.exe 124 PID 4928 wrote to memory of 1368 4928 rwwdw64d.exe 125 PID 2992 wrote to memory of 3564 2992 rwwdw64d.exe 126 PID 1368 wrote to memory of 2004 1368 rwwdw64d.exe 127 PID 3564 wrote to memory of 3568 3564 rwwdw64d.exe 128 PID 2004 wrote to memory of 1744 2004 rwwdw64d.exe 129 PID 3568 wrote to memory of 2492 3568 rwwdw64d.exe 130 PID 1744 wrote to memory of 1940 1744 rwwdw64d.exe 131 PID 2492 wrote to memory of 1704 2492 rwwdw64d.exe 132 PID 1940 wrote to memory of 5920 1940 rwwdw64d.exe 133 PID 1704 wrote to memory of 4896 1704 rwwdw64d.exe 134 PID 5920 wrote to memory of 2672 5920 rwwdw64d.exe 135 PID 4896 wrote to memory of 2908 4896 rwwdw64d.exe 136 PID 2672 wrote to memory of 2844 2672 rwwdw64d.exe 137 PID 2908 wrote to memory of 3216 2908 rwwdw64d.exe 138 PID 2844 wrote to memory of 4784 2844 rwwdw64d.exe 139 PID 3216 wrote to memory of 5760 3216 rwwdw64d.exe 140 PID 4784 wrote to memory of 2628 4784 rwwdw64d.exe 141 PID 5760 wrote to memory of 1820 5760 rwwdw64d.exe 142 PID 2628 wrote to memory of 5548 2628 rwwdw64d.exe 143 PID 1820 wrote to memory of 2640 1820 rwwdw64d.exe 144 PID 5548 wrote to memory of 3744 5548 rwwdw64d.exe 145 PID 2640 wrote to memory of 3604 2640 rwwdw64d.exe 146 PID 3744 wrote to memory of 5664 3744 rwwdw64d.exe 147 PID 3604 wrote to memory of 3692 3604 rwwdw64d.exe 148 PID 5664 wrote to memory of 1860 5664 rwwdw64d.exe 149 PID 3692 wrote to memory of 5384 3692 rwwdw64d.exe 150 PID 1860 wrote to memory of 3132 1860 rwwdw64d.exe 151 PID 5384 wrote to memory of 3440 5384 rwwdw64d.exe 152 PID 3132 wrote to memory of 3192 3132 rwwdw64d.exe 153 PID 3440 wrote to memory of 6104 3440 rwwdw64d.exe 154 PID 3192 wrote to memory of 2568 3192 rwwdw64d.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_aff2a5e34a3e21aefd98022269c4019b_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6112 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5760 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Executes dropped EXE
PID:6104 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:508 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5988 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵PID:6000
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵PID:4640
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2776 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:936 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵
- Drops startup file
- Modifies registry class
PID:4700 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- Drops file in System32 directory
PID:5800 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6052 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵
- Drops file in System32 directory
- Modifies registry class
PID:3324 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵
- Drops startup file
PID:2464 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵
- Modifies registry class
PID:5896 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6020 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3656 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3088 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2380 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Drops file in System32 directory
- Modifies registry class
PID:5364 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2364 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵
- Drops startup file
- Drops file in System32 directory
PID:1204 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵
- Modifies registry class
PID:2076 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1200 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- Drops startup file
- Modifies registry class
PID:3096 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵
- Drops startup file
PID:2808 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- Drops startup file
- Drops file in System32 directory
PID:2644 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵
- Drops startup file
PID:2852 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵
- Drops file in System32 directory
PID:5440 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5104 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵
- Drops startup file
- Modifies registry class
PID:4132 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵
- Drops file in System32 directory
PID:1876 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4812 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵
- Drops startup file
- Modifies registry class
PID:1080 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:4916 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵PID:4852
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵
- Drops startup file
PID:4660 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵
- Drops startup file
PID:2480 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4312 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵
- Modifies registry class
PID:4692 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4716 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2836 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵
- Drops file in System32 directory
PID:260 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3436 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5308 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6088 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- Drops file in System32 directory
- Modifies registry class
PID:4428 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵PID:1880
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵
- Drops file in System32 directory
- Modifies registry class
PID:1712 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵
- System Location Discovery: System Language Discovery
PID:4796 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵PID:924
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵
- Drops file in System32 directory
PID:1616 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵
- Modifies registry class
PID:5712 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵
- Drops startup file
PID:2068 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵
- Drops startup file
- Drops file in System32 directory
PID:1296 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵
- Drops file in System32 directory
PID:5912 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵
- System Location Discovery: System Language Discovery
PID:5492 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵
- Drops startup file
- Modifies registry class
PID:2456 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵
- Drops file in System32 directory
- Modifies registry class
PID:1560 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵PID:3344
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵
- Drops startup file
- Modifies registry class
PID:432 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵
- Drops file in System32 directory
- Modifies registry class
PID:3836 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵
- System Location Discovery: System Language Discovery
PID:5532 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵
- Drops startup file
PID:5128 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5716 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵PID:1428
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1800 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:716 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:712 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵
- System Location Discovery: System Language Discovery
PID:4624 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵PID:3296
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵PID:5752
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵PID:3332
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵PID:4136
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵PID:796
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵PID:3504
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵PID:2716
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵PID:3444
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵PID:5832
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵PID:4572
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵PID:4616
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵PID:4372
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵PID:4532
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵PID:252
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵PID:4652
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-