File name:

SetupRw.exe

Full analysis: https://app.any.run/tasks/30ffa082-53e2-4885-8dfe-d69900f35dad
Verdict: Malicious activity
Analysis date: October 05, 2023, 06:46:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

280E48B2E813E98E87510C7AA6ECFD1A

SHA1:

8785407204EB19FE73D9A1FD23C4EC50F3ECDB31

SHA256:

70422F692546467050A22530E527EFCC98B6CDD8B0A60A2BE2C594F5A7F6AADF

SSDEEP:

49152:krmvgkXXkU53VcngiN76dwFZeRHEYJKGcwS/Qcdh077QQlioO:6Ckao762FQR5KGmXdh07UFB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SetupRw.exe (PID: 1648)
      • SetupRw.exe (PID: 1924)
      • SetupRw.tmp (PID: 3288)
      • Rw.exe (PID: 3824)

    • Application was dropped or rewritten from another process

      • Rw.exe (PID: 3824)

    • Creates a writable file the system directory

      • Rw.exe (PID: 3824)

  • SUSPICIOUS

    • Creates files in the driver directory

      • Rw.exe (PID: 3824)

    • Reads the Windows owner or organization settings

      • SetupRw.tmp (PID: 3288)

    • Drops a system driver (possible attempt to evade defenses)

      • Rw.exe (PID: 3824)

  • INFO

    • Checks supported languages

      • SetupRw.exe (PID: 1648)
      • SetupRw.tmp (PID: 1768)
      • SetupRw.tmp (PID: 3288)
      • SetupRw.exe (PID: 1924)
      • Rw.exe (PID: 3824)
      • wmpnscfg.exe (PID: 1692)

    • Reads the computer name

      • SetupRw.tmp (PID: 1768)
      • SetupRw.tmp (PID: 3288)
      • Rw.exe (PID: 3824)
      • wmpnscfg.exe (PID: 1692)

    • Application was dropped or rewritten from another process

      • SetupRw.tmp (PID: 3288)
      • SetupRw.tmp (PID: 1768)

    • Create files in a temporary directory

      • SetupRw.exe (PID: 1648)
      • SetupRw.exe (PID: 1924)

    • Creates files in the program directory

      • SetupRw.tmp (PID: 3288)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 1692)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:06 16:39:04+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 52224
UninitializedDataSize: -
EntryPoint: 0x117dc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: RW-Everything Setup
FileVersion:
LegalCopyright:
ProductName: RW-Everything
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start setuprw.exe no specs setuprw.tmp no specs setuprw.exe setuprw.tmp no specs rw.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1648"C:\Users\admin\AppData\Local\Temp\SetupRw.exe" C:\Users\admin\AppData\Local\Temp\SetupRw.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
RW-Everything Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setuprw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
1692"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
1768"C:\Users\admin\AppData\Local\Temp\is-OG96P.tmp\SetupRw.tmp" /SL5="$F00FA,1928587,119808,C:\Users\admin\AppData\Local\Temp\SetupRw.exe" C:\Users\admin\AppData\Local\Temp\is-OG96P.tmp\SetupRw.tmp—SetupRw.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-og96p.tmp\setuprw.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1924"C:\Users\admin\AppData\Local\Temp\SetupRw.exe" /SPAWNWND=$90216 /NOTIFYWND=$F00FA C:\Users\admin\AppData\Local\Temp\SetupRw.exe
SetupRw.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
RW-Everything Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setuprw.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
3288"C:\Users\admin\AppData\Local\Temp\is-R11RN.tmp\SetupRw.tmp" /SL5="$90194,1928587,119808,C:\Users\admin\AppData\Local\Temp\SetupRw.exe" /SPAWNWND=$90216 /NOTIFYWND=$F00FA C:\Users\admin\AppData\Local\Temp\is-R11RN.tmp\SetupRw.tmp—SetupRw.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-r11rn.tmp\setuprw.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3824"C:\Program Files\RW-Everything\Rw.exe"C:\Program Files\RW-Everything\Rw.exe—SetupRw.tmp
User:
admin
Integrity Level:
HIGH
Description:
RW - Read & Write
Exit code:
0
Version:
1.7.0.0
Modules
Images
c:\program files\rw-everything\rw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
1 133
Read events
1 122
Write events
0
Delete events
11

Modification events

(PID) Process:(3288) SetupRw.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFilesHash
Value:
113394A88E8E84ACFA22A574C449F04FF78877451864767601DB86C15CC0E43D
(PID) Process:(3288) SetupRw.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFiles0000
Value:
C:\Program Files\RW-Everything\Rw.exe
(PID) Process:(3288) SetupRw.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:
1
(PID) Process:(3288) SetupRw.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
B03A7C8DCB4C53EB54F55EB010D16D521F74677C08778508078705E9EA81B26C
(PID) Process:(3288) SetupRw.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
D80C000086752BC257F7D901
(PID) Process:(3288) SetupRw.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete keyName:(default)
Value:
(PID) Process:(1692) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{97B07676-E431-4E50-9033-F625FDF994E5}\{F49BD7E5-51B0-4B4D-898D-3D77E58FC4FD}
Operation:delete keyName:(default)
Value:
(PID) Process:(1692) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{EB696381-214E-4528-9BF9-802266217465}\{F49BD7E5-51B0-4B4D-898D-3D77E58FC4FD}
Operation:delete keyName:(default)
Value:
(PID) Process:(1692) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{EB696381-214E-4528-9BF9-802266217465}
Operation:delete keyName:(default)
Value:
(PID) Process:(1692) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{97B07676-E431-4E50-9033-F625FDF994E5}
Operation:delete keyName:(default)
Value:
Executable files
11
Suspicious files
11
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
3288SetupRw.tmpC:\Program Files\RW-Everything\is-SFTE5.tmpbinary
MD5:880B00774E15FB9998715CB0677DAC1E
SHA256:53644F83D61C36D31E6E481B692CBCE82E71A9AA2BE291FA8CCD32CC80FB4841
1648SetupRw.exeC:\Users\admin\AppData\Local\Temp\is-OG96P.tmp\SetupRw.tmpexecutable
MD5:74713FC3E9983C6E148C083599177E66
SHA256:6E8A32BAFB0B2099074FD092CC6B326BD4EE4C0DFDE10BDFFFD5CD84FC687497
3288SetupRw.tmpC:\Program Files\RW-Everything\is-LNGTT.tmpbinary
MD5:5AEF9916B2550066FF7260206D0C0443
SHA256:192D6E119C68FB57FD64FE784D53351DA4EA1FB5DF787CC4D3D23748F2DCB65E
3288SetupRw.tmpC:\Program Files\RW-Everything\25308086.IRWtext
MD5:25C88D23BECF0F969AC589F6E2D3CE83
SHA256:6D959FBE7E2CCAC42C1A009DA4A765C1BCE16C2D10C19F781DF8F03B6A350475
3288SetupRw.tmpC:\Program Files\RW-Everything\is-LGN1G.tmpexecutable
MD5:22742C3686026E3D01514C51383EEC46
SHA256:6AF73063A90F1E1673090E648134D327A26EBA033237EDD92D789C9D6647A6ED
3288SetupRw.tmpC:\Program Files\RW-Everything\is-TSLHG.tmptext
MD5:25C88D23BECF0F969AC589F6E2D3CE83
SHA256:6D959FBE7E2CCAC42C1A009DA4A765C1BCE16C2D10C19F781DF8F03B6A350475
3288SetupRw.tmpC:\Program Files\RW-Everything\Rw.exeexecutable
MD5:22742C3686026E3D01514C51383EEC46
SHA256:6AF73063A90F1E1673090E648134D327A26EBA033237EDD92D789C9D6647A6ED
3288SetupRw.tmpC:\Program Files\RW-Everything\ATAPI.IRWtext
MD5:429103370648C9AEF84E43E11FADE466
SHA256:09A41416CA90BD244B439B7370183AB4602DE7F3DC7B0988C344FA8630ECB4AF
3288SetupRw.tmpC:\Program Files\RW-Everything\Rw.inibinary
MD5:5AEF9916B2550066FF7260206D0C0443
SHA256:192D6E119C68FB57FD64FE784D53351DA4EA1FB5DF787CC4D3D23748F2DCB65E
3288SetupRw.tmpC:\Program Files\RW-Everything\unins000.exeexecutable
MD5:3A165498ED2BC12F86EB064AB3204AC3
SHA256:D630E60C655600B1BCB9B5D8979DF699AE6B4909F628AFB7229F6B466C78E5C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupRw.exe