Analysis
-
max time kernel
1050s -
max time network
439s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
PDF.FaturaDetay_202407.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PDF.FaturaDetay_202407.exe
Resource
win10v2004-20240709-en
General
-
Target
PDF.FaturaDetay_202407.exe
-
Size
319KB
-
MD5
e8e59836a0fe2dfebcbde148711b5d56
-
SHA1
cd8fbf0dcdd429c06c80b124caf574334504e99a
-
SHA256
2960a2d4d2fd6b7b85b8e3ea4c86ec0c13b93bfd3754a7e772a2c74f564b0009
-
SHA512
0d0673c64f9e9e1c75e10ce6d02c4b5530831d1659ada88acf951e2bcbd56c38f0c59674b3eb7837fd882b23499eb350f2925fd67d3fdf51992d9a4312a02309
-
SSDEEP
6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BJXCcOS8W78U2kGHF4143nip:kANwRo+mv8QD4+0V167XDOSDN2JF41me
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.ru - Port:
587 - Username:
[email protected] - Password:
9b0P96R6nBreNQrU3Cte
Signatures
-
Renames multiple (511) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2080 powershell.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation RootDesign.exe -
Executes dropped EXE 64 IoCs
pid Process 2960 RootDesign.exe 2120 RootDesign.exe 2996 RootDesign.exe 2252 RootDesign.exe 4912 RootDesign.exe 452 RootDesign.exe 4612 RootDesign.exe 1452 RootDesign.exe 1620 RootDesign.exe 2500 RootDesign.exe 3092 RootDesign.exe 4576 RootDesign.exe 3884 RootDesign.exe 1940 RootDesign.exe 4392 RootDesign.exe 4560 RootDesign.exe 1396 RootDesign.exe 4912 RootDesign.exe 452 RootDesign.exe 3660 RootDesign.exe 1452 RootDesign.exe 1036 RootDesign.exe 4488 RootDesign.exe 3576 RootDesign.exe 4336 RootDesign.exe 2860 RootDesign.exe 4496 RootDesign.exe 3484 RootDesign.exe 1852 RootDesign.exe 3648 RootDesign.exe 3492 RootDesign.exe 2780 RootDesign.exe 2232 RootDesign.exe 3164 RootDesign.exe 1172 RootDesign.exe 4876 RootDesign.exe 3988 RootDesign.exe 3776 RootDesign.exe 3656 RootDesign.exe 1340 RootDesign.exe 3088 RootDesign.exe 2872 RootDesign.exe 4376 RootDesign.exe 5032 RootDesign.exe 2188 RootDesign.exe 4672 RootDesign.exe 2860 RootDesign.exe 3224 RootDesign.exe 2612 RootDesign.exe 1664 RootDesign.exe 1936 RootDesign.exe 2516 RootDesign.exe 4408 RootDesign.exe 3132 RootDesign.exe 5072 RootDesign.exe 2892 RootDesign.exe 3020 RootDesign.exe 5088 RootDesign.exe 2188 RootDesign.exe 4704 RootDesign.exe 2040 RootDesign.exe 4344 RootDesign.exe 3084 RootDesign.exe 1340 RootDesign.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\desktop.ini RootDesign.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini RootDesign.exe -
Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
pid Process 1180 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2080 powershell.exe 2080 powershell.exe 3528 powershell.exe 3528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2080 powershell.exe Token: SeDebugPrivilege 3528 powershell.exe Token: SeDebugPrivilege 2996 RootDesign.exe Token: SeDebugPrivilege 1852 RootDesign.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4168 wrote to memory of 1180 4168 PDF.FaturaDetay_202407.exe 86 PID 4168 wrote to memory of 1180 4168 PDF.FaturaDetay_202407.exe 86 PID 4168 wrote to memory of 1180 4168 PDF.FaturaDetay_202407.exe 86 PID 1180 wrote to memory of 2080 1180 cmd.exe 88 PID 1180 wrote to memory of 2080 1180 cmd.exe 88 PID 1180 wrote to memory of 2080 1180 cmd.exe 88 PID 2080 wrote to memory of 3528 2080 powershell.exe 90 PID 2080 wrote to memory of 3528 2080 powershell.exe 90 PID 2080 wrote to memory of 3528 2080 powershell.exe 90 PID 3528 wrote to memory of 2960 3528 powershell.exe 91 PID 3528 wrote to memory of 2960 3528 powershell.exe 91 PID 3528 wrote to memory of 2960 3528 powershell.exe 91 PID 2960 wrote to memory of 2120 2960 RootDesign.exe 94 PID 2960 wrote to memory of 2120 2960 RootDesign.exe 94 PID 2960 wrote to memory of 2120 2960 RootDesign.exe 94 PID 2120 wrote to memory of 2996 2120 RootDesign.exe 95 PID 2120 wrote to memory of 2996 2120 RootDesign.exe 95 PID 2120 wrote to memory of 2996 2120 RootDesign.exe 95 PID 2996 wrote to memory of 2252 2996 RootDesign.exe 97 PID 2996 wrote to memory of 2252 2996 RootDesign.exe 97 PID 2996 wrote to memory of 2252 2996 RootDesign.exe 97 PID 2252 wrote to memory of 4912 2252 RootDesign.exe 98 PID 2252 wrote to memory of 4912 2252 RootDesign.exe 98 PID 2252 wrote to memory of 4912 2252 RootDesign.exe 98 PID 4912 wrote to memory of 452 4912 RootDesign.exe 99 PID 4912 wrote to memory of 452 4912 RootDesign.exe 99 PID 4912 wrote to memory of 452 4912 RootDesign.exe 99 PID 452 wrote to memory of 4612 452 RootDesign.exe 100 PID 452 wrote to memory of 4612 452 RootDesign.exe 100 PID 452 wrote to memory of 4612 452 RootDesign.exe 100 PID 4612 wrote to memory of 1452 4612 RootDesign.exe 101 PID 4612 wrote to memory of 1452 4612 RootDesign.exe 101 PID 4612 wrote to memory of 1452 4612 RootDesign.exe 101 PID 1452 wrote to memory of 1620 1452 RootDesign.exe 102 PID 1452 wrote to memory of 1620 1452 RootDesign.exe 102 PID 1452 wrote to memory of 1620 1452 RootDesign.exe 102 PID 1620 wrote to memory of 2500 1620 RootDesign.exe 103 PID 1620 wrote to memory of 2500 1620 RootDesign.exe 103 PID 1620 wrote to memory of 2500 1620 RootDesign.exe 103 PID 2500 wrote to memory of 3092 2500 RootDesign.exe 105 PID 2500 wrote to memory of 3092 2500 RootDesign.exe 105 PID 2500 wrote to memory of 3092 2500 RootDesign.exe 105 PID 3092 wrote to memory of 4576 3092 RootDesign.exe 106 PID 3092 wrote to memory of 4576 3092 RootDesign.exe 106 PID 3092 wrote to memory of 4576 3092 RootDesign.exe 106 PID 4576 wrote to memory of 3884 4576 RootDesign.exe 107 PID 4576 wrote to memory of 3884 4576 RootDesign.exe 107 PID 4576 wrote to memory of 3884 4576 RootDesign.exe 107 PID 3884 wrote to memory of 1940 3884 RootDesign.exe 108 PID 3884 wrote to memory of 1940 3884 RootDesign.exe 108 PID 3884 wrote to memory of 1940 3884 RootDesign.exe 108 PID 1940 wrote to memory of 4392 1940 RootDesign.exe 109 PID 1940 wrote to memory of 4392 1940 RootDesign.exe 109 PID 1940 wrote to memory of 4392 1940 RootDesign.exe 109 PID 4392 wrote to memory of 4560 4392 RootDesign.exe 110 PID 4392 wrote to memory of 4560 4392 RootDesign.exe 110 PID 4392 wrote to memory of 4560 4392 RootDesign.exe 110 PID 4560 wrote to memory of 1396 4560 RootDesign.exe 111 PID 4560 wrote to memory of 1396 4560 RootDesign.exe 111 PID 4560 wrote to memory of 1396 4560 RootDesign.exe 111 PID 1396 wrote to memory of 4912 1396 RootDesign.exe 112 PID 1396 wrote to memory of 4912 1396 RootDesign.exe 112 PID 1396 wrote to memory of 4912 1396 RootDesign.exe 112 PID 4912 wrote to memory of 452 4912 RootDesign.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDF.FaturaDetay_202407.exe"C:\Users\Admin\AppData\Local\Temp\PDF.FaturaDetay_202407.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe2⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"10⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:452 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"23⤵
- Executes dropped EXE
PID:452 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"24⤵
- Executes dropped EXE
PID:3660 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"25⤵
- Executes dropped EXE
PID:1452 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"26⤵
- Executes dropped EXE
PID:1036 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"27⤵
- Executes dropped EXE
PID:4488 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
PID:3576 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"29⤵
- Executes dropped EXE
PID:4336 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"30⤵
- Executes dropped EXE
PID:2860 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"31⤵
- Executes dropped EXE
PID:4496 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"32⤵
- Executes dropped EXE
PID:3484 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"33⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"34⤵
- Executes dropped EXE
PID:3648 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"35⤵
- Executes dropped EXE
PID:3492 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"36⤵
- Executes dropped EXE
PID:2780 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"37⤵
- Executes dropped EXE
PID:2232 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"38⤵
- Executes dropped EXE
PID:3164 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"39⤵
- Executes dropped EXE
PID:1172 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"40⤵
- Executes dropped EXE
PID:4876 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"41⤵
- Executes dropped EXE
PID:3988 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"42⤵
- Executes dropped EXE
PID:3776 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"43⤵
- Executes dropped EXE
PID:3656 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"44⤵
- Executes dropped EXE
PID:1340 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"45⤵
- Executes dropped EXE
PID:3088 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"46⤵
- Executes dropped EXE
PID:2872 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"47⤵
- Executes dropped EXE
PID:4376 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"48⤵
- Executes dropped EXE
PID:5032 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"49⤵
- Executes dropped EXE
PID:2188 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"50⤵
- Executes dropped EXE
PID:4672 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"51⤵
- Executes dropped EXE
PID:2860 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
PID:3224 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"53⤵
- Executes dropped EXE
PID:2612 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"54⤵
- Executes dropped EXE
PID:1664 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"55⤵
- Executes dropped EXE
PID:1936 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"56⤵
- Executes dropped EXE
PID:2516 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"57⤵
- Executes dropped EXE
PID:4408 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"58⤵
- Executes dropped EXE
PID:3132 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"59⤵
- Executes dropped EXE
PID:5072 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
PID:2892 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"61⤵
- Executes dropped EXE
PID:3020 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"62⤵
- Executes dropped EXE
PID:5088 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"63⤵
- Executes dropped EXE
PID:2188 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"64⤵
- Executes dropped EXE
PID:4704 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"65⤵
- Executes dropped EXE
PID:2040 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"66⤵
- Executes dropped EXE
PID:4344 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"67⤵
- Executes dropped EXE
PID:3084 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"68⤵
- Executes dropped EXE
PID:1340 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"69⤵PID:4512
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"70⤵PID:2220
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"71⤵PID:4568
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"72⤵PID:2248
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"73⤵PID:4308
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"74⤵PID:4520
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"75⤵PID:3500
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"76⤵PID:1676
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"77⤵PID:1224
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"78⤵PID:3756
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"79⤵PID:1596
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"80⤵PID:4608
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"81⤵
- Checks computer location settings
PID:312 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"82⤵PID:3956
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"83⤵PID:3088
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"84⤵PID:3392
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"85⤵PID:3648
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"86⤵PID:1804
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"87⤵PID:1248
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"88⤵PID:3760
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"89⤵PID:4560
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"90⤵PID:1984
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"91⤵PID:4680
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"92⤵PID:4604
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"93⤵PID:4052
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"94⤵PID:640
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"95⤵PID:4840
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"96⤵PID:3992
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"97⤵PID:1776
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"98⤵PID:464
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"99⤵PID:4928
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"100⤵PID:3080
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"101⤵PID:2856
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"102⤵PID:1944
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"103⤵PID:3872
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"104⤵PID:1368
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"105⤵PID:4872
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"106⤵PID:2884
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"107⤵PID:4620
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"108⤵PID:2036
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"109⤵PID:2548
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"110⤵PID:3152
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"111⤵PID:4368
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"112⤵PID:400
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"113⤵PID:2148
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"114⤵PID:1876
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"115⤵PID:4456
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"116⤵
- Checks computer location settings
PID:4128 -
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"117⤵PID:4704
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"118⤵PID:1180
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"119⤵PID:4404
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"120⤵PID:3528
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"121⤵PID:2460
-
C:\TheDream\RootDesign.exe"C:\TheDream\RootDesign.exe"122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-