004c59e17178ebbc86da08ea93eb39064a86f5d1be7c18d330c15f80dde8504b

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads/1PDF.FaturaDetay_202407.exe
Size

323KB
MD5

d8bf792f818877bf4848fde9511caeb8
SHA1

a8aea1abb7cf1ddb275584bb5746c97790342e80
SHA256

f5d96127b34730cf3bbbccd1c35098873fc0af897cc5d6dc3dd39a8e64c511d7
SHA512

28292c32d518cecb66ef0a41f583022b6c125ae758fb013dd51896c25625cc23da2a8604d794e2198939f994d15bec09d9b67003bc5bd734d27b15b167e1ebe4
SSDEEP

6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BLtsorUC7ggXpTILMYSQpIIQENMshQt:kANwRo+mv8QD4+0V161tTNjkIIFN5c

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.mail.ru
Port:
587
Username:
[email protected]
Password:
9b0P96R6nBreNQrU3Cte

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2988	powershell.exe

Checks computer location settings 2 TTPs 38 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	1PDF.FaturaDetay_202407.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	RootDesign.exe

Executes dropped EXE 38 IoCs

pid	Process
3748	RootDesign.exe
3844	RootDesign.exe
4844	RootDesign.exe
4776	RootDesign.exe
2788	RootDesign.exe
4636	RootDesign.exe
1864	RootDesign.exe
848	RootDesign.exe
4364	RootDesign.exe
4100	RootDesign.exe
408	RootDesign.exe
4676	RootDesign.exe
2388	RootDesign.exe
4828	RootDesign.exe
3872	RootDesign.exe
2984	RootDesign.exe
2416	RootDesign.exe
4160	RootDesign.exe
720	RootDesign.exe
680	RootDesign.exe
4264	RootDesign.exe
2396	RootDesign.exe
3908	RootDesign.exe
2788	RootDesign.exe
3436	RootDesign.exe
1288	RootDesign.exe
1880	RootDesign.exe
3040	RootDesign.exe
2444	RootDesign.exe
3192	RootDesign.exe
3708	RootDesign.exe
4376	RootDesign.exe
3364	RootDesign.exe
4276	RootDesign.exe
1640	RootDesign.exe
4788	RootDesign.exe
3940	RootDesign.exe
1808	RootDesign.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUqdates = "C:\\TheDream\\RootDesign.exe"	RootDesign.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3316	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2988	powershell.exe
2988	powershell.exe
4804	powershell.exe
4804	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	4844	RootDesign.exe
Token: SeDebugPrivilege	4776	RootDesign.exe
Token: SeDebugPrivilege	2788	RootDesign.exe
Token: SeDebugPrivilege	4636	RootDesign.exe
Token: SeDebugPrivilege	1864	RootDesign.exe
Token: SeDebugPrivilege	848	RootDesign.exe
Token: SeDebugPrivilege	4364	RootDesign.exe
Token: SeDebugPrivilege	4100	RootDesign.exe
Token: SeDebugPrivilege	408	RootDesign.exe
Token: SeDebugPrivilege	4676	RootDesign.exe
Token: SeDebugPrivilege	2388	RootDesign.exe
Token: SeDebugPrivilege	4828	RootDesign.exe
Token: SeDebugPrivilege	3872	RootDesign.exe
Token: SeDebugPrivilege	2984	RootDesign.exe
Token: SeDebugPrivilege	2416	RootDesign.exe
Token: SeDebugPrivilege	4160	RootDesign.exe
Token: SeDebugPrivilege	720	RootDesign.exe
Token: SeDebugPrivilege	680	RootDesign.exe
Token: SeDebugPrivilege	4264	RootDesign.exe
Token: SeDebugPrivilege	2396	RootDesign.exe
Token: SeDebugPrivilege	3908	RootDesign.exe
Token: SeDebugPrivilege	2788	RootDesign.exe
Token: SeDebugPrivilege	3436	RootDesign.exe
Token: SeDebugPrivilege	1288	RootDesign.exe
Token: SeDebugPrivilege	1880	RootDesign.exe
Token: SeDebugPrivilege	3040	RootDesign.exe
Token: SeDebugPrivilege	2444	RootDesign.exe
Token: SeDebugPrivilege	3192	RootDesign.exe
Token: SeDebugPrivilege	3708	RootDesign.exe
Token: SeDebugPrivilege	4376	RootDesign.exe
Token: SeDebugPrivilege	3364	RootDesign.exe
Token: SeDebugPrivilege	4276	RootDesign.exe
Token: SeDebugPrivilege	1640	RootDesign.exe
Token: SeDebugPrivilege	4788	RootDesign.exe
Token: SeDebugPrivilege	3940	RootDesign.exe
Token: SeDebugPrivilege	1808	RootDesign.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 3316	3640	1PDF.FaturaDetay_202407.exe	86
PID 3640 wrote to memory of 3316	3640	1PDF.FaturaDetay_202407.exe	86
PID 3640 wrote to memory of 3316	3640	1PDF.FaturaDetay_202407.exe	86
PID 3316 wrote to memory of 2988	3316	cmd.exe	88
PID 3316 wrote to memory of 2988	3316	cmd.exe	88
PID 3316 wrote to memory of 2988	3316	cmd.exe	88
PID 2988 wrote to memory of 4804	2988	powershell.exe	89
PID 2988 wrote to memory of 4804	2988	powershell.exe	89
PID 2988 wrote to memory of 4804	2988	powershell.exe	89
PID 4804 wrote to memory of 3748	4804	powershell.exe	90
PID 4804 wrote to memory of 3748	4804	powershell.exe	90
PID 4804 wrote to memory of 3748	4804	powershell.exe	90
PID 3748 wrote to memory of 3844	3748	RootDesign.exe	93
PID 3748 wrote to memory of 3844	3748	RootDesign.exe	93
PID 3748 wrote to memory of 3844	3748	RootDesign.exe	93
PID 3844 wrote to memory of 4844	3844	RootDesign.exe	94
PID 3844 wrote to memory of 4844	3844	RootDesign.exe	94
PID 3844 wrote to memory of 4844	3844	RootDesign.exe	94
PID 4844 wrote to memory of 4776	4844	RootDesign.exe	95
PID 4844 wrote to memory of 4776	4844	RootDesign.exe	95
PID 4844 wrote to memory of 4776	4844	RootDesign.exe	95
PID 4776 wrote to memory of 2788	4776	RootDesign.exe	96
PID 4776 wrote to memory of 2788	4776	RootDesign.exe	96
PID 4776 wrote to memory of 2788	4776	RootDesign.exe	96
PID 2788 wrote to memory of 4636	2788	RootDesign.exe	97
PID 2788 wrote to memory of 4636	2788	RootDesign.exe	97
PID 2788 wrote to memory of 4636	2788	RootDesign.exe	97
PID 4636 wrote to memory of 1864	4636	RootDesign.exe	98
PID 4636 wrote to memory of 1864	4636	RootDesign.exe	98
PID 4636 wrote to memory of 1864	4636	RootDesign.exe	98
PID 1864 wrote to memory of 848	1864	RootDesign.exe	103
PID 1864 wrote to memory of 848	1864	RootDesign.exe	103
PID 1864 wrote to memory of 848	1864	RootDesign.exe	103
PID 848 wrote to memory of 4364	848	RootDesign.exe	105
PID 848 wrote to memory of 4364	848	RootDesign.exe	105
PID 848 wrote to memory of 4364	848	RootDesign.exe	105
PID 4364 wrote to memory of 4100	4364	RootDesign.exe	106
PID 4364 wrote to memory of 4100	4364	RootDesign.exe	106
PID 4364 wrote to memory of 4100	4364	RootDesign.exe	106
PID 4100 wrote to memory of 408	4100	RootDesign.exe	107
PID 4100 wrote to memory of 408	4100	RootDesign.exe	107
PID 4100 wrote to memory of 408	4100	RootDesign.exe	107
PID 408 wrote to memory of 4676	408	RootDesign.exe	108
PID 408 wrote to memory of 4676	408	RootDesign.exe	108
PID 408 wrote to memory of 4676	408	RootDesign.exe	108
PID 4676 wrote to memory of 2388	4676	RootDesign.exe	109
PID 4676 wrote to memory of 2388	4676	RootDesign.exe	109
PID 4676 wrote to memory of 2388	4676	RootDesign.exe	109
PID 2388 wrote to memory of 4828	2388	RootDesign.exe	110
PID 2388 wrote to memory of 4828	2388	RootDesign.exe	110
PID 2388 wrote to memory of 4828	2388	RootDesign.exe	110
PID 4828 wrote to memory of 3872	4828	RootDesign.exe	112
PID 4828 wrote to memory of 3872	4828	RootDesign.exe	112
PID 4828 wrote to memory of 3872	4828	RootDesign.exe	112
PID 3872 wrote to memory of 2984	3872	RootDesign.exe	113
PID 3872 wrote to memory of 2984	3872	RootDesign.exe	113
PID 3872 wrote to memory of 2984	3872	RootDesign.exe	113
PID 2984 wrote to memory of 2416	2984	RootDesign.exe	114
PID 2984 wrote to memory of 2416	2984	RootDesign.exe	114
PID 2984 wrote to memory of 2416	2984	RootDesign.exe	114
PID 2416 wrote to memory of 4160	2416	RootDesign.exe	115
PID 2416 wrote to memory of 4160	2416	RootDesign.exe	115
PID 2416 wrote to memory of 4160	2416	RootDesign.exe	115
PID 4160 wrote to memory of 720	4160	RootDesign.exe	116

C:\Users\Admin\AppData\Local\Temp\Downloads\1PDF.FaturaDetay_202407.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads\1PDF.FaturaDetay_202407.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:720
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        35⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3708
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        36⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        37⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3364
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        38⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        39⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        40⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4788
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        41⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3940
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\TheDream\RootDesign.exe

Filesize
126KB

MD5
ba563203779c4ad6b2e619c42463f4a8

SHA1
d85458664b6c971d2e24da84a2dbbb88a03fc542

SHA256
a5794b8e199ca1a7c35cb4d393282fde4a73e9f9190153e97a13eb9baf3a35e6

SHA512
6a6b85d228ac630f6468965d5b8c66d2f7edc07f1a18444debc22b46a7923fe7021e4219cb3513ac1996d6b36052d64455267836835f5df12961039a1b858849

Download Submit
C:\TheDream\log.txt

Filesize
123B

MD5
05f6ab189a1de6e6df6e38f5b0b8b4bd

SHA1
03d7d11d92abed5920c707f60ba581a76f9bd7ad

SHA256
ce9fbb33ac5f8ac3c5eb16837eaf74c913abe713888479ee8f08257f45f31a69

SHA512
67849b09a1a3c8114d250e61043f825e82d904349ae1a0e5e7e9f76e5933ddc48c2daa51308c475fec6df1c05b11ad6e8eb65ec71ecb904d4c26f48ca961ba50

Download Submit
C:\TheDream\log.txt

Filesize
138B

MD5
fa0440d87ec10af45f66333216844909

SHA1
2f1ff91d9a7f001176b06f3b70c4d593ed33c3d4

SHA256
c4fbf77cf6239d853c97644cf6aeeb959dcffb61ca9eed3a3605be66d198e451

SHA512
7d599131dd374b5359cb5cdc862af91ae90621c16ec2a5d35745330ddc8580ffd1322f50f6aa8c33cf83d732e031e93a980b34a11b162e5e798c6470b60c5f97

Download Submit
C:\TheDream\log.txt

Filesize
153B

MD5
c008ffc89a197bacb86718c0bd5c76bc

SHA1
048f4007285eee07ea2269e596cea941cc59725f

SHA256
0b72c619f792591166ca361aa368e1fea6201ad25c2e3141081e2b00aabee25b

SHA512
e36c579e6441528d7f02c5229a4ca989ffe52708ecd2ab2d976b5a6c55785b00202fae3d0431e12e428f3f45d0f74ae7b68e15c1b991139f17fdb1d14d5b3ec4

Download Submit
C:\TheDream\log.txt

Filesize
168B

MD5
4c1ac33e48afabde05f3b008972ce1fe

SHA1
7e8309854591cc4241505a07b0d96a6b05c957b7

SHA256
ed4fa850abf07403217302c8a0dbcd7027eac7adf89854cbd0a6b148c34b53ad

SHA512
1e71f789e68e31105922f13c4c16d8d71aeaaf81fe63655e7d5b0f3caf576ef012531b38c16fbf0cc259a610d2e7911822930f2276cad8f80ed757cc43d8cd62

Download Submit
C:\TheDream\log.txt

Filesize
183B

MD5
537b234acfbc03809e2ea6472eb85287

SHA1
b4ad167d8eae2a2aff0fcc820f392fad7fdfd10f

SHA256
ab2181424f65545b16d43254ef61929c13282f39d98c1aaca1de3f7ec15b1988

SHA512
038f35253b7ba243ff78973e2bdc1ed37633df87240baaf4504a7f9c0613ae2f5b2ca165f8234d0755a89e5f6304a16e86502f654014198186ae81d08b18ea3e

Download Submit
C:\TheDream\log.txt

Filesize
198B

MD5
8f35d2e08da3b2cea10bd75fa259d585

SHA1
b2ec34511c4dba3abf542b16ca90c0d8e516afe7

SHA256
914107c0ed2e0b015a775b549e6b472786c572bacadd5fdb566326da36f197c8

SHA512
884154ee90522f38bc0a9880b5426bf18b355f158f1c00b746fa6c2107693d9fe13e2a8e7580e1b2e736a88ab2b89a2dd3c890ab72c89342225a49d091ffb31e

Download Submit
C:\TheDream\log.txt

Filesize
213B

MD5
a3a64fa03717fce236b529388da4810a

SHA1
d528d26dd06d75cf655645693184d29df36b83a9

SHA256
f2cd16e4c354581c9c1a7dfbb54b1d7fb07527f9f1cd2939c9988e7063ecf0eb

SHA512
30cbcf8be1559609c813be64a3ced98f29c820a5ed2046b9220b1c61844209e5e46380cfc1bd8ed578f889473017735c5b918ab5f3847364e4ebe56abb5c0ae7

Download Submit
C:\TheDream\log.txt

Filesize
228B

MD5
36e40faf8d2fc5cfe7587619df070f76

SHA1
6ddb3826e9fa71a2039f6d5f3e2cbf2662ac6f9b

SHA256
7423e80426e2f68bd7a73a9581887e9335e8507dfc96235ea84e2435f4c4d719

SHA512
2ce0c910fc7b4fddc0b581848535f29e4a143eae5c3eed137284cf073f4e701f08a9c1d6bd3edf7a64fccb84e461ea8d4fd44c83e2b1b7ec2ead5dfb1540ed79

Download Submit
C:\TheDream\log.txt

Filesize
243B

MD5
f9395d0fd06e721bd306012019bee766

SHA1
48a8ea18ae462e80363c4f8ab571a904ae3952e1

SHA256
90a9ed42aca8a8ad9e119cdeeac1ea93b7139cf5005bfb2bca525d7fdd55a05b

SHA512
8559a12c72fab34f447d5d83b6a9843410652694ff07e253621489360a7e283f9fc2222754cf158bbb914711e7003b4e10c239645cb7a21077c1dee74325c238

Download Submit
C:\TheDream\log.txt

Filesize
258B

MD5
1812ffec7b7debca4297609676e95a96

SHA1
ca90e19c989368d0ad53c1727542d2a67c70619b

SHA256
a7723e54a18662360823b78fb33b2222455697be7acf2d1a32b58c72ea92d6b5

SHA512
cbae8c0410c3433726d00f14759ec0f33e6e2a8c2b2ace5ca139949cbf5a9044c822c24d12cf05501a4370da22429a437f84cbffa4569aa369d278eae5b6ca65

Download Submit
C:\TheDream\log.txt

Filesize
273B

MD5
bc0a4b5afb0338792bacb9f28d7a5e4f

SHA1
9b4d382b38a39412d5f6d10f7e333663f889ab1f

SHA256
55139ed0cefc15d1a80facdf56ae9d59f7491726cb58350c2d37ff807478c937

SHA512
f9dd9f56cfd7cdb71e8722ecc2a36b277484a4d3b21c7ea3423d7280a71fd0094519eb9abce151024c364547bf9f15a46e113dc12a76de161dfcf40a643a3402

Download Submit
C:\TheDream\log.txt

Filesize
288B

MD5
911c9cb987bb46b0e0be3426334e0742

SHA1
3fd61c2944ef955017f0554bd567063690f58d91

SHA256
33ad5b447a1b9fd43ce1f63dfba813206d2c2c5817b146299713b685eb19e7a7

SHA512
e1a3aab5d0338a69634b3df80376de842ba25dd2c0c68f74ce536568dfafc599a5e106c90f210eb512aa1272454064d58252a329f33e68be281ae7681c68f57f

Download Submit
C:\TheDream\log.txt

Filesize
303B

MD5
bdaa392b83894cac4b898ea5105f6f34

SHA1
80e368359b9143be9f813d3cd33bf86eed065fad

SHA256
cd9771f59de6f63c2d134af975dea142e67197dc0ac4a473d0c62b7d846e572c

SHA512
a6ac6429960da27eb82002ff6e1f7fcbf6821c8e4fe73f1ec7a1e9b24918c0393b0d2e5542ca8046721b4dd47e38821040ce670c52a8eeee10d7cf9a9dfa4cd2

Download Submit
C:\TheDream\log.txt

Filesize
17B

MD5
6973b88e8ca2c8c4ad67369cd211a49f

SHA1
cce768cc4a13cf8edd1841add873c2b0dea1738b

SHA256
b060331cb9f98d15d3fe25b8a311dc431c84a85bfa06426ad80cc3bef5b924ec

SHA512
35e2ddc683fea47325d6c7374a6a93faa71d52185b2f0f127a9cf7dec0f2347b12668eb668a267314443ed511b5e7d939f1f93640b9c6425fcc660d42f35d945

Download Submit
C:\TheDream\log.txt

Filesize
33B

MD5
b1eec1f4ab428032df8fe89e1126d0eb

SHA1
545171c320602c976b0fc13754ddbb307724e0aa

SHA256
c3b9233cb90ee38b6916f27a84fcbfbd70e7d59f792a4a191e5b6adb87ca75f1

SHA512
f5f624a15f1f6910c25e5c1f7b292345062378972c07106c64d7139def46ee3dea7e3b99ba4216c2cd7d84a7a82906b0092b97edff86865b5e73b12156edea1a

Download Submit
C:\TheDream\log.txt

Filesize
48B

MD5
1d89a8d548de37e16541372cc27300af

SHA1
5fd89d509296bf368c2e498a0bc72e04aea596f5

SHA256
93e10bc4fe7068fe7564384e1d32d850b97183d54067dcd7618c6c21aabb94fa

SHA512
ee0ff6bec74732277459a9a81e147e4dcc194fa8f5b57406b68424220b16f9b5ddf2a26c063566d1e120afbda37b59fc36adb94f1b7308989fa1055400e19258

Download Submit
C:\TheDream\log.txt

Filesize
63B

MD5
f81d9e83620c89bfde85ab2941bb0376

SHA1
1fbfcc09f799a24f82e678ca1c474e1ab1f63a52

SHA256
385d6c604a215eb5866ae59f63656fb58d0af0782156a1546de47682174807d7

SHA512
b12f842f8b9f2faf6b1bca1b637b4b54821b9a9c473974322cf3af80e6eac21e398ff16d03546a94733b94909e71553a45814a9dd669dfbb9b9c6a1dd0407a5b

Download Submit
C:\TheDream\log.txt

Filesize
78B

MD5
e5194869aa1e865bef36ee36b51aa863

SHA1
51e5896c5ae667ab0c3a6a7206a22d0332d2aa45

SHA256
4c8c1f2d9ef8192c3afd48d716c3c572acbde061dad28c93b96b4dd322094ee4

SHA512
ed523b4f21f15d1ce5c05b0856a58b45a51894e572f7dcafbc7ebb82fbf0164b9375635a0328636011e185f0b8874446c266a7591112abd23065457eb9f52747

Download Submit
C:\TheDream\log.txt

Filesize
93B

MD5
c750d058e9c023e7abe42af831492850

SHA1
d30e88ae6aff3de778ad8c220e2d59aae9aa3352

SHA256
4a0ba824e91f2ca7987a077f9fb81cae03b1fa9a1c2a7a67f79beea1c1b3e625

SHA512
f623b6a066702c86808b3bb1f57bcd505653eae75cf5b713043cd3f96b1acdbb2e7512455a00dd9d746ffea87afece5cdeee55371fc5baafcce892847e82129b

Download Submit
C:\TheDream\log.txt

Filesize
108B

MD5
d1a558e5ec2a77d45e9c9582ba8fa824

SHA1
23089dd277005ac0d9f2dfcebfbb0b502f9768d7

SHA256
b1c032cfce765a0dd494411169cf576d1d179ae7fe747b87229826abaa1f6d3a

SHA512
890e9fe98f9d497d79ee9c23d0cc00a093298989ee80e189b83f77fee6e46b662f8789643b1105d60289aadb2a0d1ff8771a3b1b1bc734d5b48f21e0d3ec64fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RootDesign.exe.log

Filesize
1KB

MD5
96cca7a6ce0df83a5eaacad47f26e6c0

SHA1
a203126275c74e9974ba23a1269e8f5104b134b3

SHA256
e29461f622da1d1f9e37466f5dc1f96bb10621454cffc5fd4dc73ae2f973d344

SHA512
11dc5cfdf4ed957fc8ebc4894ff8e2cbbd64864032159625bd6b92daa16053cad12cb61c17416a55b76c3722174cf751bd108665402ea426225670589520cacb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
28854213fdaa59751b2b4cfe772289cc

SHA1
fa7058052780f4b856dc2d56b88163ed55deb6ab

SHA256
7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

SHA512
1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
8fdc0f962a0217f948e328ff9a0bf55e

SHA1
7980626061dbd6f3bc483a359198b1536632b3a2

SHA256
ac1b074c2ca321fb9cf724c278b98148a9f32dc4c999f2f2ef10d072ee82ce15

SHA512
135e49bcbf4f54e445d10fb3ba15c9983e41514e18804c3a785427e64b1d05a81327fea2e04cfb59f9705dc5aa5eab068c915f600cb80e45caa3b56320729f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_huqt2cpr.5rv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\readme.txt

Filesize
1KB

MD5
934c538703a8d75fc9452968bd4153e4

SHA1
f85647d373dcafe1dc6c54d2fef2a6cb192a5172

SHA256
04ead23fabb8ebae8d2e271624b5059a89300c6ae824469b671d26dc5d72208d

SHA512
7112ac70c40ab61bfa68151ac78ff6ebee02ee8a61869ae0f083bd5fbc8d22ff585ecbb59156694cf17072363d4ffb4bf1bb51b9194e697e1bf1827f79ac0c05

Download Submit
memory/2988-34-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Filesize
304KB

Download
memory/2988-60-0x0000000073040000-0x00000000737F0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-20-0x0000000004F30000-0x0000000004F52000-memory.dmp

Filesize
136KB

Download
memory/2988-19-0x0000000073040000-0x00000000737F0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-22-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/2988-15-0x000000007304E000-0x000000007304F000-memory.dmp

Filesize
4KB

Download
memory/2988-32-0x0000000005B40000-0x0000000005E94000-memory.dmp

Filesize
3.3MB

Download
memory/2988-33-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Filesize
120KB

Download
memory/2988-18-0x0000000005190000-0x00000000057B8000-memory.dmp

Filesize
6.2MB

Download
memory/2988-21-0x00000000050D0000-0x0000000005136000-memory.dmp

Filesize
408KB

Download
memory/2988-17-0x0000000073040000-0x00000000737F0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-16-0x00000000025C0000-0x00000000025F6000-memory.dmp

Filesize
216KB

Download
memory/3640-63-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3748-59-0x00000000052A0000-0x00000000052C2000-memory.dmp

Filesize
136KB

Download
memory/3748-61-0x00000000051C0000-0x00000000051CA000-memory.dmp

Filesize
40KB

Download
memory/3748-55-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/3748-54-0x0000000009C90000-0x000000000A234000-memory.dmp

Filesize
5.6MB

Download
memory/3748-52-0x00000000028D0000-0x00000000028D6000-memory.dmp

Filesize
24KB

Download
memory/3748-49-0x0000000000780000-0x00000000007A8000-memory.dmp

Filesize
160KB

Download
memory/4804-53-0x0000000073040000-0x00000000737F0000-memory.dmp

Filesize
7.7MB

Download
memory/4804-37-0x0000000073040000-0x00000000737F0000-memory.dmp

Filesize
7.7MB

Download
memory/4804-36-0x0000000073040000-0x00000000737F0000-memory.dmp

Filesize
7.7MB

Download
memory/4804-35-0x0000000073040000-0x00000000737F0000-memory.dmp

Filesize
7.7MB

Download