004c59e17178ebbc86da08ea93eb39064a86f5d1be7c18d330c15f80dde8504b

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads/PDF.FaturaDetay_202407.exe
Size

322KB
MD5

3a2ba5be087162cfdb5d49ac32edd534
SHA1

879043e2954c4cf7f461c1381ae2a943d71bbaef
SHA256

7a285458817660143004002c76b1e1457666b1659dfbd35863541f62630430d0
SHA512

ba8dba7d1cd39b00cf6ee894809b1c09a3f72484d6dafb4ff2b2663d29247baf0565dfc3e4f0bcccb78138ffca59e9c56579485244d00f5b1bc69cfedb1c024a
SSDEEP

6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BLGx1d0RjzV5Pnz63LLHBNy:kANwRo+mv8QD4+0V16xblLPkLLhNy

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.mail.ru
Port:
587
Username:
[email protected]
Password:
9b0P96R6nBreNQrU3Cte

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3016	powershell.exe

Checks computer location settings 2 TTPs 39 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	PDF.FaturaDetay_202407.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RootDesign.exe

Executes dropped EXE 39 IoCs

pid	Process
5096	RootDesign.exe
3444	RootDesign.exe
3144	RootDesign.exe
4580	RootDesign.exe
4980	RootDesign.exe
1924	RootDesign.exe
3480	RootDesign.exe
4112	RootDesign.exe
5072	RootDesign.exe
3172	RootDesign.exe
3108	RootDesign.exe
4124	RootDesign.exe
2568	RootDesign.exe
4580	RootDesign.exe
4736	RootDesign.exe
2776	RootDesign.exe
1376	RootDesign.exe
2832	RootDesign.exe
4000	RootDesign.exe
1672	RootDesign.exe
2984	RootDesign.exe
5104	RootDesign.exe
3640	RootDesign.exe
4104	RootDesign.exe
1944	RootDesign.exe
384	RootDesign.exe
3496	RootDesign.exe
692	RootDesign.exe
1480	RootDesign.exe
5036	RootDesign.exe
4064	RootDesign.exe
1888	RootDesign.exe
2820	RootDesign.exe
4844	RootDesign.exe
3120	RootDesign.exe
3276	RootDesign.exe
2476	RootDesign.exe
852	RootDesign.exe
4392	RootDesign.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUqdates = "C:\\TheDream\\RootDesign.exe"	RootDesign.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2780	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3016	powershell.exe
3016	powershell.exe
4932	powershell.exe
4932	powershell.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	3444	RootDesign.exe
Token: SeDebugPrivilege	3144	RootDesign.exe
Token: SeDebugPrivilege	4580	RootDesign.exe
Token: SeDebugPrivilege	4980	RootDesign.exe
Token: SeDebugPrivilege	1924	RootDesign.exe
Token: SeDebugPrivilege	3480	RootDesign.exe
Token: SeDebugPrivilege	4112	RootDesign.exe
Token: SeDebugPrivilege	5072	RootDesign.exe
Token: SeDebugPrivilege	3172	RootDesign.exe
Token: SeDebugPrivilege	3108	RootDesign.exe
Token: SeDebugPrivilege	4124	RootDesign.exe
Token: SeDebugPrivilege	2568	RootDesign.exe
Token: SeDebugPrivilege	4580	RootDesign.exe
Token: SeDebugPrivilege	4736	RootDesign.exe
Token: SeDebugPrivilege	2776	RootDesign.exe
Token: SeDebugPrivilege	1376	RootDesign.exe
Token: SeDebugPrivilege	2832	RootDesign.exe
Token: SeDebugPrivilege	4000	RootDesign.exe
Token: SeDebugPrivilege	1672	RootDesign.exe
Token: SeDebugPrivilege	2984	RootDesign.exe
Token: SeDebugPrivilege	5104	RootDesign.exe
Token: SeDebugPrivilege	3640	RootDesign.exe
Token: SeDebugPrivilege	4104	RootDesign.exe
Token: SeDebugPrivilege	1944	RootDesign.exe
Token: SeDebugPrivilege	384	RootDesign.exe
Token: SeDebugPrivilege	3496	RootDesign.exe
Token: SeDebugPrivilege	692	RootDesign.exe
Token: SeDebugPrivilege	1480	RootDesign.exe
Token: SeDebugPrivilege	5036	RootDesign.exe
Token: SeDebugPrivilege	4064	RootDesign.exe
Token: SeDebugPrivilege	1888	RootDesign.exe
Token: SeDebugPrivilege	2820	RootDesign.exe
Token: SeDebugPrivilege	4844	RootDesign.exe
Token: SeDebugPrivilege	3120	RootDesign.exe
Token: SeDebugPrivilege	3276	RootDesign.exe
Token: SeDebugPrivilege	2476	RootDesign.exe
Token: SeDebugPrivilege	852	RootDesign.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2780	4632	PDF.FaturaDetay_202407.exe	84
PID 4632 wrote to memory of 2780	4632	PDF.FaturaDetay_202407.exe	84
PID 4632 wrote to memory of 2780	4632	PDF.FaturaDetay_202407.exe	84
PID 2780 wrote to memory of 3016	2780	cmd.exe	86
PID 2780 wrote to memory of 3016	2780	cmd.exe	86
PID 2780 wrote to memory of 3016	2780	cmd.exe	86
PID 3016 wrote to memory of 4932	3016	powershell.exe	87
PID 3016 wrote to memory of 4932	3016	powershell.exe	87
PID 3016 wrote to memory of 4932	3016	powershell.exe	87
PID 4932 wrote to memory of 5096	4932	powershell.exe	88
PID 4932 wrote to memory of 5096	4932	powershell.exe	88
PID 4932 wrote to memory of 5096	4932	powershell.exe	88
PID 5096 wrote to memory of 3444	5096	RootDesign.exe	91
PID 5096 wrote to memory of 3444	5096	RootDesign.exe	91
PID 5096 wrote to memory of 3444	5096	RootDesign.exe	91
PID 3444 wrote to memory of 3144	3444	RootDesign.exe	92
PID 3444 wrote to memory of 3144	3444	RootDesign.exe	92
PID 3444 wrote to memory of 3144	3444	RootDesign.exe	92
PID 3144 wrote to memory of 4580	3144	RootDesign.exe	93
PID 3144 wrote to memory of 4580	3144	RootDesign.exe	93
PID 3144 wrote to memory of 4580	3144	RootDesign.exe	93
PID 4580 wrote to memory of 4980	4580	RootDesign.exe	94
PID 4580 wrote to memory of 4980	4580	RootDesign.exe	94
PID 4580 wrote to memory of 4980	4580	RootDesign.exe	94
PID 4980 wrote to memory of 1924	4980	RootDesign.exe	96
PID 4980 wrote to memory of 1924	4980	RootDesign.exe	96
PID 4980 wrote to memory of 1924	4980	RootDesign.exe	96
PID 1924 wrote to memory of 3480	1924	RootDesign.exe	97
PID 1924 wrote to memory of 3480	1924	RootDesign.exe	97
PID 1924 wrote to memory of 3480	1924	RootDesign.exe	97
PID 3480 wrote to memory of 4112	3480	RootDesign.exe	100
PID 3480 wrote to memory of 4112	3480	RootDesign.exe	100
PID 3480 wrote to memory of 4112	3480	RootDesign.exe	100
PID 4112 wrote to memory of 5072	4112	RootDesign.exe	101
PID 4112 wrote to memory of 5072	4112	RootDesign.exe	101
PID 4112 wrote to memory of 5072	4112	RootDesign.exe	101
PID 5072 wrote to memory of 3172	5072	RootDesign.exe	102
PID 5072 wrote to memory of 3172	5072	RootDesign.exe	102
PID 5072 wrote to memory of 3172	5072	RootDesign.exe	102
PID 3172 wrote to memory of 3108	3172	RootDesign.exe	104
PID 3172 wrote to memory of 3108	3172	RootDesign.exe	104
PID 3172 wrote to memory of 3108	3172	RootDesign.exe	104
PID 3108 wrote to memory of 4124	3108	RootDesign.exe	105
PID 3108 wrote to memory of 4124	3108	RootDesign.exe	105
PID 3108 wrote to memory of 4124	3108	RootDesign.exe	105
PID 4124 wrote to memory of 2568	4124	RootDesign.exe	106
PID 4124 wrote to memory of 2568	4124	RootDesign.exe	106
PID 4124 wrote to memory of 2568	4124	RootDesign.exe	106
PID 2568 wrote to memory of 4580	2568	RootDesign.exe	107
PID 2568 wrote to memory of 4580	2568	RootDesign.exe	107
PID 2568 wrote to memory of 4580	2568	RootDesign.exe	107
PID 4580 wrote to memory of 4736	4580	RootDesign.exe	108
PID 4580 wrote to memory of 4736	4580	RootDesign.exe	108
PID 4580 wrote to memory of 4736	4580	RootDesign.exe	108
PID 4736 wrote to memory of 2776	4736	RootDesign.exe	109
PID 4736 wrote to memory of 2776	4736	RootDesign.exe	109
PID 4736 wrote to memory of 2776	4736	RootDesign.exe	109
PID 2776 wrote to memory of 1376	2776	RootDesign.exe	110
PID 2776 wrote to memory of 1376	2776	RootDesign.exe	110
PID 2776 wrote to memory of 1376	2776	RootDesign.exe	110
PID 1376 wrote to memory of 2832	1376	RootDesign.exe	111
PID 1376 wrote to memory of 2832	1376	RootDesign.exe	111
PID 1376 wrote to memory of 2832	1376	RootDesign.exe	111
PID 2832 wrote to memory of 4000	2832	RootDesign.exe	112

C:\Users\Admin\AppData\Local\Temp\Downloads\PDF.FaturaDetay_202407.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads\PDF.FaturaDetay_202407.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5096
      - C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5104
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4104
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3496
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        35⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        36⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        37⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        38⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        39⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3120
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        40⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3276
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        41⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        42⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:852
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        43⤵
        Executes dropped EXE
        
        PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\TheDream\RootDesign.exe

Filesize
125KB

MD5
e739795e2208eb8e10ee98b92b52a5ca

SHA1
0ac1bd3681544350158ff9d7c44d1732b5673178

SHA256
bbda59896347af0b13c361b9fb97c42c1903e1cd1fad498c8192416c408139c5

SHA512
ff39f09fc65d6bad6b6a5d555c453ee7a29fdb8d7e16dc4ef08cb9a3b2b0d14558dc379a87e5e170752fdac56192b1d677cbb447a880e6c0fca5f0110b63c062

Download Submit
C:\TheDream\log.txt

Filesize
126B

MD5
9c788766645324a0544e77719ec74f3a

SHA1
eb36e2b9af2f1de97a418296451264a6d09432be

SHA256
9ad1ed6a02b72803f122eacbe8792e95203c8279ebf94de62efe73ed2de65cbb

SHA512
05a3a842d35cee353673ef896e9c7b088177174b8a996a80239bfd1aa140596f6350a549908647c6a18f72e06906819d4fd168c71af61ef17c9ae2f8f3780f71

Download Submit
C:\TheDream\log.txt

Filesize
141B

MD5
118034be4e5e40b9ce26a21d9ad8ddab

SHA1
dca2c9ab97dcbab2d136857390414008407d89b7

SHA256
061b921670f8074f883322dbec91032cf1361478d3b591e6cadcbcbb1f904b2a

SHA512
2d46565fc0fdbe19f8b803732be2615b1deceaf75b31291632100dee195ad5672abc2769d1118ea7e32c7ebb6233c94e0880d45c16143c2daa20ff9eea52d8e7

Download Submit
C:\TheDream\log.txt

Filesize
156B

MD5
d1a57c397a25bd33239a9e20bb372a15

SHA1
76f6838bda773ef6b1a2f2c1e7dee224ab640664

SHA256
0a8e94f53a69120617d3822d5cd7204e05e49d3ac6916eaa64b470acc2b0086a

SHA512
648dcad1420e2179f93f1d441616dc3982fa7a355d40c034189d74a912bb455240554163ade355c79d1c1854e0f80ab96c0e0ca3f3a6ec6e9d2232c0a9730a43

Download Submit
C:\TheDream\log.txt

Filesize
171B

MD5
c1f51041209cbfec0334e239bc1ad217

SHA1
8550018103fefafba93194991d78dc18dd1416ab

SHA256
6fe037658176983359670a656fd6b7f4db37f7fe3416b820957b3a8e0d2bbcac

SHA512
cfcd3809de7aa26976f5137b8db3c26e1c6893bec35674b0aabb04a40976bea2c64cbf6f4ca5c05c4815eca25149cd7e37f8ec6088c6e8f775652c67d6d0b607

Download Submit
C:\TheDream\log.txt

Filesize
186B

MD5
4c00afd71023ba478000bebcedc18ce1

SHA1
48c2e96900a77ed12b9f018c0cb6c4bed9600540

SHA256
db91a04852099fcb2eb6df76ffae528474d40059d1c4eb0733bf9306143bf59a

SHA512
939e9d634cd61a3a62e3135764c5f8b0d623861d4a08d5c9e06fe3742bfd17cd170e609cf1b3e26e3044bc89171de7398d7d7bfe2447df7482f07c16216f9b1a

Download Submit
C:\TheDream\log.txt

Filesize
201B

MD5
d81260f1a679fa6fcf4c8698ecb58615

SHA1
97393533bdab3cf9ca777005534ab20310b676e6

SHA256
60062ce5031928dfcba5f6be15e406d48aa80fc70bd733392cceaed28d35e5bf

SHA512
51fd70e018793254cc14ca9b73dfa906febee8c14bedce65f319fd8ce0dc7fb5fdf53b212858b2cff166f01baaa70dd81412a4b67437587e7e7271a764d1d44e

Download Submit
C:\TheDream\log.txt

Filesize
216B

MD5
3df1eb5853271b2381dbf8b3737b912f

SHA1
edf414a969e2adb571a4308f9dc2e37bc2933bd3

SHA256
de27b1700a5ed82ce7653add18b7b86bf5646f773bff58f7744b280caedeed1c

SHA512
b4dee8e4cab792cef18bf75231a92e581068df199bdf6d1510ed85318fa2f1831d556d0568ec7030e6ccf44b3226d9a7a287c7515cedbf2f56a8b1891fa3e635

Download Submit
C:\TheDream\log.txt

Filesize
231B

MD5
282981667ba6bac6afd18a3ab776797e

SHA1
2db1b62a24453b83353dfe4dec0ee49ee050b45e

SHA256
ba763d236358af8478d39c5b48382719a400440bdc2b62854bad81cccc463314

SHA512
4ba8fb9ceb6f13811830ee8a17b0adb77b4caa44707b515bf098d931740d2c07e5718837baa81e733149f13d5f8f7098bd2dd96d0eb2750835bcb8901e9ddccb

Download Submit
C:\TheDream\log.txt

Filesize
246B

MD5
87e4c360ebcfd08363003abf4aae7120

SHA1
8ab3eb0093eced092b5d11add3707d54f414e0cd

SHA256
7b6527141909ead983b6dc0a49a4e49b312197c967c5156fd76c23529e091f7a

SHA512
a33fe940fdac6ae355a74d490fcc9d087f4cb2cee32add14dffee2d360368f179ef151a47d994315b0d495c0b8de2aaf056741c3684f7eeab518e4cb72b3f07e

Download Submit
C:\TheDream\log.txt

Filesize
261B

MD5
878f98a12c0326ec4471e4798f780b35

SHA1
859a9046fd75fe8dd052c566a668ec568be19f7a

SHA256
b8c1538f66af5f7fcc417e3d681500551863fd890b820a5a6ef681cff8e5cd24

SHA512
4762885eb474786475688853765fb7f8b2f6ae50f1260156eeccd29bcbdd9c144bbe7b391a2e53009ecd84b4c9065d7726b79b37fd54404da7c503d9fc118418

Download Submit
C:\TheDream\log.txt

Filesize
276B

MD5
68cc39cecebe491143d050c3cc8d527e

SHA1
54c4fdbe25e6db85c79b4f3de906f61cdc0b9cdf

SHA256
d242df5786f8bf5174a62bfee35247de102620c55ed84b5ab9fdbb45a22c8c64

SHA512
503b6de37d8b3b230a078f9eb1e3edb3dce9f9d164d398f466a5b63a6e1612c1c96924d7e3ee63ae4dc141bc1ccff44c7203227d5991fdcb32fd0a627a5f5c04

Download Submit
C:\TheDream\log.txt

Filesize
291B

MD5
d1b784b17308c42aba9a311bce9c5935

SHA1
1e921cc869479d6b9866dac53f07d19b640d60ff

SHA256
e1dcac57d7a601cb185354d2cc502bb08e8eee317bf0d598157fbb2cdc81c1c1

SHA512
dca23fe42136b891cee53592ea4d9af889d3d1fbdac44e2240a7327524f7670451d2e9033f348249570783ba920676bbfe62e38de0afc8fb4391b86b337f47b4

Download Submit
C:\TheDream\log.txt

Filesize
306B

MD5
611d11e13c47eff2f31b1b55d334ad8c

SHA1
0451f32aa2acb08b702611f6829011af27a144da

SHA256
6c7b8c9c3c78ef2e6d640794e1f7663ef3e68e9bb2bebeaac418f06acfa8af91

SHA512
76b1f604c6ca8b2492ecdf59c6959257aa4519150f76917c7395879f245b71093dbfb09d656968d9a084e515daa28b5f76143c16df2c4a4a34bf360f4ea5874d

Download Submit
C:\TheDream\log.txt

Filesize
21B

MD5
3c232254a15022c8bccc67a163f2ce5a

SHA1
bd82a81e9048be79ae2b5513333d9bb9c6325999

SHA256
2af33a3f0aba7bfc582cceab6baece188696c0ab08940acb8dbe086b48e6a589

SHA512
67793fbb1dd2dde93a85bd830884ad02cac37dfd7bbb92ceb591dd866fc9e0663ab8941d8c43dc144134b661b0c7009f6f7bfbc8aa023c86d30fbe7f9bde6c18

Download Submit
C:\TheDream\log.txt

Filesize
36B

MD5
a5b0591b2f70456da9cd02ef7b388049

SHA1
c4436deecb44292acdb1aaf6e594f81f87bbd59a

SHA256
4dc16645122903c5a02cbc562d46e9b0167a4df03a7d4f331237ab299934f717

SHA512
33226836f1f8546ca287138f647062c5d2cd9f3f735020e93941a786ebd1f381bad3b486624b52c57dd62957bccb36c1c4fb5256f9cd40981647d8f04750de4c

Download Submit
C:\TheDream\log.txt

Filesize
51B

MD5
4bf48e46840fb716c7f67cb15aaf0640

SHA1
57871bd1a9084f3d16582e3a4b367e729d43f072

SHA256
71ed11b127d1bde7c75ca3e5af17c70106e8b07c728f72eaa7a0fb7186621912

SHA512
b94021a7acf4ff4190ad70823b2560952b8f683da580a1365e13a3157799b9cfb73f51bad43f2c91b78c6d34a75db84c032cef0cfd529f70a13b0005525d64de

Download Submit
C:\TheDream\log.txt

Filesize
66B

MD5
01c596cbd77a920982c9cd4d4cca3d12

SHA1
fb442b56ed6545dc6f7395ec46dacb56d084b141

SHA256
9497780664233254a6b3785a48367c6cc9cbac3b7e712c0fcf6e239d7814d842

SHA512
0e94b4b795b0f376ff5efe59f6bd1463b588a8c1154ed0b8956b0e988f93529455a69283ce1e55f2637c73fbf7dd5eaa23a45e97da4f430688c7f6eccdce29ff

Download Submit
C:\TheDream\log.txt

Filesize
81B

MD5
4e0e0807884f3f21019a28701e2f33be

SHA1
c7207484837fe1b7957a2c94a7b77fbf2e517189

SHA256
80bda00796a2d7812ffb3106d337d8e86e4184f3b31ad33f4e2093109f890107

SHA512
0e4e5547896849d969f38ebcd8041f7d427e017fb7581767763bd7ea1a36d96c8818ad1e2c06b14cfb557eaaff74de0fdd8393d4376539ac80fb4468751bc404

Download Submit
C:\TheDream\log.txt

Filesize
96B

MD5
45c561fb2c15620a9640782fc40cd2b1

SHA1
1a1f745124bdb30331ea1c37ab53f8eca2412d07

SHA256
312c7fabec8778052a0cc9d10157026edfd64aa240a94be5ff18fcb5432b384c

SHA512
af461ada8910472c8df94e7036be02ffc3b781e0a443ee9b37cf2aaeaac8069c7e064151fe0140fe9ff6f5652f709102d0b5bbf99e572037707e1a7a14d55923

Download Submit
C:\TheDream\log.txt

Filesize
111B

MD5
332fea85597750aeddd99a600e4e4867

SHA1
ccab3db9f1992a70b80bf6e2cf594bdb6e1ea908

SHA256
371ba0e39642c50ce5a370eb59535c1f1fc1ecfbb7cd90855bc6d1ff64ab7650

SHA512
3ff40fc03416165708bda4736f17e3fdfb8df8b5587bf773c7716175b35f07cdaa792af500b22318a5a3fe44d51e4edcde290adf15993f4c24a8607c0c389c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RootDesign.exe.log

Filesize
1KB

MD5
96cca7a6ce0df83a5eaacad47f26e6c0

SHA1
a203126275c74e9974ba23a1269e8f5104b134b3

SHA256
e29461f622da1d1f9e37466f5dc1f96bb10621454cffc5fd4dc73ae2f973d344

SHA512
11dc5cfdf4ed957fc8ebc4894ff8e2cbbd64864032159625bd6b92daa16053cad12cb61c17416a55b76c3722174cf751bd108665402ea426225670589520cacb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
28854213fdaa59751b2b4cfe772289cc

SHA1
fa7058052780f4b856dc2d56b88163ed55deb6ab

SHA256
7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

SHA512
1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
a0413d1621734695a906139c3105b929

SHA1
41552da253af813b70535d7b8233da9dcdc84f9c

SHA256
c478038061d64afec93a6bcb4e225650dd62cce9f2af3782a5efa723f460c986

SHA512
1f15c0bbad4b7e57a1b77ca660ebd195f785d0fc77582e8c12288c2c8637e9b6854a032d3baeb61dd3fe94177afec7cc8201ad7242261657953ec96b4848a487

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kokrleb0.xuq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\readme.txt

Filesize
1KB

MD5
934c538703a8d75fc9452968bd4153e4

SHA1
f85647d373dcafe1dc6c54d2fef2a6cb192a5172

SHA256
04ead23fabb8ebae8d2e271624b5059a89300c6ae824469b671d26dc5d72208d

SHA512
7112ac70c40ab61bfa68151ac78ff6ebee02ee8a61869ae0f083bd5fbc8d22ff585ecbb59156694cf17072363d4ffb4bf1bb51b9194e697e1bf1827f79ac0c05

Download Submit
memory/3016-19-0x0000000072950000-0x0000000073100000-memory.dmp

Filesize
7.7MB

Download
memory/3016-21-0x0000000004CE0000-0x0000000004D46000-memory.dmp

Filesize
408KB

Download
memory/3016-22-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download
memory/3016-60-0x0000000072950000-0x0000000073100000-memory.dmp

Filesize
7.7MB

Download
memory/3016-20-0x0000000004C40000-0x0000000004C62000-memory.dmp

Filesize
136KB

Download
memory/3016-15-0x000000007295E000-0x000000007295F000-memory.dmp

Filesize
4KB

Download
memory/3016-32-0x0000000005670000-0x00000000059C4000-memory.dmp

Filesize
3.3MB

Download
memory/3016-33-0x0000000005C10000-0x0000000005C2E000-memory.dmp

Filesize
120KB

Download
memory/3016-34-0x0000000005C60000-0x0000000005CAC000-memory.dmp

Filesize
304KB

Download
memory/3016-17-0x0000000004E60000-0x0000000005488000-memory.dmp

Filesize
6.2MB

Download
memory/3016-18-0x0000000072950000-0x0000000073100000-memory.dmp

Filesize
7.7MB

Download
memory/3016-16-0x0000000002630000-0x0000000002666000-memory.dmp

Filesize
216KB

Download
memory/4632-62-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4932-35-0x0000000072950000-0x0000000073100000-memory.dmp

Filesize
7.7MB

Download
memory/4932-52-0x0000000072950000-0x0000000073100000-memory.dmp

Filesize
7.7MB

Download
memory/4932-46-0x0000000072950000-0x0000000073100000-memory.dmp

Filesize
7.7MB

Download
memory/4932-36-0x0000000072950000-0x0000000073100000-memory.dmp

Filesize
7.7MB

Download
memory/5096-63-0x0000000002790000-0x000000000279A000-memory.dmp

Filesize
40KB

Download
memory/5096-54-0x000000000AA40000-0x000000000AFE4000-memory.dmp

Filesize
5.6MB

Download
memory/5096-59-0x000000000A6D0000-0x000000000A6F2000-memory.dmp

Filesize
136KB

Download
memory/5096-58-0x000000000A630000-0x000000000A6C2000-memory.dmp

Filesize
584KB

Download
memory/5096-53-0x0000000000F50000-0x0000000000F56000-memory.dmp

Filesize
24KB

Download
memory/5096-49-0x00000000005A0000-0x00000000005C8000-memory.dmp

Filesize
160KB

Download