c56c00ca3f42026f17affef76b3752f268d1498f862b3143985ca7c1d33feb39

Resubmissions

21-01-2025 11:18

250121-nef6aa1jfx 10

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PDF.FaturaDetay_202407.exe
Size

322KB
MD5

3a2ba5be087162cfdb5d49ac32edd534
SHA1

879043e2954c4cf7f461c1381ae2a943d71bbaef
SHA256

7a285458817660143004002c76b1e1457666b1659dfbd35863541f62630430d0
SHA512

ba8dba7d1cd39b00cf6ee894809b1c09a3f72484d6dafb4ff2b2663d29247baf0565dfc3e4f0bcccb78138ffca59e9c56579485244d00f5b1bc69cfedb1c024a
SSDEEP

6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BLGx1d0RjzV5Pnz63LLHBNy:kANwRo+mv8QD4+0V16xblLPkLLhNy

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
872	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RootDesign.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	PDF.FaturaDetay_202407.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RootDesign.exe

Executes dropped EXE 5 IoCs

pid	Process
4652	RootDesign.exe
4612	RootDesign.exe
2716	RootDesign.exe
1412	RootDesign.exe
1268	RootDesign.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUqdates = "C:\\TheDream\\RootDesign.exe"	RootDesign.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4476	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RootDesign.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RootDesign.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RootDesign.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RootDesign.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDF.FaturaDetay_202407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RootDesign.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
872	powershell.exe
872	powershell.exe
2548	powershell.exe
2548	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	4612	RootDesign.exe
Token: SeDebugPrivilege	2716	RootDesign.exe
Token: SeDebugPrivilege	1412	RootDesign.exe
Token: SeDebugPrivilege	1268	RootDesign.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4476	2152	PDF.FaturaDetay_202407.exe	81
PID 2152 wrote to memory of 4476	2152	PDF.FaturaDetay_202407.exe	81
PID 2152 wrote to memory of 4476	2152	PDF.FaturaDetay_202407.exe	81
PID 4476 wrote to memory of 872	4476	cmd.exe	83
PID 4476 wrote to memory of 872	4476	cmd.exe	83
PID 4476 wrote to memory of 872	4476	cmd.exe	83
PID 872 wrote to memory of 2548	872	powershell.exe	84
PID 872 wrote to memory of 2548	872	powershell.exe	84
PID 872 wrote to memory of 2548	872	powershell.exe	84
PID 2548 wrote to memory of 4652	2548	powershell.exe	85
PID 2548 wrote to memory of 4652	2548	powershell.exe	85
PID 2548 wrote to memory of 4652	2548	powershell.exe	85
PID 4652 wrote to memory of 4612	4652	RootDesign.exe	87
PID 4652 wrote to memory of 4612	4652	RootDesign.exe	87
PID 4652 wrote to memory of 4612	4652	RootDesign.exe	87
PID 4612 wrote to memory of 2716	4612	RootDesign.exe	96
PID 4612 wrote to memory of 2716	4612	RootDesign.exe	96
PID 4612 wrote to memory of 2716	4612	RootDesign.exe	96
PID 2716 wrote to memory of 1412	2716	RootDesign.exe	99
PID 2716 wrote to memory of 1412	2716	RootDesign.exe	99
PID 2716 wrote to memory of 1412	2716	RootDesign.exe	99
PID 1412 wrote to memory of 1268	1412	RootDesign.exe	101
PID 1412 wrote to memory of 1268	1412	RootDesign.exe	101
PID 1412 wrote to memory of 1268	1412	RootDesign.exe	101

C:\Users\Admin\AppData\Local\Temp\PDF.FaturaDetay_202407.exe
"C:\Users\Admin\AppData\Local\Temp\PDF.FaturaDetay_202407.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4652
      - C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\TheDream\RootDesign.exe
        
        "C:\TheDream\RootDesign.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\TheDream\RootDesign.exe

Filesize
125KB

MD5
e739795e2208eb8e10ee98b92b52a5ca

SHA1
0ac1bd3681544350158ff9d7c44d1732b5673178

SHA256
bbda59896347af0b13c361b9fb97c42c1903e1cd1fad498c8192416c408139c5

SHA512
ff39f09fc65d6bad6b6a5d555c453ee7a29fdb8d7e16dc4ef08cb9a3b2b0d14558dc379a87e5e170752fdac56192b1d677cbb447a880e6c0fca5f0110b63c062

Download Submit
C:\TheDream\log.txt

Filesize
21B

MD5
3c232254a15022c8bccc67a163f2ce5a

SHA1
bd82a81e9048be79ae2b5513333d9bb9c6325999

SHA256
2af33a3f0aba7bfc582cceab6baece188696c0ab08940acb8dbe086b48e6a589

SHA512
67793fbb1dd2dde93a85bd830884ad02cac37dfd7bbb92ceb591dd866fc9e0663ab8941d8c43dc144134b661b0c7009f6f7bfbc8aa023c86d30fbe7f9bde6c18

Download Submit
C:\TheDream\log.txt

Filesize
36B

MD5
a5b0591b2f70456da9cd02ef7b388049

SHA1
c4436deecb44292acdb1aaf6e594f81f87bbd59a

SHA256
4dc16645122903c5a02cbc562d46e9b0167a4df03a7d4f331237ab299934f717

SHA512
33226836f1f8546ca287138f647062c5d2cd9f3f735020e93941a786ebd1f381bad3b486624b52c57dd62957bccb36c1c4fb5256f9cd40981647d8f04750de4c

Download Submit
C:\TheDream\log.txt

Filesize
51B

MD5
4bf48e46840fb716c7f67cb15aaf0640

SHA1
57871bd1a9084f3d16582e3a4b367e729d43f072

SHA256
71ed11b127d1bde7c75ca3e5af17c70106e8b07c728f72eaa7a0fb7186621912

SHA512
b94021a7acf4ff4190ad70823b2560952b8f683da580a1365e13a3157799b9cfb73f51bad43f2c91b78c6d34a75db84c032cef0cfd529f70a13b0005525d64de

Download Submit
C:\TheDream\log.txt

Filesize
66B

MD5
01c596cbd77a920982c9cd4d4cca3d12

SHA1
fb442b56ed6545dc6f7395ec46dacb56d084b141

SHA256
9497780664233254a6b3785a48367c6cc9cbac3b7e712c0fcf6e239d7814d842

SHA512
0e94b4b795b0f376ff5efe59f6bd1463b588a8c1154ed0b8956b0e988f93529455a69283ce1e55f2637c73fbf7dd5eaa23a45e97da4f430688c7f6eccdce29ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RootDesign.exe.log

Filesize
1KB

MD5
96cca7a6ce0df83a5eaacad47f26e6c0

SHA1
a203126275c74e9974ba23a1269e8f5104b134b3

SHA256
e29461f622da1d1f9e37466f5dc1f96bb10621454cffc5fd4dc73ae2f973d344

SHA512
11dc5cfdf4ed957fc8ebc4894ff8e2cbbd64864032159625bd6b92daa16053cad12cb61c17416a55b76c3722174cf751bd108665402ea426225670589520cacb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
28854213fdaa59751b2b4cfe772289cc

SHA1
fa7058052780f4b856dc2d56b88163ed55deb6ab

SHA256
7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

SHA512
1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
bda1ea587a9f18bac9de294052613252

SHA1
9d03e5eb1adfb1ad335f7bbbe3a068ea392748c4

SHA256
7a904d72b509861d7e2199578adc38ebaee42b92d59df94a52e0c4d183f9c5b3

SHA512
3666684e2e7b6d518c19b8f373475609094ae43b5f02d707c57958f3db30349d8b886ab5b5a5ff2a404ab90b296039766c3885f1a5b59cafebc87d1289289ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skxz4fzn.dci.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\readme.txt

Filesize
1KB

MD5
934c538703a8d75fc9452968bd4153e4

SHA1
f85647d373dcafe1dc6c54d2fef2a6cb192a5172

SHA256
04ead23fabb8ebae8d2e271624b5059a89300c6ae824469b671d26dc5d72208d

SHA512
7112ac70c40ab61bfa68151ac78ff6ebee02ee8a61869ae0f083bd5fbc8d22ff585ecbb59156694cf17072363d4ffb4bf1bb51b9194e697e1bf1827f79ac0c05

Download Submit
memory/872-60-0x00000000729C0000-0x0000000073170000-memory.dmp

Filesize
7.7MB

Download
memory/872-22-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Filesize
408KB

Download
memory/872-16-0x0000000004BC0000-0x0000000004BF6000-memory.dmp

Filesize
216KB

Download
memory/872-18-0x00000000052D0000-0x00000000058F8000-memory.dmp

Filesize
6.2MB

Download
memory/872-17-0x00000000729C0000-0x0000000073170000-memory.dmp

Filesize
7.7MB

Download
memory/872-33-0x0000000006210000-0x000000000622E000-memory.dmp

Filesize
120KB

Download
memory/872-19-0x00000000729C0000-0x0000000073170000-memory.dmp

Filesize
7.7MB

Download
memory/872-20-0x0000000005900000-0x0000000005922000-memory.dmp

Filesize
136KB

Download
memory/872-21-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/872-34-0x0000000006240000-0x000000000628C000-memory.dmp

Filesize
304KB

Download
memory/872-15-0x00000000729CE000-0x00000000729CF000-memory.dmp

Filesize
4KB

Download
memory/872-32-0x0000000005BC0000-0x0000000005F14000-memory.dmp

Filesize
3.3MB

Download
memory/2152-63-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2548-53-0x00000000729C0000-0x0000000073170000-memory.dmp

Filesize
7.7MB

Download
memory/2548-46-0x00000000729C0000-0x0000000073170000-memory.dmp

Filesize
7.7MB

Download
memory/2548-45-0x00000000729C0000-0x0000000073170000-memory.dmp

Filesize
7.7MB

Download
memory/2548-35-0x00000000729C0000-0x0000000073170000-memory.dmp

Filesize
7.7MB

Download
memory/4652-55-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Filesize
584KB

Download
memory/4652-59-0x0000000004B80000-0x0000000004BA2000-memory.dmp

Filesize
136KB

Download
memory/4652-61-0x0000000004B70000-0x0000000004B7A000-memory.dmp

Filesize
40KB

Download
memory/4652-54-0x0000000009560000-0x0000000009B04000-memory.dmp

Filesize
5.6MB

Download
memory/4652-52-0x0000000004940000-0x0000000004946000-memory.dmp

Filesize
24KB

Download
memory/4652-49-0x0000000000130000-0x0000000000158000-memory.dmp

Filesize
160KB

Download