db0b26b347783e46f934c7d408e000556d480b79181fb4963fa762c389f87278

Analysis

max time kernel
114s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dawn.exe
Size 3.3MB
Sample260708-mzzyfsev4x
SHA256 db0b26b347783e46f934c7d408e000556d480b79181fb4963fa762c389f87278
MD5 d53a55bae8cbe83d098cbaec84148842
SHA1 6dec8c9d1207327c9bd44349caa1f8204213d09c
SHA512 d7b6b35310ce07e8fcff49101b59cf2f2938498104684cb0efeb9821cc5ec320f2f5edd94d5dd23d164daa59d3ecb1cf7a39b7b590ac611c0cddf61383684d4c
SSDEEP 98304:9vIkamauIdsyxrKhCPjrHcYNptUo5OUMja:9fanf9+sjr8mptU6OU6a
TLSH
T137F51221244D911BD29E1E32B342FBA609532FD554CD2432F69B3E6FF936B72E809583
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
11	raw.githubusercontent.com

Network Service Discovery 1 TTPs 3 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3120	jcef_helper.exe
476	jcef_helper.exe
1416	jcef_helper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
2908	Dawn (Feather).exe
3196	Dawn (Feather).exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3692	powershell.exe
3124	powershell.exe
5912	powershell.exe

Loads dropped DLL 64 IoCs

pid	Process
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe
1484	dawn.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1312	powershell.exe
4648	powershell.exe
2700	powershell.exe
6024	powershell.exe
2028	powershell.exe
2616	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dawn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Dawn (Feather).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Dawn (Feather).exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2028	powershell.exe
2028	powershell.exe
2616	powershell.exe
2616	powershell.exe
1312	powershell.exe
1312	powershell.exe
4648	powershell.exe
4648	powershell.exe
2700	powershell.exe
2700	powershell.exe
6024	powershell.exe
6024	powershell.exe
5912	powershell.exe
5912	powershell.exe
3692	powershell.exe
3692	powershell.exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3196	Dawn (Feather).exe
3124	powershell.exe
3124	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	6024	powershell.exe
Token: SeDebugPrivilege	5912	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3196	Dawn (Feather).exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2028	1484	dawn.exe	88
PID 1484 wrote to memory of 2616	1484	dawn.exe	90
PID 1484 wrote to memory of 1312	1484	dawn.exe	92
PID 1484 wrote to memory of 4648	1484	dawn.exe	94
PID 1484 wrote to memory of 2700	1484	dawn.exe	97
PID 1484 wrote to memory of 6024	1484	dawn.exe	99
PID 1484 wrote to memory of 5912	1484	dawn.exe	101
PID 1484 wrote to memory of 2908	1484	dawn.exe	104
PID 2908 wrote to memory of 3196	2908	Dawn (Feather).exe	105
PID 3196 wrote to memory of 3692	3196	Dawn (Feather).exe	106
PID 3196 wrote to memory of 3124	3196	Dawn (Feather).exe	108

C:\Users\Admin\AppData\Local\Temp\dawn.exe
"C:\Users\Admin\AppData\Local\Temp\dawn.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"Stop\"; $m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsh22F1.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; if (-not $i) { Write-Error \"no windows-amd64 app-zip entry\"; exit 1 }; Write-Output $i.path; Write-Output $i.sha256; Write-Output $i.sizeBytes"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsh22F1.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; [Console]::Out.Write($i.path.Trim())"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsh22F1.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; [Console]::Out.Write($i.sha256.Trim())"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsh22F1.tmp\manifest.json\" | ConvertFrom-Json; [Console]::Out.Write($m.version.Trim())"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"Stop\"; $hash = (Get-FileHash -Algorithm SHA256 \"C:\Users\Admin\AppData\Local\Temp\nsh22F1.tmp\DawnLauncher.zip\").Hash.ToLower(); $expected = \"7ee28ac0cf8f89a40f67a24d3e88169ad22265359b1d123eda7dde6ce80649c4\".Trim().ToLower(); if ($hash -ne $expected) { Write-Error \"SHA-256 mismatch: expected $expected got $hash\"; exit 1 }; Write-Output \"OK\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"Stop\"; Expand-Archive -Force -Path \"C:\Users\Admin\AppData\Local\Temp\nsh22F1.tmp\DawnLauncher.zip\" -DestinationPath \"C:\Users\Admin\AppData\Local\Dawn\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"SilentlyContinue\"; Get-AppxPackage -Name \"DawnLauncher\" | Remove-AppxPackage -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5912
- C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe
  "C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe
    "C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' if (Get-AppxPackage -Name 'Microsoft.MinecraftUWP') { 'true' return } $dataRoot = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data' if (Test-Path $dataRoot) { foreach ($item in Get-ChildItem $dataRoot) { $package = Get-ItemProperty $item.PsPath if ($package.PackageFullName -like 'Microsoft.MinecraftUWP_*') { 'true' return } } } 'false'"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' if (Get-AppxPackage -Name 'Microsoft.MinecraftWindowsBeta') { 'true' return } $dataRoot = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data' if (Test-Path $dataRoot) { foreach ($item in Get-ChildItem $dataRoot) { $package = Get-ItemProperty $item.PsPath if ($package.PackageFullName -like 'Microsoft.MinecraftWindowsBeta_*') { 'true' return } } } 'false'"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3124
  - - C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe
      "C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=d3d11-warp-webgl --use-gl=angle --mute-audio --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.262 (Dawn Launcher)" --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --metrics-shmem-handle=5020,i,17119180408396373891,8801338481844514781,524288 --field-trial-handle=5252,i,15025037004236240804,6747336035577520808,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=5296,i,12861521747040537739,14685099612826417087,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=5384 --mojo-platform-channel-handle=5248 /prefetch:11
      4⤵
      Network Service Discovery
      PID:3120
  - - C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe
      "C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --use-angle=d3d11-warp-webgl --use-gl=angle --mute-audio --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.262 (Dawn Launcher)" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --metrics-shmem-handle=5708,i,2239258793072230254,17490343936827274872,524288 --field-trial-handle=5252,i,15025037004236240804,6747336035577520808,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=5296,i,12861521747040537739,14685099612826417087,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=6228 --mojo-platform-channel-handle=6076 /prefetch:13
      4⤵
      Network Service Discovery
      PID:476
  - - C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe
      "C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.262 (Dawn Launcher)" --disable-print-preview --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-breakpad --disable-notifications --disable-speech-api --js-flags=--max-old-space-size=128 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=6740,i,15781378838972811781,5401602469607011482,2097152 --field-trial-handle=5252,i,15025037004236240804,6747336035577520808,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=5296,i,12861521747040537739,14685099612826417087,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=handle --log-file=6760 --mojo-platform-channel-handle=6756 /prefetch:1
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe
      "C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=d3d11-warp-webgl --use-gl=angle --mute-audio --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.262 (Dawn Launcher)" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --metrics-shmem-handle=7844,i,7190049405087141689,5605980263647132447,524288 --field-trial-handle=5252,i,15025037004236240804,6747336035577520808,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=5296,i,12861521747040537739,14685099612826417087,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=7836 --mojo-platform-channel-handle=7840 /prefetch:14
      4⤵
      Network Service Discovery
      PID:1416

C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe
"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe" --dawn-login-startup
1⤵
PID:2156
- C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe
  "C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe" --dawn-login-startup
  2⤵
  PID:3912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dawn (Feather).exe

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe
Size 905KB
SHA256 2c49ae37ed9be178ae0ecc085d473d4a08c19c03c302bc7eac4720b8a45b79bb
MD5 d88bc1a94ebd3aaac3034462d5601c5a
SHA1 a396f9562ca52862bc1db49d692fdf52c7d2c47f
SHA512 730c5d6814d5fcfd13f24a8122d15bb1f0f5d7dc811afba577233d751658d0e5c2e00c9351e02920709af8ed6539b68f7b741a767e81a22c89512316d30ed89d
SSDEEP 12288:spyDcGs+09VuYUY6kP7B6aCSId2Vd9UTQOppc:xcGM7u9Y6kP7MeXUTQOPc
TLSH
T144157C25615C00B6D1AB8A319702BB12D6727DC50698652BF3923E6FFE33771ED29B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af_NEUTER.pak

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\locales\af_NEUTER.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\legal\java.desktop\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\legal\java.desktop\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\legal\java.desktop\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

README.JAVASE

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\legal\java.desktop\README.JAVASE
Size 39B
SHA256 a599d79ec20f64079704f1ed4588d5c725ff798824f7d22838a5fb7bd0b01ddb
MD5 e2c44ace8282e391297221a64474ab30
SHA1 42bce25b27e52811fc22677e2c3bd3b6d2fe95b8
SHA512 13d36059b448ad3265ed1441070cf3c51b428bfa5793f2278e79485673963a4b0968e7870c154431ed181e973dc54ab4fe8ca5fa7ee0a59cd60cef017377f3b4
MD5 SHA1 SHA512

Submit Download

classlist

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\classlist
Size 199KB
SHA256 3550a7756e254b4490021e90d366f4a7b3faac7ecfd2ea2daa4ddaf39fe4b423
MD5 75bf28824e72dde6c69f6be56a36dc6b
SHA1 b146ae64656ed815bf4a0adb3713f26306a817ce
SHA512 de0b80cbf72b376acb2a95bba81b229cbe3bb76d50b94c08b7bf7afa5ff4ad7a88f61c11c48e21135959e5598534e648ae0d3e7278bf1f0a154837bec47f7a42
SSDEEP 3072:NHKAJ8yx/SccgLRxrjUlUv2PodfcG7JscnJRIUa6zQ:8AJ8yx/SccgLRxrjUlUv2PodfcG7JwP
TLSH
T1DA148413D08D74726684E5EFD46203196004C9736C06E9ACD6568AC2F1EBDFE853FEEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct.sym

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\ct.sym
Size 10.4MB
SHA256 db7333432609fb2c1e440bfd08688841307f8b0281615af8080bcf1f62d72d79
MD5 d59051b698aba2c26d7a1ef3da71c346
SHA1 b83b4ba670772609c55b768baddf3b2f67cd768e
SHA512 37e5662acef1cb79f5ad0796f5d045912143cc418914a0f28f8cd6f68ac14e1d948510e28e547b0301a69c10a3a6087e8db8f4a00b60c83eac4032c9dbe383ed
SSDEEP 196608:XjF5FO8UEVul3dKEHwl/bc4iOiJN6ZaYHa:XnJUe6gawlTniOibMa
TLSH
T18FB65A2DBFC49087DA53A1B684218773B5A885F95181F19B061E0CB8BAF1EB10F53EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontconfig.bfc

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\fontconfig.bfc
Size 4KB
SHA256 18db3daa9e2e8dd036195daeac943d0c1b95b1ecaef5e5eb087cf93f2211d636
MD5 2dd9616d3a470c4d0623747f702a6f8e
SHA1 82bb6bc33a681dd8d1e28f1641bce77b933a8c05
SHA512 24c85cdbb47fcd246bdb3340374469173ba66e57558bb449c60abad1dacbbde8538804228fa6958da9970515470d8dfeb8858e65bb6a3d8ce76cf1d9e2611f2c
SSDEEP 96:00UKe8mIRluBbsnCBj7BFBBOPicbXdaWYssByad7pV:WhZsK5bBEicbxZsXp
TLSH
T16BA1CE01E4FB9308F2FBFB76A7B990598D72F855BA73CA6C1010415E47A25408E52F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontconfig.properties.src

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\fontconfig.properties.src
Size 12KB
SHA256 dab4e26663d5ede2bb5f21ff629a3858b80ee01eb0f4b06984d1f4eefd6f8b0e
MD5 fff32a90805b5b049f4baabe2ebe331e
SHA1 6cce3c7f2012506e80b0b14184bb71da11df5213
SHA512 ada66a934c4153120b7c6dd9d6f4abd62377e83c6215fe393a500804fcd89e2d945a843268cdb5df698ac83f10108c8569f079b8c6a457f658546ba932fd2b54
SSDEEP 192:YTh0WcTkCtTBElDWnsNi8bTM1d5CN59/Ywca9nB2RqhCQPBifGuo7xd:YTh1cRnHeR9B2Rqhhgaxd
TLSH
T13342660E220C0BDABBBDA85231F6A9127D1DA47F4282AF4735FC8609DE555D1F692333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jawt.lib

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\jawt.lib
Size 1KB
SHA256 ae7545b2d473329b330c725ccd00ddc4859bd4fd52b35d50336582b5ec081afe
MD5 1dfd21eec466bf4622de8c18ebd42611
SHA1 52fb2059763fa420824c74f22bef473ae26df019
SHA512 10c7eff6074a94a7a9ee82b14741220a089114d63cb73e89478604681f7b293847a8e60ff8757279009e289783065ef2bd4af58789b948fd75888fc948566d7d
TLSH
T19A3191A29FA34C57CE3CC132D4CAA450627C24412305BEBFBADD09A14FB6DD4F9A1C06
MD5 SHA1 SHA512 TLSH

Submit Download

default.jfc

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\jfr\default.jfc
Size 39KB
SHA256 26f2d7bf2f8473b3849f9480629eee695edf59fd667da838890a22919237718a
MD5 addb23b132c5c9545a8457c0035f4f12
SHA1 977a996ef63c11b220ec531873931fd29143b4da
SHA512 8e4ad89801b77586543d5a0d287288acbf9a240148e2ee0751770703f33eb1281493767239f2c27ff6ed1f9559b2cc6a1bbf1da6a471af82a144d8e7eded9572
SSDEEP 192:j9ILlN+iQK3LQeaWHT9cA0tza9gVWTnuAgb0/G0uemdP8NP8Gq:j9I5N+6kjWzSza9gQTnsGpuPmPZq
TLSH
T1B303F05005E8AE9D62CE9F3BCF6566035CB194F3616AB03470EC3E945F9949242F38FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profile.jfc

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\jfr\profile.jfc
Size 39KB
SHA256 3e2c847608b1e7d182337f56bbf75b6a026ba4e9634b398bd92aec865e9ea8a7
MD5 30d02712f05511787469c5cb13e4c3b6
SHA1 fd750d24688dbad3f45d653637ada1ac89f6826e
SHA512 9731bf2ce695783acb3eabbab88bd131ee0caf2c1963648fac14a287d3fa83d360fe24233f78464d847bda3a48b8eaa2b9f5ad17d816bf9339a23ca5384cf252
SSDEEP 192:jbsh62+HK3LQeqPMT9cC0Gza9hVT0UuAgb0/G0UumKP8NP8Gq:jbsA2+qkxP+bza9hZ0UsGnxPmPZq
TLSH
T14A03E05005E8AE9D628E9F3BCF6566035CB194F3616AB03470EC3E945F9949242F38FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrt-fs.jar

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\jrt-fs.jar
Size 107KB
SHA256 67160cc16382621dedd6061098be3ed1abbee232a3678da5b75655c24377770d
MD5 0195b101ef04467360f5007f40844c46
SHA1 ae1b5ac6361054f5b1851814429572a1bbb5e6aa
SHA512 8ec5f4590d59ca4370d7c36fcde5258c393600b533723f3c378704843dbea42ab9037d057b6b0b9aae456851c9d8ee7b33d3ebb11d4a7623aa5a129d611a9704
SSDEEP 1536:YoErfAmPCc6Pxs6MVz9dUfxsjxjP0Qvmg7mFI5raPaebz8owL2uEt3aTnOfRGhi:YNbAmEPxszdUfQFmFzPkTLI3aTaRB
TLSH
T11EB3E13B3BD68453F0222771E884C30E24A158EA85DEB12E4164C5898BF3EF55E65BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

jvm.lib

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\jvm.lib
Size 1.2MB
SHA256 2668fa994062b4ed0f55c88b955e0863cf23edbb63f001537923f41bccbf574f
MD5 f909ff2738bf272db50452be74c0d138
SHA1 775e209112ddc9f0486546c2f4c6f29514fe13f3
SHA512 f3ddb064c4053960015ee1ce8b01903527f339e2b6fb94623b6f2d4edac09889e1b8151d8c00181d87e332309215df566b9138d6e9e369cc13f3b6d6c04867b2
SSDEEP 6144:otV/6mkDb+sX5D/SHjzovWYf2LtZixZ8ZkoImk+Or6vL1B:QJk/5D/SH/oHf2LCxZ8+B+Or6vLn
TLSH
T1B345AA39C0166C3BB16DE5288B6E91F78BAF48148221B3E33A4E7F51C7B752FD601526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psfont.properties.ja

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\psfont.properties.ja
Size 3KB
SHA256 5a4bd51b969bf187ff86d94f4a71fdfbfa602762975fa3c73d264b4575f7c78f
MD5 d4c735bf5756759a1c3bc8de408629fc
SHA1 67c15e05a398b4ce6409d530a058f7e1b2208c20
SHA512 8124b25decfa64a65433ff2ce1f0f7bdf304abe2997568abc35264a705f07152aa993b543da37c4132b4b1b606743c825c90a0eb17b268518d478f5cf0889062
TLSH
T15C71EFA04FB8A7191422069571EFBBD8E61A7FD2C235B14794F168029049DFDFB88B37
MD5 SHA1 SHA512 TLSH

Submit Download

psfontj2d.properties

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\psfontj2d.properties
Size 11KB
SHA256 cfb2f55fc4a22368567273c38f1afe3fc627ad56710a1d922ada68015710e53f
MD5 f42a635f91f94d6794dc5d1ea87dee18
SHA1 2797b5185e9c6f34dea22349faea83687132483d
SHA512 84520412f1596f584c174c50e2d906d6370f6fc60af10963f659690f82a83e4da4238b37201049dc45fb736ce4c087d7e31f78d8823e7e85f999e9dc7189399b
SSDEEP 192:9ThMPwn+Cyub3Ee4OECKDIcYOhAgZ50OKDQLT2IcpRuWRbHr9NRXUh/QTv9Ho39I:9ThkxzubEFOEscAW5VKsCfHz8RPxGt
TLSH
T1E8326581853C2674115307A2728FAFC0EE5DEAB59430A32790F5B602569EEF02F69F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\security\cacerts
Size 129KB
SHA256 707312d3e8018928f53d108e4534f628cbbfad18196df1a2e72884300be1a69f
MD5 881adfcde495d7617f386bd5a5e266a3
SHA1 8ac5c4224e29351fb5d1242511652816361be139
SHA512 b56f14cf167ae0f59f6e33fa92b61a8b78346eb7320dbafb37ec220864d42cd484dc87743ce3f1f9e9accf8873a6f1add329a7da99ea6205e167d46ccbba855f
SSDEEP 3072:6W50keopPrPXMvYrSuZe1AXA7BTMly8Jg96K:D7pP0Hus6XAlTMl4L
TLSH
T160D35B8B0F3D7405BFE2DE48A688D7277D76F3E42E9695271121C1E41E92BA07C8D12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

public_suffix_list.dat

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\security\public_suffix_list.dat
Size 223KB
SHA256 37e71e43c8605f29b9072f152d0ea4708735cdf335a5b68b2bc2f875760806c3
MD5 10b97553377f635919a0febd997fbb6b
SHA1 6ca1cdb596c0c478101c9337bd7d8e9b524875cc
SHA512 6d54c7759840942f408072be79eb66f2d753e0b4094c98efab036f20f2dd8f04f46b2dc0ab7b81b2b412b223c5b6a52b6c79352355627f66efce23a764450d88
SSDEEP 3072:nA3pISlZio3o5MPG4KaF+hChCDBzmgOmbhseoYeUORwZ6OI0mGxzV3qCVMVzke8J:nA3pISlZiushN3SImxSIJua4
TLSH
T15424DD5A6EE9AD0DC01381374072929AD729A21C5E49EF1F1B4470A81CF5E9B2F43FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\tzdb.dat
Size 100KB
SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
MD5 df8a313edca47a1b2537b7ec047ce4de
SHA1 449cd5af08a45e2b017e670b3df9c8bf06de0c7e
SHA512 7c4c67d5793bdbf3f9b7dec1360b9278ad7206e66f6917568e2fc04e0fbc019b504edc35870eae143f9f313d5b7eca81404d5c4783c7fc61e0f8a1ec1d18e36e
SSDEEP 1536:N0ExeF88hPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:NPeq8hPdrcWzbVj0hJzdxuT/5ToU
TLSH
T149A3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\lib\tzmappings
Size 15KB
SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
MD5 f2c6e7d7e1856acd650426427dc72cbd
SHA1 42fcb6d986381170cdef3aeaaf9f8ddc124fdec0
SHA512 3fff765acea8b4b2f1d01ee080920db815212ef05a75832a4a01e174886544b1320f85229d43d5077e050bf8309a2d467d784e828b82cfd095fa1caca7780b35
SSDEEP 192:LQW46R4S2t0ZvH4LacPZ5E1DBMpLcnyhAXnEo2nh+E4:LQW46R4jtavQSRqwSL4
TLSH
T15F622585B06622E4C073EC0D3F227AD3F886F3C49AC69A4D2953C366BD059B766D5837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\runtime\release
Size 1KB
SHA256 ffba67b5eff5d9064c6ec635b4656a235300f57bbb123cff29016b2e48e32f6c
MD5 50ff146f3b805eee89cb631614eb6589
SHA1 508c859a8613cb468bd089f692641b221ab7ed76
SHA512 ab8351c3822d44274e86837def96cc8720c43fbb46d28d82eadd9726b0d83e0498d506a4868db2eaba003a9e8fffc2785cc78713e3b0c0b0d228feef7b8c109d
TLSH
T11C21BE2FD01E88B09F9402C365B4C92FF5DDA9364582ACA4AE8B84C4B077BB7C579129
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 88704263ada35961bdb35514635132dd7f1e16297db9abbe5e4858ddc4e7bcd2
MD5 3d01d8c7345daed1d907240721fcb5f6
SHA1 193735ac35612abdb81b6f7cd42187754a7c6eb1
SHA512 eb572bec97c34d1bb8be87996220ae86044d9cef4bafa81e57a9d13386981e5d6f2b791f711b8746449a4fcf0c8cabd8684fdd560d500e33e803f7129bc971b5
SSDEEP 1536:EtdKYo2hqHMRfKQx1flJdCHYyh4iUxPR40i71YieyPUOdBjV3CNBQkj2ba57klTZ:EvKYo2hqHMRfKQx1flJdwYyqiUPRCqBy
TLSH
T1875374D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download