Analysis
- user interaction
yes - max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 03:52
General
- Target dawn-installer.exe
- Size 3.3MB
- Sample260720-efdl4sg151
- SHA256 e6681d3b9e6adcb3dc88c98aebf41bd5a41a10daa89d6b2a5ba8addcab907cf8
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dawn-installer.exe"C:\Users\Admin\AppData\Local\Temp\dawn-installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"Stop\"; $m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl6A5B.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; if (-not $i) { Write-Error \"no windows-amd64 app-zip entry\"; exit 1 }; Write-Output $i.path; Write-Output $i.sha256; Write-Output $i.sizeBytes"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl6A5B.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; [Console]::Out.Write($i.path.Trim())"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl6A5B.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; [Console]::Out.Write($i.sha256.Trim())"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl6A5B.tmp\manifest.json\" | ConvertFrom-Json; [Console]::Out.Write($m.version.Trim())"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mg0qs2cs.f2h.ps1
NScurl.dll
cookies.txt
manifest.json
nsExec.dll
memory/1004-71-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-67-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-73-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-74-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-70-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-69-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-68-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-72-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-66-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-75-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-76-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-77-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-48-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/1004-4-0x0000000073960000-0x00000000740FD000-memory.dmp
memory/2124-22-0x0000000005030000-0x0000000005096000-memory.dmp
memory/2124-30-0x0000000006180000-0x00000000061A2000-memory.dmp
memory/2124-15-0x0000000072E22000-0x0000000072E23000-memory.dmp
memory/2124-16-0x00000000023D0000-0x0000000002406000-memory.dmp
memory/2124-17-0x0000000072E10000-0x00000000735CC000-memory.dmp
memory/2124-18-0x0000000005140000-0x000000000578A000-memory.dmp
memory/2124-35-0x0000000008A60000-0x0000000008F8C000-memory.dmp
memory/2124-33-0x0000000007830000-0x00000000079F2000-memory.dmp
memory/2124-19-0x0000000072E10000-0x00000000735CC000-memory.dmp
memory/2124-32-0x0000000007EB0000-0x000000000852C000-memory.dmp
memory/2124-31-0x0000000007270000-0x000000000782A000-memory.dmp
memory/2124-37-0x0000000072E10000-0x00000000735CC000-memory.dmp
memory/2124-29-0x0000000006130000-0x000000000614A000-memory.dmp
memory/2124-28-0x0000000006BD0000-0x0000000006C66000-memory.dmp
memory/2124-27-0x00000000058B0000-0x00000000058FC000-memory.dmp
memory/2124-26-0x0000000005870000-0x000000000588E000-memory.dmp
memory/2124-25-0x0000000005990000-0x0000000005CEB000-memory.dmp
memory/2124-21-0x0000000004FC0000-0x0000000005026000-memory.dmp
memory/2124-20-0x0000000004F20000-0x0000000004F42000-memory.dmp
memory/4160-50-0x0000000072E10000-0x00000000735CC000-memory.dmp
memory/4160-44-0x00000000058C0000-0x0000000005C1B000-memory.dmp
memory/4160-43-0x0000000072E10000-0x00000000735CC000-memory.dmp
memory/4160-42-0x0000000072E10000-0x00000000735CC000-memory.dmp
memory/4160-41-0x0000000072E10000-0x00000000735CC000-memory.dmp