Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 15, 2024, 9:27 a.m.	July 15, 2024, 9:32 a.m.

Size	322.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3a2ba5be087162cfdb5d49ac32edd534`
SHA256	`7a285458817660143004002c76b1e1457666b1659dfbd35863541f62630430d0`
CRC32	`9335E2ED`
ssdeep	`6144:CZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6BLGx1d0RjzV5Pnz63LLHBNy:kANwRo+mv8QD4+0V16xblLPkLLhNy`
Yara	DllRegisterServer_Zero - execute regsvr32.exe Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

PDF.FaturaDetay_202407.exe "C:\Users\test22\AppData\Local\Temp\PDF.FaturaDetay_202407.exe"
184
- cmd.exe "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
  2136
  - powershell.exe PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
    2232
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
      2328
      - RootDesign.exe "C:\TheDream\RootDesign.exe"
        2420
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2744
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        508
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2456
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2496
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2760
        
        RootDesign.exe "C:\TheDream\RootDesign.exe"
        2556
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
smtp.mail.ru	A 94.100.180.160 A 217.69.139.160	94.100.180.160

IP Address	Status	Action
164.124.101.2	Active	Moloch
217.69.139.160	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 217.69.139.160:587 -> 192.168.56.103:49175	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 217.69.139.160:587 -> 192.168.56.103:49180	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 217.69.139.160:587 -> 192.168.56.103:49182	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 217.69.139.160:587 -> 192.168.56.103:49178	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.103:49175 -> 217.69.139.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49182 -> 217.69.139.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49180 -> 217.69.139.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49178 -> 217.69.139.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 217.69.139.160:587 -> 192.168.56.103:49184	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode
TCP 192.168.56.103:49184 -> 217.69.139.160:587	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49175 217.69.139.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e
TLSv1 192.168.56.103:49180 217.69.139.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e
TLSv1 192.168.56.103:49178 217.69.139.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e
TLSv1 192.168.56.103:49182 217.69.139.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e
TLSv1 192.168.56.103:49184 217.69.139.160:587	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.mail.ru	f5:86:61:b5:b2:6c:9a:dd:9a:ba:a0:24:59:4d:7b:99:e6:72:ea:7e

Queries for the computername (26 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:19 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:27 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (17 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:26 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:27 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:27 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494b00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494b00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494b00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004941c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004941c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004941c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004941c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004941c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004941c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494b00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494b00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494b00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494c40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00494d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a380 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a380 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a380 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589b80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589b80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589b80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589b80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589b80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589b80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	c:\program files\mozilla firefox\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 15, 2024, 9:26 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

Allocates read-write-execute memory (usually to unpack itself) (50 out of 695 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72681000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72682000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02463000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02464000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02466000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02483000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02484000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02485000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02488000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02489000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02921000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02922000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02923000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02924000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02925000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02926000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02927000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02928000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02929000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0292a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0292b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0292c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0292d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0292e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0292f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:26 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\TheDream\Uninstall.exe
file	C:\TheDream\RootDesign.exe

Creates a shortcut to an executable file (14 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Word 2013.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
cmdline	PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
cmdline	cmd /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe
cmdline	"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe

Drops a binary and executes it (1 event)

file	C:\TheDream\RootDesign.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2140 thread_handle: 0x000002a8 process_identifier: 2136 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b0	1	1	0
CreateProcessInternalW July 15, 2024, 9:26 a.m.	thread_identifier: 2236 thread_handle: 0x00000084 process_identifier: 2232 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: PowerShell.exe -windowstyle hidden powershell -c C:\TheDream\RootDesign.exe filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 15, 2024, 9:26 a.m.	flags: 1158 family: 0	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (10 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 15, 2024, 9:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 15, 2024, 9:19 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Makes SMTP requests, possibly sending spam (5 events)

receiver

[]

sender

[]

server

217.69.139.160

receiver

[]

sender

[]

server

217.69.139.160

receiver

[]

sender

[]

server

217.69.139.160

receiver

[]

sender

[]

server

217.69.139.160

receiver

[]

sender

[]

server

217.69.139.160

A process attempted to delay the analysis task. (1 event)

description

RootDesign.exe tried to sleep 13641392 seconds, actually delayed analysis time by 13641392 seconds

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusW July 15, 2024, 9:26 a.m.	service_handle: 0x006bf498 service_type: 48 service_status: 3		0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUqdates

reg_value

C:\TheDream\RootDesign.exe

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c C:\TheDream\RootDesign.exe
parent_process	powershell.exe				martian_process	"C:\TheDream\RootDesign.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 184 resumed a thread in remote process 2136
NtResumeThread July 15, 2024, 9:26 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2136	1	0	0

Creates a suspicious Powershell process (3 events)

option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (2 events)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\TheDream\RootDesign.exe

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Dropper.fc
ALYac	Gen:Variant.Tedy.577745
Cylance	Unsafe
VIPRE	Gen:Variant.Tedy.577745
Sangfor	Trojan.Win32.Agent.Vihe
K7AntiVirus	Trojan ( 005b23d21 )
BitDefender	Gen:Variant.Tedy.577745
K7GW	Trojan ( 005b23d21 )
Cybereason	malicious.e08716
Arcabit	Trojan.Tedy.D8D0D1
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
McAfee	Artemis!3A2BA5BE0871
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	Trojan.Win32.Agent.xbrtrh
MicroWorld-eScan	Gen:Variant.Tedy.577745
Emsisoft	Gen:Variant.Tedy.577745 (B)
McAfeeD	ti!7A2854588176
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.3a2ba5be087162cf
Sophos	Mal/Generic-S
Ikarus	Trojan.JS.Kilim
Google	Detected
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Dropper]/MSIL.Sysn
Kingsoft	MSIL.Trojan-Dropper.Sysn.gen
Gridinsoft	Trojan.Win32.Agent.sa
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan.Win32.Agent.xbrtrh
GData	Gen:Variant.Tedy.577745
Varist	W32/ABRansom.COSM-6065
AhnLab-V3	Malware/Win32.Generic.C4244351
BitDefenderTheta	Gen:NN.ZemsilF.36808.hu0@aO8zQFi
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.106378209
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq
Fortinet	W32/PossibleThreat
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

PDF.FaturaDetay_202407.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All