46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
84s
max time network
63s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/9f88187d774cc9eaf89dc65479c4302d.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

AdobeSLService.exeAdobePrintFr.exe

pid process

1220 AdobeSLService.exe
1404 AdobePrintFr.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1560 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1220	AdobeSLService.exe
1404	AdobePrintFr.exe

pid	process
1560	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

9f88187d774cc9eaf89dc65479c4302d.exeAdobeSLService.exeAdobePrintFr.exe

description	pid	process
Token: SeDebugPrivilege	1108	9f88187d774cc9eaf89dc65479c4302d.exe
Token: SeDebugPrivilege	1220	AdobeSLService.exe
Token: SeDebugPrivilege	1404	AdobePrintFr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AdobePrintFr.exe

pid process

1404 AdobePrintFr.exe

pid	process
1404	AdobePrintFr.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9f88187d774cc9eaf89dc65479c4302d.exetaskeng.exe

description	pid	process	target process
PID 1108 wrote to memory of 1560	1108	9f88187d774cc9eaf89dc65479c4302d.exe	cmd.exe
PID 1108 wrote to memory of 1560	1108	9f88187d774cc9eaf89dc65479c4302d.exe	cmd.exe
PID 1108 wrote to memory of 1560	1108	9f88187d774cc9eaf89dc65479c4302d.exe	cmd.exe
PID 1828 wrote to memory of 1404	1828	taskeng.exe	AdobePrintFr.exe
PID 1828 wrote to memory of 1404	1828	taskeng.exe	AdobePrintFr.exe
PID 1828 wrote to memory of 1404	1828	taskeng.exe	AdobePrintFr.exe
PID 1828 wrote to memory of 1220	1828	taskeng.exe	AdobeSLService.exe
PID 1828 wrote to memory of 1220	1828	taskeng.exe	AdobeSLService.exe
PID 1828 wrote to memory of 1220	1828	taskeng.exe	AdobeSLService.exe

C:\Users\Admin\AppData\Local\Temp\foo\9f88187d774cc9eaf89dc65479c4302d.exe
"C:\Users\Admin\AppData\Local\Temp\foo\9f88187d774cc9eaf89dc65479c4302d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\hfko5gx4.rm0.bat" "
  2⤵
  - Deletes itself
  PID:1560

C:\Windows\system32\taskeng.exe
taskeng.exe {4C58F9CD-C09A-49FE-A8AE-0BEEF4F39A66} S-1-5-21-1131729243-447456001-3632642222-1000:AVGLFESB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Roaming\Adobe\CameraRaw\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\AdobePrintFr.exe
  C:\Users\Admin\AppData\Roaming\Adobe\CameraRaw\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\\AdobePrintFr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1404
- C:\Users\Admin\AppData\Roaming\Adobe\SLStore\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\AdobeSLService.exe
  C:\Users\Admin\AppData\Roaming\Adobe\SLStore\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\\AdobeSLService.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hfko5gx4.rm0.bat

MD5
8415bef1ecc36d183cbc164650a9866b

SHA1
e61c2ba4618fa9c5553abc31de277ac49a6f95b8

SHA256
bdf0090b903bb949da28a2d6a4bf48ea575fcff0e3f03343dcfcf613e1496dc2

SHA512
3a5163212d94932ac748fb41f1d97bf5d095394372ae194e722e4f50019a91a108c2a79f1ed2051070377992e5b17bcef428d81b92ff48bf1bfd9c8c4be3f592

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\CameraRaw\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\AdobePrintFr.exe

MD5
6bf42c3eedd9543c2d59a4146edbbf16

SHA1
471c8f329b10e7a4dff3b1ed9a974c23575996b5

SHA256
0825d2fc2097ea605cac9b4a7c36f240b9728425cf2c7f72e09be3aaeebad924

SHA512
e14178a03e8388c41cbd90815225fd092a9da4024f7c795b7f341c5c42c6091e22d6a7dbe0073495f2eaa418705202b2646ce642d93788489e853e7b56d7b976

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\CameraRaw\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\AdobePrintFr.exe

MD5
6bf42c3eedd9543c2d59a4146edbbf16

SHA1
471c8f329b10e7a4dff3b1ed9a974c23575996b5

SHA256
0825d2fc2097ea605cac9b4a7c36f240b9728425cf2c7f72e09be3aaeebad924

SHA512
e14178a03e8388c41cbd90815225fd092a9da4024f7c795b7f341c5c42c6091e22d6a7dbe0073495f2eaa418705202b2646ce642d93788489e853e7b56d7b976

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\SLStore\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\AdobeSLService.exe

MD5
987826a19f7789912015bb2e9297f38b

SHA1
44d78469d914208d6865fd35a731f5ea61c72975

SHA256
eb48a31f8f81635d24f343a09247284149884bd713d3bc1c0b9c936bca8bafd7

SHA512
3089d7d790a73488526b26fa896e480a1ac4d11733a79f624d4d1f8c19cc4d5fedf29b3ae905c10b7ab2c58d95d62748f8a7c3b00284af76478eda472f47f805

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\SLStore\Settings.{ED7BA470-8E54-465E-825C-99712043E01C}\AdobeSLService.exe

MD5
987826a19f7789912015bb2e9297f38b

SHA1
44d78469d914208d6865fd35a731f5ea61c72975

SHA256
eb48a31f8f81635d24f343a09247284149884bd713d3bc1c0b9c936bca8bafd7

SHA512
3089d7d790a73488526b26fa896e480a1ac4d11733a79f624d4d1f8c19cc4d5fedf29b3ae905c10b7ab2c58d95d62748f8a7c3b00284af76478eda472f47f805

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\settings.dat

MD5
79112a6fc548964a1e3617c11c68f6f1

SHA1
b944b9cced86c946215e7a167971b061658fa9e9

SHA256
2ea1e7d566390ce4e4e91a4106121d59497c578bccc63a66ef7ce7782fa4941b

SHA512
25d462d7802411a96df2f3af2ac1d47106273781a76a5b8e006920d079f4e02515fbe453e1cbcdfbe85b44a565ac10a87a225cd310cea35bd61211b133417912

Download Submit
memory/1108-5-0x0000000000B30000-0x0000000000B50000-memory.dmp

Filesize
128KB

Download
memory/1108-9-0x0000000000B70000-0x0000000000B73000-memory.dmp

Filesize
12KB

Download
memory/1108-10-0x0000000000B60000-0x0000000000B67000-memory.dmp

Filesize
28KB

Download
memory/1108-8-0x0000000000B50000-0x0000000000B58000-memory.dmp

Filesize
32KB

Download
memory/1108-0-0x000007FEF6330000-0x000007FEF6D1C000-memory.dmp

Filesize
9.9MB

Download
memory/1108-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1108-1-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1220-12-0x0000000000000000-mapping.dmp

Download
memory/1220-21-0x000007FEF6330000-0x000007FEF6D1C000-memory.dmp

Filesize
9.9MB

Download
memory/1220-22-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1404-11-0x0000000000000000-mapping.dmp

Download
memory/1404-17-0x000007FEF6330000-0x000007FEF6D1C000-memory.dmp

Filesize
9.9MB

Download
memory/1404-18-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/1404-20-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/1404-28-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1560-6-0x0000000000000000-mapping.dmp

Download