Resubmissions
17-03-2022 11:50
220317-nzwrgadcd8 1017-03-2022 11:47
220317-nxz14sdcc9 1017-03-2022 11:43
220317-nvn6tsbfar 1017-03-2022 11:40
220317-nsw4nadcb7 117-03-2022 11:36
220317-nqrfdsbehp 1017-03-2022 11:31
220317-nmv96sbegl 1Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-de-20220113 -
submitted
17-03-2022 11:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B24
Resource
win10-20220223-de
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B24
Resource
win10v2004-de-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B24
Score
10/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Executes dropped EXE 5 IoCs
pid Process 2200 armsvc.exe 60 AdobeARM.exe 3200 MSIB3CF.tmp 3672 RdrServicesUpdater.exe 4052 armsvc.exe -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 48 IoCs
pid Process 1420 MsiExec.exe 692 MsiExec.exe 692 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe 3316 MsiExec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\unified-share\js\nls\root\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_filter-hover_32.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_folder-hover_32.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\search-summary\js\nls\hu-hu\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\error-icon.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\core\dev\nls\fr-ma\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\en-il\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\images\s_checkbox_unselected_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\pt_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_reminders_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\Playstore\ar_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\rename.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\ob-preview\js\nls\de-de\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer-select\js\nls\uk-ua\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\js\nls\zh-cn\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\js\nls\fr-ma\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\img\tools\check.cur RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\activity-badge\images\avatar.jpg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\js\nls\sv-se\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\home\images\themes\dark\icons.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\js\nls\ar-ae\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\S_IlluNoInternetConnection_120x80.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\win-scrollbar\themes\dark\arrow-down.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\ob-preview\js\nls\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\themes\dark\s_shared_multi_filetype.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\app-center\js\nls\en-il\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\close_x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\pages-app\images\themes\dark\example_icons.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\css\main.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\walk-through\js\selector.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\aic_file_icons.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\js\nls\sk-sk\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\home\images\files_icons.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\remove.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\js\nls\pl-pl\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\js\nls\nl-nl\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\comdll.X.manifest msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\js\nls\da-dk\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\editpdf\css\main-selector.css RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPlugin.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\app-center\css\main.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_gridview_selected.svg RdrServicesUpdater.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\1ce659d.HDR msiexec.exe File created C:\Windows\Installer\1ce658f.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce6578.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65cc.HDR msiexec.exe File created C:\Windows\Installer\1ce65d7.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI673E.tmp msiexec.exe File created C:\Windows\Installer\1ce65be.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65d6.HDR msiexec.exe File created C:\Windows\Installer\1ce65d9.HDR msiexec.exe File created C:\Windows\Installer\1ce65de.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI105A.tmp msiexec.exe File created C:\Windows\Installer\1ce65a2.HDR msiexec.exe File created C:\Windows\Installer\1ce6570.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce657f.HDR msiexec.exe File created C:\Windows\Installer\1ce6581.HDR msiexec.exe File created C:\Windows\Installer\1ce6590.HDR msiexec.exe File created C:\Windows\Installer\1ce65a4.HDR msiexec.exe File created C:\Windows\Installer\1ce65a5.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65bd.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI9A35.tmp msiexec.exe File created C:\Windows\Installer\1ce65e2.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI1370.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce65c1.HDR msiexec.exe File created C:\Windows\Installer\1ce656c.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65a3.HDR msiexec.exe File created C:\Windows\Installer\1ce65b6.HDR msiexec.exe File created C:\Windows\Installer\1ce65b7.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65c2.HDR msiexec.exe File created C:\Windows\Installer\1ce65d2.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65d9.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce6563.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico msiexec.exe File created C:\Windows\Installer\1ce65e0.HDR msiexec.exe File created C:\Windows\Installer\1ce6569.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce656c.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce658d.HDR msiexec.exe File created C:\Windows\Installer\1ce659d.HDR msiexec.exe File created C:\Windows\Installer\1ce65d3.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI6A1E.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce65b7.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65e1.HDR msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI113B.tmp msiexec.exe File created C:\Windows\Installer\1ce65a6.HDR msiexec.exe File created C:\Windows\Installer\1ce6572.HDR msiexec.exe File created C:\Windows\Installer\1ce6578.HDR msiexec.exe File created C:\Windows\Installer\1ce6585.HDR msiexec.exe File created C:\Windows\Installer\1ce65cf.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI8DD8.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce6565.HDR msiexec.exe File created C:\Windows\Installer\1ce6597.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSIEACC.tmp msiexec.exe File created C:\Windows\Installer\{AC76BA86-0804-1033-1959-001824311644}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\1ce6596.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65d8.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XDPFile_8.ico msiexec.exe File created C:\Windows\Installer\1ce658e.HDR msiexec.exe File created C:\Windows\Installer\1ce657e.HDR msiexec.exe File created C:\Windows\Installer\1ce6588.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce658a.HDR msiexec.exe File created C:\Windows\Installer\1ce659f.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce65d4.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI9967.tmp msiexec.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SDXHelper.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SDXHelper.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppName = "RdrCEF.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppName = "AcroRd32.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\Policy = "3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\Policy = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights MsiExec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy MsiExec.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Adobe.AcrobatSearch.1\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Control msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B744CAF070E41400\Patches msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\acrobat2018\shell\open\ddeexec msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{7CD06992-50AA-11D1-B8F0-00A0C9259304}\1.0\0\win32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ = "IAcroAXDocShim" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pdf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3F1-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{198F17AE-B921-4308-9543-288D426A5C2B}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\OpenWithProgids MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xfdf\ MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AcroPDF.DLL\AppID = "{BBAA0E44-3862-490C-8E63-AC2D2D6EF733}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EC-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\MiscStatus\1\ = "131473" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ProxyStubClsid32\ = "{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.pdfxml\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{00FFD6C4-1A94-44BC-AD3E-8AC18552E3E6}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\AuxUserType\2\ = "Acrobat Document" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68AB67CA7DA73301B744CAF070E41400 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PDFPrevHndlr.DLL\AppID = "{6236FF8C-E747-4173-86D3-99F511B61DF3}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\shell\ = "Read" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\EditFlags = 00000100 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF\CLSID\ = "{CA8A9780-280D-11CF-A24D-444553540000}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\ = "IBroker" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.FDFDoc\shell\Read\command\command = 3300340054004c006000690060005a00350028004e0033003200260028006a0046007b0029002100520065006100640065007200500072006f006700720061006d00460069006c00650073003e006600570044004b003600510062006e006400390033002600280053005e0046004a006900340030002000220025003100220000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\AcroPDF.DLL msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AFormAut.App\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5007373A-20D7-458F-9FFB-ABC900E3A831}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{12BA069D-0FC6-4577-97C6-5DF634CE6E84} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\NumMethods\ = "7" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AdobeAcrobat.OpenDocuments.2\CurVer\ = "AdobeAcrobat.OpenDocuments.3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell\Read\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00FFD6C4-1A94-44BC-AD3E-8AC18552E3E6}\{B4848E37-7C66-40A6-9F66-D3A9BC8F4636}\TypeLib\Version = "3.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.acrobatsecuritysettings.1\Insertable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AFormAut.App.1\CLSID\ = "{7CD069A1-50AA-11D1-B8F0-00A0C9259304}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E790E1D1-9DE8-4853-8AC6-933D4FD9C927}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker.1\CLSID\ = "{BD57A9B2-4E7D-4892-9107-9F4106472DA4}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CD069A0-50AA-11D1-B8F0-00A0C9259304}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00FFD6C4-1A94-44BC-AD3E-8AC18552E3E6}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\CurVer msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DF9A1DA0-23C0-101B-B02E-FDFDFDFDFDFD}\TreatAs msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{198F17AE-B921-4308-9543-288D426A5C2B}\TypeLib\Version = "3.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\{F2383816-917A-46CC-AD2A-5013BED3800F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68AB67CA7DA73301B744CAF070E41400\Accessibility_Plugins = "Reader_Big_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl64.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}" MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2340 chrome.exe 2340 chrome.exe 3752 chrome.exe 3752 chrome.exe 3476 chrome.exe 3476 chrome.exe 2860 chrome.exe 2860 chrome.exe 2620 chrome.exe 2620 chrome.exe 1696 chrome.exe 1696 chrome.exe 3352 chrome.exe 3352 chrome.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 2144 AdobeARMHelper.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2144 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 2144 AdobeARMHelper.exe Token: SeSecurityPrivilege 3652 msiexec.exe Token: SeCreateTokenPrivilege 2144 AdobeARMHelper.exe Token: SeAssignPrimaryTokenPrivilege 2144 AdobeARMHelper.exe Token: SeLockMemoryPrivilege 2144 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 2144 AdobeARMHelper.exe Token: SeMachineAccountPrivilege 2144 AdobeARMHelper.exe Token: SeTcbPrivilege 2144 AdobeARMHelper.exe Token: SeSecurityPrivilege 2144 AdobeARMHelper.exe Token: SeTakeOwnershipPrivilege 2144 AdobeARMHelper.exe Token: SeLoadDriverPrivilege 2144 AdobeARMHelper.exe Token: SeSystemProfilePrivilege 2144 AdobeARMHelper.exe Token: SeSystemtimePrivilege 2144 AdobeARMHelper.exe Token: SeProfSingleProcessPrivilege 2144 AdobeARMHelper.exe Token: SeIncBasePriorityPrivilege 2144 AdobeARMHelper.exe Token: SeCreatePagefilePrivilege 2144 AdobeARMHelper.exe Token: SeCreatePermanentPrivilege 2144 AdobeARMHelper.exe Token: SeBackupPrivilege 2144 AdobeARMHelper.exe Token: SeRestorePrivilege 2144 AdobeARMHelper.exe Token: SeShutdownPrivilege 2144 AdobeARMHelper.exe Token: SeDebugPrivilege 2144 AdobeARMHelper.exe Token: SeAuditPrivilege 2144 AdobeARMHelper.exe Token: SeSystemEnvironmentPrivilege 2144 AdobeARMHelper.exe Token: SeChangeNotifyPrivilege 2144 AdobeARMHelper.exe Token: SeRemoteShutdownPrivilege 2144 AdobeARMHelper.exe Token: SeUndockPrivilege 2144 AdobeARMHelper.exe Token: SeSyncAgentPrivilege 2144 AdobeARMHelper.exe Token: SeEnableDelegationPrivilege 2144 AdobeARMHelper.exe Token: SeManageVolumePrivilege 2144 AdobeARMHelper.exe Token: SeImpersonatePrivilege 2144 AdobeARMHelper.exe Token: SeCreateGlobalPrivilege 2144 AdobeARMHelper.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeSecurityPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe Token: SeTakeOwnershipPrivilege 3652 msiexec.exe Token: SeRestorePrivilege 3652 msiexec.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 60 AdobeARM.exe 60 AdobeARM.exe 60 AdobeARM.exe 60 AdobeARM.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 3752 chrome.exe 60 AdobeARM.exe 60 AdobeARM.exe 60 AdobeARM.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3340 SDXHelper.exe 60 AdobeARM.exe 60 AdobeARM.exe 60 AdobeARM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3752 wrote to memory of 2816 3752 chrome.exe 63 PID 3752 wrote to memory of 2816 3752 chrome.exe 63 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 1432 3752 chrome.exe 64 PID 3752 wrote to memory of 2340 3752 chrome.exe 65 PID 3752 wrote to memory of 2340 3752 chrome.exe 65 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66 PID 3752 wrote to memory of 4060 3752 chrome.exe 66
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://1drv.ms/u/s!AnWE7BCdi_7hgxBogqt9g3XXAdK7?e=C53B241⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97f414f50,0x7ff97f414f60,0x7ff97f414f702⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:22⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2292 /prefetch:82⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:12⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4332 /prefetch:82⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:12⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5060 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4536 /prefetch:82⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4404 /prefetch:82⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5480 /prefetch:82⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5596 /prefetch:82⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:82⤵PID:3684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3384 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3392 /prefetch:82⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5672 /prefetch:82⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3816 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:82⤵PID:3372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5396 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,5906286957861072970,7344787079285181755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:2668
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1660
-
C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe"C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3340
-
C:\ProgramData\Adobe\ARM\S\17816\AdobeARMHelper.exe"C:\ProgramData\Adobe\ARM\S\17816\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\17816" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\17816" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:60
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3652 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 19C3D907AA018E89D8F1FDBF73E5BBAD2⤵
- Loads dropped DLL
PID:1420
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D720EAE170646FE276B063E702F0F170 E Global\MSI00002⤵
- Loads dropped DLL
PID:692
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7B161CFEA91083E878DF723D47F7A67D2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:3316
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 58CA25C769519B56054D8DC6720AB07A E Global\MSI00002⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1920
-
-
C:\Windows\Installer\MSIB3CF.tmp"C:\Windows\Installer\MSIB3CF.tmp" /b 2 120 02⤵
- Executes dropped EXE
PID:3200
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 19.010.20098 19.010.20069.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3672
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"1⤵
- Executes dropped EXE
PID:2200
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"1⤵
- Executes dropped EXE
PID:4052