Analysis
-
max time kernel
121s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-it-20220113 -
submitted
23/03/2022, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
readme.dll
Resource
win7-20220310-it
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
readme.dll
Resource
win10v2004-it-20220113
0 signatures
0 seconds
General
-
Target
readme.dll
-
Size
471KB
-
MD5
fbc2f28e187edcc6ddf89989ff8e591f
-
SHA1
a322761d2f8eb898810454f545e8646495e98fea
-
SHA256
77457f0b7da19036041ca3a0071e141909d889eb7e2d28d6ad0df73bc3c81636
-
SHA512
6d04490602f0239dc823a5640793f5415597a70682d64b1620ae5006a351c70e232cb5c024caf2eff2ef2527d22ed321687dcde94b00877f8ecfc9ba788ae0de
Score
10/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Executes dropped EXE 5 IoCs
pid Process 1980 armsvc.exe 208 AdobeARM.exe 1820 MSI9981.tmp 3432 RdrServicesUpdater.exe 364 armsvc.exe -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 48 IoCs
pid Process 2580 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe 3720 MsiExec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AdobeARM.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_download_pdf_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\js\nls\hr-hr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_sortedby_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\js\nls\en-gb\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\reviews\images\dd_arrow_small.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\fil_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\read_EX_Challenger_1_DT.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\ind_prog.gif RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\generic-rhp-app\css\main-selector.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\el_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\desktop-connector-files\js\nls\nb-no\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\delete.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-recent-files\js\nls\pt-br\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\app\dev\nls\ko-kr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\virgo-new-folder.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\win8-scrollbar\arrow-down.gif RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\new_icons.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\pages-app\images\rhp_world_icon.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-files\css\main-selector.css RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\rename.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\add-account\images\icons.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\js\nls\hu-hu\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\share.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\uss-search\js\nls\sk-sk\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\css\main.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\edit-pdf.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\editpdf\js\plugins\editpdf-selector.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\s_filterselected-dark-down_32.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\task-handler\images\example_icons2x.png RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png RdrServicesUpdater.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sign-services-auth\js\nls\fr-fr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\pages-app\css\main-selector.css RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\fi-fi\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\pt-br\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\signatures\js\nls\hr-hr\ui-strings.js RdrServicesUpdater.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer-select\js\nls\nb-no\ui-strings.js RdrServicesUpdater.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI9A0F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D7.tmp msiexec.exe File created C:\Windows\Installer\1ce45fb.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4624.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4636.HDR msiexec.exe File created C:\Windows\Installer\1ce4660.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4660.HDR msiexec.exe File created C:\Windows\Installer\1ce465f.HDR msiexec.exe File created C:\Windows\Installer\1ce4633.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4668.HDR msiexec.exe File created C:\Windows\Installer\1ce45f6.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce461d.HDR msiexec.exe File created C:\Windows\Installer\1ce4623.HDR msiexec.exe File created C:\Windows\Installer\1ce462b.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce462e.HDR msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico msiexec.exe File created C:\Windows\Installer\1ce464f.HDR msiexec.exe File created C:\Windows\Installer\1ce4653.HDR msiexec.exe File created C:\Windows\Installer\1ce465d.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4662.HDR msiexec.exe File created C:\Windows\Installer\1ce4672.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce460e.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce461b.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4659.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce465a.HDR msiexec.exe File created C:\Windows\Installer\1ce45eb.msi msiexec.exe File created C:\Windows\Installer\1ce460a.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4611.HDR msiexec.exe File created C:\Windows\Installer\1ce4621.HDR msiexec.exe File created C:\Windows\Installer\1ce4610.HDR msiexec.exe File created C:\Windows\Installer\1ce466c.HDR msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico msiexec.exe File created C:\Windows\Installer\1ce4626.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4667.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI48AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7B23.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8343.tmp msiexec.exe File created C:\Windows\Installer\1ce4602.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4606.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce462b.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce463a.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSIFEA7.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce4674.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI97E9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDBE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6D6F.tmp msiexec.exe File created C:\Windows\Installer\1ce45f7.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce4632.HDR msiexec.exe File created C:\Windows\Installer\1ce4666.HDR msiexec.exe File created C:\Windows\Installer\1ce4671.HDR msiexec.exe File created C:\Windows\Installer\1ce460c.HDR msiexec.exe File created C:\Windows\Installer\1ce4612.HDR msiexec.exe File created C:\Windows\Installer\1ce463e.HDR msiexec.exe File created C:\Windows\Installer\1ce4661.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSID925.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9941.tmp msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIFFE3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B5A.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce461a.HDR msiexec.exe File opened for modification C:\Windows\Installer\1ce461f.HDR msiexec.exe File created C:\Windows\Installer\1ce463c.HDR msiexec.exe File created C:\Windows\Installer\1ce4656.HDR msiexec.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppName = "RdrCEF.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppName = "AcroRd32.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\Policy = "3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\ msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578} msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy MsiExec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility msiexec.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3} msiexec.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\ = "CAcroPDDoc" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EB-4981-101B-9CA8-9240CE2738AE}\ = "CAcroPDAnnot" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.AcrobatSearch.1\CLSID\ = "{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3}\TypeLib\ = "{47A7A4B0-2723-41BA-865E-EBBB7081A602}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroBroker.Broker\CurVer msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\CurVer\ = "AcroExch.Document.DC" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\ToolboxBitmap32\ = "C:\\PROGRA~2\\COMMON~1\\Adobe\\Acrobat\\ActiveX\\AcroPDF.dll, 102" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" /u \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}\ProgID\ = "AFormAut.App.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\CurVer\ = "AcroExch.acrobatsecuritysettings.1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\EditFlags = 00000100 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\8\ = "Rich Text Format, 1, 1, 1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\ProxyStubClsid32\ = "{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\protocol\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\InProcServer32\ThreadingModel = "Both" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.Document.DC\shell\Read msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}\TypeLib\ = "{47A7A4B0-2723-41BA-865E-EBBB7081A602}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.Plugin\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Plugin\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\APIFile_8.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{673E8452-7646-11D1-B90B-00A0C9259304}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68AB67CA7DA73301B744CAF070E41400\SearchAndIndex = "Reader_Big_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\ = "IPDFPreviewHandler" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\DocObject msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\PDFFile_8.ico,0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\AcroExch.XFDFDoc\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf\Extension = ".xfdf" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pdf msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroAccess.AcrobatAccess msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\HELPDIR msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithProgids\AcroExch.acrobatsecuritysettings = "0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CD069A0-50AA-11D1-B8F0-00A0C9259304}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Accessibility.api" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\7\ = "2, 1, 16, 1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{673E8452-7646-11D1-B90B-00A0C9259304}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\launchreader msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\MiscStatus MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.pdx\Extension = ".pdx" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\AuxUserType\2\ = "Acrobat Document" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C523F390-9C83-11D3-9094-00104BD0D535}\3.0\HELPDIR msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68AB67CA7DA73301B744CAF070E41400\ReaderAIRIntegration = "ReaderProgramFiles" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDXFileType\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3EF-4981-101B-9CA8-9240CE2738AE} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA408033019195008142136144\Version = "17301504" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3068 AdobeARMHelper.exe 3068 AdobeARMHelper.exe 3068 AdobeARMHelper.exe 3068 AdobeARMHelper.exe 3068 AdobeARMHelper.exe 3068 AdobeARMHelper.exe 3068 AdobeARMHelper.exe 3068 AdobeARMHelper.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3068 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 3068 AdobeARMHelper.exe Token: SeSecurityPrivilege 1216 msiexec.exe Token: SeCreateTokenPrivilege 3068 AdobeARMHelper.exe Token: SeAssignPrimaryTokenPrivilege 3068 AdobeARMHelper.exe Token: SeLockMemoryPrivilege 3068 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 3068 AdobeARMHelper.exe Token: SeMachineAccountPrivilege 3068 AdobeARMHelper.exe Token: SeTcbPrivilege 3068 AdobeARMHelper.exe Token: SeSecurityPrivilege 3068 AdobeARMHelper.exe Token: SeTakeOwnershipPrivilege 3068 AdobeARMHelper.exe Token: SeLoadDriverPrivilege 3068 AdobeARMHelper.exe Token: SeSystemProfilePrivilege 3068 AdobeARMHelper.exe Token: SeSystemtimePrivilege 3068 AdobeARMHelper.exe Token: SeProfSingleProcessPrivilege 3068 AdobeARMHelper.exe Token: SeIncBasePriorityPrivilege 3068 AdobeARMHelper.exe Token: SeCreatePagefilePrivilege 3068 AdobeARMHelper.exe Token: SeCreatePermanentPrivilege 3068 AdobeARMHelper.exe Token: SeBackupPrivilege 3068 AdobeARMHelper.exe Token: SeRestorePrivilege 3068 AdobeARMHelper.exe Token: SeShutdownPrivilege 3068 AdobeARMHelper.exe Token: SeDebugPrivilege 3068 AdobeARMHelper.exe Token: SeAuditPrivilege 3068 AdobeARMHelper.exe Token: SeSystemEnvironmentPrivilege 3068 AdobeARMHelper.exe Token: SeChangeNotifyPrivilege 3068 AdobeARMHelper.exe Token: SeRemoteShutdownPrivilege 3068 AdobeARMHelper.exe Token: SeUndockPrivilege 3068 AdobeARMHelper.exe Token: SeSyncAgentPrivilege 3068 AdobeARMHelper.exe Token: SeEnableDelegationPrivilege 3068 AdobeARMHelper.exe Token: SeManageVolumePrivilege 3068 AdobeARMHelper.exe Token: SeImpersonatePrivilege 3068 AdobeARMHelper.exe Token: SeCreateGlobalPrivilege 3068 AdobeARMHelper.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeSecurityPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe Token: SeTakeOwnershipPrivilege 1216 msiexec.exe Token: SeRestorePrivilege 1216 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 208 AdobeARM.exe 208 AdobeARM.exe 208 AdobeARM.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 208 AdobeARM.exe 208 AdobeARM.exe 208 AdobeARM.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 208 AdobeARM.exe 208 AdobeARM.exe 208 AdobeARM.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1008 wrote to memory of 3044 1008 rundll32.exe 63 PID 1008 wrote to memory of 3044 1008 rundll32.exe 63 PID 1008 wrote to memory of 3044 1008 rundll32.exe 63 PID 1216 wrote to memory of 2580 1216 msiexec.exe 82 PID 1216 wrote to memory of 2580 1216 msiexec.exe 82 PID 1216 wrote to memory of 2580 1216 msiexec.exe 82 PID 1216 wrote to memory of 3720 1216 msiexec.exe 83 PID 1216 wrote to memory of 3720 1216 msiexec.exe 83 PID 1216 wrote to memory of 3720 1216 msiexec.exe 83 PID 3068 wrote to memory of 208 3068 AdobeARMHelper.exe 85 PID 3068 wrote to memory of 208 3068 AdobeARMHelper.exe 85 PID 3068 wrote to memory of 208 3068 AdobeARMHelper.exe 85 PID 1216 wrote to memory of 3720 1216 msiexec.exe 86 PID 1216 wrote to memory of 3720 1216 msiexec.exe 86 PID 1216 wrote to memory of 3720 1216 msiexec.exe 86 PID 1216 wrote to memory of 4016 1216 msiexec.exe 87 PID 1216 wrote to memory of 4016 1216 msiexec.exe 87 PID 1216 wrote to memory of 4016 1216 msiexec.exe 87 PID 1216 wrote to memory of 1820 1216 msiexec.exe 88 PID 1216 wrote to memory of 1820 1216 msiexec.exe 88 PID 1216 wrote to memory of 1820 1216 msiexec.exe 88 PID 1216 wrote to memory of 3432 1216 msiexec.exe 89 PID 1216 wrote to memory of 3432 1216 msiexec.exe 89 PID 1216 wrote to memory of 3432 1216 msiexec.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\readme.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\readme.dll,#12⤵PID:3044
-
-
C:\ProgramData\Adobe\ARM\S\7729\AdobeARMHelper.exe"C:\ProgramData\Adobe\ARM\S\7729\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\7729" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\7729" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:208
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B9BF8A9D52CC38AD3789D56DBE7F71A62⤵
- Loads dropped DLL
PID:2580
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6578CDAA941952C379CF8FC2DFFD8FEF E Global\MSI00002⤵
- Loads dropped DLL
PID:3720
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 90EC29F971E0E77E3759A02027439C852⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:3720
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2222BCD1214A0DE5188B8DF5648ECB34 E Global\MSI00002⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Windows\Installer\MSI9981.tmp"C:\Windows\Installer\MSI9981.tmp" /b 2 120 02⤵
- Executes dropped EXE
PID:1820
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 19.010.20098 19.010.20069.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3432
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"1⤵
- Executes dropped EXE
PID:1980
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"1⤵
- Executes dropped EXE
PID:364