Analysis
-
max time kernel
152s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:06
Static task
static1
Behavioral task
behavioral1
Sample
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
Resource
win7-20220414-en
General
-
Target
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
-
Size
3.9MB
-
MD5
855c397b671d85fb2422b31924f8af9f
-
SHA1
a2750adf76a245c6f822dc9723e9660b833ca8d4
-
SHA256
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
-
SHA512
921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
Malware Config
Signatures
-
XMRig Miner Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1408-57-0x0000000000610000-0x000000000079B000-memory.dmp xmrig behavioral1/memory/1408-64-0x000000000072B8DA-mapping.dmp xmrig behavioral1/memory/1408-66-0x0000000000610000-0x000000000079B000-memory.dmp xmrig behavioral1/memory/376-78-0x0000000000530000-0x00000000006BB000-memory.dmp xmrig behavioral1/memory/376-83-0x000000000064B8DA-mapping.dmp xmrig behavioral1/memory/376-86-0x0000000000530000-0x00000000006BB000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
AdobeUpdateService.exeAdobeUpdateService.exepid process 812 AdobeUpdateService.exe 376 AdobeUpdateService.exe -
Loads dropped DLL 2 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exepid process 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 812 AdobeUpdateService.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe \Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exedescription pid process target process PID 884 set thread context of 1408 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 812 set thread context of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AdobeUpdateService.exepid process 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe 376 AdobeUpdateService.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AdobeUpdateService.exedescription pid process Token: SeLockMemoryPrivilege 376 AdobeUpdateService.exe Token: SeLockMemoryPrivilege 376 AdobeUpdateService.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exepid process 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 812 AdobeUpdateService.exe 812 AdobeUpdateService.exe 812 AdobeUpdateService.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exepid process 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 812 AdobeUpdateService.exe 812 AdobeUpdateService.exe 812 AdobeUpdateService.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exedescription pid process target process PID 884 wrote to memory of 1408 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 884 wrote to memory of 1408 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 884 wrote to memory of 1408 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 884 wrote to memory of 1408 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 884 wrote to memory of 1408 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 884 wrote to memory of 1408 884 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 1408 wrote to memory of 1272 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe schtasks.exe PID 1408 wrote to memory of 1272 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe schtasks.exe PID 1408 wrote to memory of 1272 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe schtasks.exe PID 1408 wrote to memory of 1272 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe schtasks.exe PID 1408 wrote to memory of 812 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 1408 wrote to memory of 812 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 1408 wrote to memory of 812 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 1408 wrote to memory of 812 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 1408 wrote to memory of 812 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 1408 wrote to memory of 812 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 1408 wrote to memory of 812 1408 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe PID 812 wrote to memory of 376 812 AdobeUpdateService.exe AdobeUpdateService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 5 /TN "Adobe Service Task Host" /TR "C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
memory/376-86-0x0000000000530000-0x00000000006BB000-memory.dmpFilesize
1.5MB
-
memory/376-83-0x000000000064B8DA-mapping.dmp
-
memory/376-78-0x0000000000530000-0x00000000006BB000-memory.dmpFilesize
1.5MB
-
memory/376-77-0x0000000000531000-0x0000000000689000-memory.dmpFilesize
1.3MB
-
memory/812-69-0x0000000000000000-mapping.dmp
-
memory/884-54-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/1272-67-0x0000000000000000-mapping.dmp
-
memory/1408-66-0x0000000000610000-0x000000000079B000-memory.dmpFilesize
1.5MB
-
memory/1408-64-0x000000000072B8DA-mapping.dmp
-
memory/1408-57-0x0000000000610000-0x000000000079B000-memory.dmpFilesize
1.5MB
-
memory/1408-55-0x0000000000610000-0x000000000079B000-memory.dmpFilesize
1.5MB