Analysis
-
max time kernel
154s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:06
Static task
static1
Behavioral task
behavioral1
Sample
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
Resource
win7-20220414-en
General
-
Target
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
-
Size
3.9MB
-
MD5
855c397b671d85fb2422b31924f8af9f
-
SHA1
a2750adf76a245c6f822dc9723e9660b833ca8d4
-
SHA256
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
-
SHA512
921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
Malware Config
Signatures
-
XMRig Miner Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5108-132-0x0000000000800000-0x000000000098B000-memory.dmp xmrig behavioral2/memory/5108-139-0x0000000000800000-0x000000000098B000-memory.dmp xmrig behavioral2/memory/4340-145-0x0000000000F00000-0x000000000108B000-memory.dmp xmrig behavioral2/memory/4340-153-0x0000000000F00000-0x000000000108B000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
AdobeUpdateService.exeAdobeUpdateService.exepid process 2116 AdobeUpdateService.exe 4340 AdobeUpdateService.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exedescription pid process target process PID 916 set thread context of 5108 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 2116 set thread context of 4340 2116 AdobeUpdateService.exe AdobeUpdateService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AdobeUpdateService.exepid process 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe 4340 AdobeUpdateService.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AdobeUpdateService.exedescription pid process Token: SeLockMemoryPrivilege 4340 AdobeUpdateService.exe Token: SeLockMemoryPrivilege 4340 AdobeUpdateService.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exepid process 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 2116 AdobeUpdateService.exe 2116 AdobeUpdateService.exe 2116 AdobeUpdateService.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exepid process 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe 2116 AdobeUpdateService.exe 2116 AdobeUpdateService.exe 2116 AdobeUpdateService.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exedescription pid process target process PID 916 wrote to memory of 5108 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 916 wrote to memory of 5108 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 916 wrote to memory of 5108 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 916 wrote to memory of 5108 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 916 wrote to memory of 5108 916 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe PID 5108 wrote to memory of 4632 5108 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe schtasks.exe PID 5108 wrote to memory of 4632 5108 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe schtasks.exe PID 5108 wrote to memory of 4632 5108 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe schtasks.exe PID 5108 wrote to memory of 2116 5108 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 5108 wrote to memory of 2116 5108 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 5108 wrote to memory of 2116 5108 b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe AdobeUpdateService.exe PID 2116 wrote to memory of 4340 2116 AdobeUpdateService.exe AdobeUpdateService.exe PID 2116 wrote to memory of 4340 2116 AdobeUpdateService.exe AdobeUpdateService.exe PID 2116 wrote to memory of 4340 2116 AdobeUpdateService.exe AdobeUpdateService.exe PID 2116 wrote to memory of 4340 2116 AdobeUpdateService.exe AdobeUpdateService.exe PID 2116 wrote to memory of 4340 2116 AdobeUpdateService.exe AdobeUpdateService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 5 /TN "Adobe Service Task Host" /TR "C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exeFilesize
3.9MB
MD5855c397b671d85fb2422b31924f8af9f
SHA1a2750adf76a245c6f822dc9723e9660b833ca8d4
SHA256b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd
SHA512921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09
-
memory/2116-141-0x0000000000000000-mapping.dmp
-
memory/4340-144-0x0000000000000000-mapping.dmp
-
memory/4340-145-0x0000000000F00000-0x000000000108B000-memory.dmpFilesize
1.5MB
-
memory/4340-153-0x0000000000F00000-0x000000000108B000-memory.dmpFilesize
1.5MB
-
memory/4632-140-0x0000000000000000-mapping.dmp
-
memory/5108-131-0x0000000000000000-mapping.dmp
-
memory/5108-132-0x0000000000800000-0x000000000098B000-memory.dmpFilesize
1.5MB
-
memory/5108-139-0x0000000000800000-0x000000000098B000-memory.dmpFilesize
1.5MB