2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f

General

Target

2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Size

2.4MB
MD5

74347dc3a096caf972f84ad25b5f60d9
SHA1

e5c77ef37a9b19d586dd0ee0b8cc4d755724c59e
SHA256

2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f
SHA512

965db68a2afbf774aa1585096d096ff725b8bc7851685f659101c0d1fbdfd5815e6e471d86e523936685ece139c2b5d712c4ecad694d74cac9308008a1c9328d

Score

10^/10

adobe phishing upx

Malware Config

Signatures

Detected adobe phishing page
phishing adobe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1976-130-0x0000000000DB0000-0x000000000153A000-memory.dmp	upx
behavioral2/memory/1976-131-0x0000000000DB0000-0x000000000153A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

Processes:

2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com\ = "48"	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe = "11001"	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "48"	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "48"	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\NumberOfSubdomains = "1"	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

pid	process
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
Token: SeIncreaseQuotaPrivilege	1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

pid	process
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
1976	2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe

C:\Users\Admin\AppData\Local\Temp\2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe
"C:\Users\Admin\AppData\Local\Temp\2c3e75fb4e864ada796de818602fdde4a5100d5c3d981fe5295dac98de660c5f.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-130-0x0000000000DB0000-0x000000000153A000-memory.dmp

Filesize
7.5MB

Download
memory/1976-131-0x0000000000DB0000-0x000000000153A000-memory.dmp

Filesize
7.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads