e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677

Analysis

max time kernel
147s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe
Size

236KB
MD5

45f843d184b7adb06d03c24b1db94b8a
SHA1

42b38e6c2af494645162c161c0609e2b8b1c54b8
SHA256

e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677
SHA512

add63ae5aa3ea1bfa56b3d6fa75f1e798c855d97090325d40bdf02758942ceb8118c5eb153d7f124533146983f3a87214dd025f3d01879ca8f703689586a3769
SSDEEP

3072:5JtjTJK5x0GI5wkdeP7Lb7raJK1bAkgFwxpiIE:tTJem5PQeJoA

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
208	Acrobat.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Acrobat.exe
File opened (read-only)	\??\B:	Acrobat.exe
File opened (read-only)	\??\E:	Acrobat.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Windows.Manifest	Acrobat.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS	Acrobat.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4500	reg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
208	Acrobat.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe
1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe
1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe
208	Acrobat.exe
208	Acrobat.exe
208	Acrobat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 308	1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe	88
PID 1716 wrote to memory of 308	1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe	88
PID 1716 wrote to memory of 308	1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe	88
PID 1716 wrote to memory of 208	1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe	90
PID 1716 wrote to memory of 208	1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe	90
PID 1716 wrote to memory of 208	1716	e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe	90
PID 308 wrote to memory of 4500	308	cmd.exe	91
PID 308 wrote to memory of 4500	308	cmd.exe	91
PID 308 wrote to memory of 4500	308	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe
"C:\Users\Admin\AppData\Local\Temp\e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg delete HKCU\Software\yahoo\pager /v "Save Password" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKCU\Software\yahoo\pager /v "Save Password" /f
    3⤵
    - Modifies registry key
    PID:4500
- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe
  "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe

Filesize
236KB

MD5
45f843d184b7adb06d03c24b1db94b8a

SHA1
42b38e6c2af494645162c161c0609e2b8b1c54b8

SHA256
e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677

SHA512
add63ae5aa3ea1bfa56b3d6fa75f1e798c855d97090325d40bdf02758942ceb8118c5eb153d7f124533146983f3a87214dd025f3d01879ca8f703689586a3769

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Acrobat.exe

Filesize
236KB

MD5
45f843d184b7adb06d03c24b1db94b8a

SHA1
42b38e6c2af494645162c161c0609e2b8b1c54b8

SHA256
e9a85f74f3aeda50a32e7742c6068844c9f93c1b8961b7cd7e8950f888db1677

SHA512
add63ae5aa3ea1bfa56b3d6fa75f1e798c855d97090325d40bdf02758942ceb8118c5eb153d7f124533146983f3a87214dd025f3d01879ca8f703689586a3769

Download Submit
memory/208-143-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1716-132-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1716-142-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads