9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf

Analysis

max time kernel
84s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
Size

927KB
MD5

4b1435fc8f2f3160e63718a9b446f7f0
SHA1

7f7af64b730e353ef93d3646a4d795a570c1a293
SHA256

9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf
SHA512

91a3d5d74e1abd60f0f2b38eb13d1cb375537ed1cc85067c3459c64375b010b5d8ccc2d74004d1546e41f2c3da8800745c1422dd4ac72a2edd2425263c92313d
SSDEEP

12288:Y/0DcLYk8zFcetqZQ5Z/IAIhTiRdvDEiUk+UQgiELr8keQuNGBHHn8titf1mmpxP:RhkqcetqS5lIAfdvDEiAUBhXs4jNnjr

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe

Drops file in Program Files directory 2 IoCs

Processes:

AdobeARM.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe

pid	process
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AdobeARM.exe

pid process

2436 AdobeARM.exe

pid	process
2436	AdobeARM.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exeAdobeARM.exe

description	pid	process	target process
PID 4952 wrote to memory of 2436	4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe	AdobeARM.exe
PID 4952 wrote to memory of 2436	4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe	AdobeARM.exe
PID 4952 wrote to memory of 2436	4952	9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe	AdobeARM.exe
PID 2436 wrote to memory of 3628	2436	AdobeARM.exe	Reader_sl.exe
PID 2436 wrote to memory of 3628	2436	AdobeARM.exe	Reader_sl.exe
PID 2436 wrote to memory of 3628	2436	AdobeARM.exe	Reader_sl.exe

C:\Users\Admin\AppData\Local\Temp\9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe
"C:\Users\Admin\AppData\Local\Temp\9a26d0a24e38831c1afe5afafbfb29cd0e3dee6094312b64aefe764193d61dcf.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
3⤵
PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Filesize
358B

MD5
ba8087fe55bd299f29b040c0f730ac1e

SHA1
e9e7ba59e39d8592b2fd61a0891d00bceb477c98

SHA256
b9adaa7dc4891db3554fde347bf3fc1975fc0998efe16c4b07bbb087122807e0

SHA512
cd0db7b0b6d1111c8414362d3490b0ea26416de9d276539fa14c42ca287818989b013fe7314e6e5b84f6a732fe332facaeb731ac53baed0bbd14d265e7a8fb59

Download Submit
memory/2436-133-0x0000000000000000-mapping.dmp

Download
memory/3628-136-0x0000000000000000-mapping.dmp

Download
memory/4952-132-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/4952-134-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download