ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Size

57KB
MD5

c000b6bc63f8f6da787d8581289254a7
SHA1

12e95ac16e0c5d8df2d9e51a7da311be310f7acb
SHA256

ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4
SHA512

18397a9d2f4a02d89372fd372f6480a8a0e5ed46c416cba315bae732b4c07623bfb8b162279579a86b7a5a3bebb2eb09172f8c4eef2e49876e6b7e786ef9fbe8
SSDEEP

1536:o77/KSRNddvzL+nlAuRDDWTqRJWx02X0yYD4uM/BS2x95biTvvu/:o77/KSRNddvzL+nlAuRDDWTqRJ80EbYA

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1732	acrotray.exe
2024	acrotray.exe
1500	acrotray .exe
1900	acrotray .exe

Loads dropped DLL 4 IoCs

pid	Process
1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
1732	acrotray.exe
1732	acrotray.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe"	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\acrotray.exe	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
File created	\??\c:\program files (x86)\microsoft office\office14\bcssync.exe	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
File created	C:\Program Files (x86)\Adobe\acrotray .exe	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\megawebfind.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\megawebfind.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.megawebfind.com\ = "1117"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\megawebfind.com\Total = "1117"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004cb5101ee1c66044b9ed7c75968968a800000000020000000000106600000001000020000000a1dc303f2e529fc08c51fbb39cd6129e5291424ec4a8881054077308d37170b1000000000e8000000002000020000000a4d7595a813734d049b3908d05242d5d67d0d57f3a8cbdd23fb64124a4508aca20000000bee00e51ba3aaabea725bc535e256b9128794f0bbf3ed8d20d321f8086032f8d40000000d1665a05ed08ca5c1911cb49117b3807a5408c0c49bfedc0fa1f556790e822389636c89c33a19895d968e23745530753865558b45fffde7317e87345600ba94e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.megawebfind.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CED1E811-7345-11ED-B243-5AF036119C64} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1117"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407fc8b15207d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004cb5101ee1c66044b9ed7c75968968a800000000020000000000106600000001000020000000ec16035a3e21537241d708657123434c85ec79adab2dbc616ee2c0eb7bc63839000000000e80000000020000200000000374110715855e51daa9e3683ddf19b5b3b5885c777ff7f4f6189fc5ae5bf7bc90000000d43e39e9bc0c4ee1cd36338e643b9ef5f550db4b1fc98d94089a72f9c8551c8e50f022fa4a7751f9f390d201bd2115234ea386e99cdfcc92880b0bb09be9f8588c58d44edf132f9db3c567aab07c3cdf249aa6f863c1ddcca54668a38227a769296696c044860d6cb4a1a1a79f026800a169f47301d75c95bbb3d757bc60eda6cb37f8988787c4832486de86e62280c840000000e26c41db684ff5bdf440136c0cfa9a9d48689dd5f96b0f21e893729f5fbb895faf360c14b01154d5ea6e0a8e5dae918f3b2644836167392803aeba3e18440eb0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376862894"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
1732	acrotray.exe
1732	acrotray.exe
1732	acrotray.exe
2024	acrotray.exe
2024	acrotray.exe
1500	acrotray .exe
1500	acrotray .exe
1500	acrotray .exe
1900	acrotray .exe
1900	acrotray .exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2024	acrotray.exe
1900	acrotray .exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2024	acrotray.exe
1900	acrotray .exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2024	acrotray.exe
1900	acrotray .exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2024	acrotray.exe
1900	acrotray .exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2024	acrotray.exe
1900	acrotray .exe
652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
2024	acrotray.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Token: SeDebugPrivilege	2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Token: SeDebugPrivilege	652	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Token: SeDebugPrivilege	1732	acrotray.exe
Token: SeDebugPrivilege	2024	acrotray.exe
Token: SeDebugPrivilege	1500	acrotray .exe
Token: SeDebugPrivilege	1900	acrotray .exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1428	iexplore.exe
1428	iexplore.exe
1428	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1428	iexplore.exe
1428	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1428	iexplore.exe
1428	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1428	iexplore.exe
1428	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2040	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	27
PID 1408 wrote to memory of 2040	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	27
PID 1408 wrote to memory of 2040	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	27
PID 1408 wrote to memory of 2040	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	27
PID 2040 wrote to memory of 652	2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	28
PID 2040 wrote to memory of 652	2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	28
PID 2040 wrote to memory of 652	2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	28
PID 2040 wrote to memory of 652	2040	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	28
PID 1408 wrote to memory of 1732	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	29
PID 1408 wrote to memory of 1732	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	29
PID 1408 wrote to memory of 1732	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	29
PID 1408 wrote to memory of 1732	1408	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	29
PID 1732 wrote to memory of 2024	1732	acrotray.exe	32
PID 1732 wrote to memory of 2024	1732	acrotray.exe	32
PID 1732 wrote to memory of 2024	1732	acrotray.exe	32
PID 1732 wrote to memory of 2024	1732	acrotray.exe	32
PID 1732 wrote to memory of 1500	1732	acrotray.exe	33
PID 1732 wrote to memory of 1500	1732	acrotray.exe	33
PID 1732 wrote to memory of 1500	1732	acrotray.exe	33
PID 1732 wrote to memory of 1500	1732	acrotray.exe	33
PID 1500 wrote to memory of 1900	1500	acrotray .exe	34
PID 1500 wrote to memory of 1900	1500	acrotray .exe	34
PID 1500 wrote to memory of 1900	1500	acrotray .exe	34
PID 1500 wrote to memory of 1900	1500	acrotray .exe	34
PID 1428 wrote to memory of 1616	1428	iexplore.exe	35
PID 1428 wrote to memory of 1616	1428	iexplore.exe	35
PID 1428 wrote to memory of 1616	1428	iexplore.exe	35
PID 1428 wrote to memory of 1616	1428	iexplore.exe	35
PID 1428 wrote to memory of 1984	1428	iexplore.exe	37
PID 1428 wrote to memory of 1984	1428	iexplore.exe	37
PID 1428 wrote to memory of 1984	1428	iexplore.exe	37
PID 1428 wrote to memory of 1984	1428	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
"C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
  "C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
    "C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:652
- C:\Program Files (x86)\Adobe\acrotray.exe
  "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Program Files (x86)\Adobe\acrotray.exe
    "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Program Files (x86)\Adobe\acrotray .exe
    "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Program Files (x86)\Adobe\acrotray .exe
      "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:472083 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
59KB

MD5
c77ffd7f9265bc3f747dc50034a90c96

SHA1
55c0327c8935acb9a659a4d7ee2f00873e86387c

SHA256
07b106d51bc285c1e583c1a99e5b357bf0eb1eb7aeccb47e0560673c5d2d1c85

SHA512
350129537e92429033cba473d1a2304da0e383d4b132e56812f539b28f6fbbeb77704b5949410023e2c74c3208175a2546b830df9682c9e3729436f85996d4c4

Download Submit
C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
59KB

MD5
c77ffd7f9265bc3f747dc50034a90c96

SHA1
55c0327c8935acb9a659a4d7ee2f00873e86387c

SHA256
07b106d51bc285c1e583c1a99e5b357bf0eb1eb7aeccb47e0560673c5d2d1c85

SHA512
350129537e92429033cba473d1a2304da0e383d4b132e56812f539b28f6fbbeb77704b5949410023e2c74c3208175a2546b830df9682c9e3729436f85996d4c4

Download Submit
C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
59KB

MD5
c77ffd7f9265bc3f747dc50034a90c96

SHA1
55c0327c8935acb9a659a4d7ee2f00873e86387c

SHA256
07b106d51bc285c1e583c1a99e5b357bf0eb1eb7aeccb47e0560673c5d2d1c85

SHA512
350129537e92429033cba473d1a2304da0e383d4b132e56812f539b28f6fbbeb77704b5949410023e2c74c3208175a2546b830df9682c9e3729436f85996d4c4

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
88KB

MD5
99eb8b8998801d2bb74c411e565d0961

SHA1
17f45f62bcfd7f052a3e456aadb8d566035cbf79

SHA256
5b9ac7fa92f1d8cb97ae1c978782236a0de0eb50fc81a9d165e2e12afbf17b3c

SHA512
b8feddef24587b13b50f0fc9c5a54d6e57eeab310ef25a89866bce725835b77a6968c05c7c356514f20d1bb13cb34ceb54216703f6320eeb064306b074cbeded

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
88KB

MD5
99eb8b8998801d2bb74c411e565d0961

SHA1
17f45f62bcfd7f052a3e456aadb8d566035cbf79

SHA256
5b9ac7fa92f1d8cb97ae1c978782236a0de0eb50fc81a9d165e2e12afbf17b3c

SHA512
b8feddef24587b13b50f0fc9c5a54d6e57eeab310ef25a89866bce725835b77a6968c05c7c356514f20d1bb13cb34ceb54216703f6320eeb064306b074cbeded

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
88KB

MD5
99eb8b8998801d2bb74c411e565d0961

SHA1
17f45f62bcfd7f052a3e456aadb8d566035cbf79

SHA256
5b9ac7fa92f1d8cb97ae1c978782236a0de0eb50fc81a9d165e2e12afbf17b3c

SHA512
b8feddef24587b13b50f0fc9c5a54d6e57eeab310ef25a89866bce725835b77a6968c05c7c356514f20d1bb13cb34ceb54216703f6320eeb064306b074cbeded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
11acbd1ce7fe1ce8a86bf584c02067d4

SHA1
fb871afaf09064ce8d079f5e39aaed3a4bdc0a57

SHA256
f24e309dd00df0d4bb5e7c4992a985f60b21b90aa1bbc7a2806053f2a6661596

SHA512
f6348b65224116a591d011a83b7fbf947c7c9ab00a58fab927fad7fb4cef952f0fb4ecc88babe3ee20dbaab18059d9fababf326f8bf9a0ca248a054939051662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
7ddf72436b037b940bead298cdfb039c

SHA1
5718ffb9770f28a2ef61e1c0152050d23f4c6f50

SHA256
4cc8de206610cffcf202cb8b306549177b4495a791b2f6666dfcb93634d37205

SHA512
e33b0b76efbeb80b88b0ad079095412091655125e59d45f2566bfedae5121d6bb5136a5aaf7f959b911d6ff72f9eb98e06c99e85772473024d9ba651015163bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04c42124429f249481852e81a15f6a20

SHA1
ab7d785e35d14d0fee531b531057d43c6ca50457

SHA256
d92754b81cb3516a1a045e9df8a054b785c312a2ff2edaacb87495b107c584b3

SHA512
a9aa43e6f9d2cdfe830a93a82b3d2529d60aed4337bc05a47274b0c1dc6c412e8577019d05f37897dc7a04c91fc378d52326e22386a378e0434eb219c9cba3ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc034d9e361394b9d92f2041b6c5a1bc

SHA1
9af18d2821b259a60cd7447d1eb3b936794aea8d

SHA256
96ec9000564b31b14b49712494e57ab0c2dbbd99d87db4e2cedd0665b026b8c2

SHA512
f1f5c37bb4b38cc20c95d230559beb19dd9706024b5c0b466c81775e00d8ada0cc9632ec5edba2c596e9b868f9fd2368cb8c74ab05c3e658669da2d09cba8ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
fb88083cc7a6b701ca5b9453dd1414ff

SHA1
2edcc68d437f34a44583127495f23c9af16e0048

SHA256
5f6bb0c08d9508f33ee3edfbc7004042819bd1704cf56980a082a5b0178b830f

SHA512
44161cfac411ad9c840f2a68ca8f9fd127b1095440fc5c34235eadf3b196be0058ca600fe40143fef3f26b4d73b142ec6027fe38270ec5264a09dcf4375b7e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
25d7ebdaaeea98dc3cd87b44e927b896

SHA1
a326e61dcef28be060c98a22495008ba04fb2638

SHA256
a5eda3aa97b54d42eb557b579d62e24deb6e16d56428cba23b80840657ac6cfb

SHA512
7a0a0747ab1cf104486573d8bc3dbe9f478d654b79ff1917a8c9813b620bb630b172d92ef0fde85bee65973f5f6072f960591f7314f1b4ca4d8636887349cc9a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I3U5LWSJ.txt

Filesize
608B

MD5
2fd33be28f6ad2f01cf0fad9181a86f8

SHA1
c04bc6164ab49eb7b4ad13690bb361269b0ce38f

SHA256
9cd743311c1f1f6405dd45b0e85e39f4adc2e1b4cc7c2535d9689cb846108dce

SHA512
c283c98c554c2c040dc405fd10cdca2b9226ef0609381350cf2fcb3ffcc3f44c14641c966402b8a61cc947c4455e5831b72cdfdc35aac505aa62e18870ed81f7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WUI51ILA.txt

Filesize
114B

MD5
e95a17ba445c91f7181ff9742a59d2ee

SHA1
430a4e3a79b7a108a885a735abf2cd5075ef1633

SHA256
56d94d7b90a13f0754d70fddf5f9c75baa9d27c034645a80a5032a312f0abdae

SHA512
cda1bf6333067110f72a8cc7cafb593970f3f64ca5599e73f85931e6a8dfa318217011d590f74a979f4362424cdeed9f303583682cd2af32465ec22d3477cb1f

Download Submit
\Program Files (x86)\Adobe\acrotray .exe

Filesize
59KB

MD5
c77ffd7f9265bc3f747dc50034a90c96

SHA1
55c0327c8935acb9a659a4d7ee2f00873e86387c

SHA256
07b106d51bc285c1e583c1a99e5b357bf0eb1eb7aeccb47e0560673c5d2d1c85

SHA512
350129537e92429033cba473d1a2304da0e383d4b132e56812f539b28f6fbbeb77704b5949410023e2c74c3208175a2546b830df9682c9e3729436f85996d4c4

Download Submit
\Program Files (x86)\Adobe\acrotray .exe

Filesize
59KB

MD5
c77ffd7f9265bc3f747dc50034a90c96

SHA1
55c0327c8935acb9a659a4d7ee2f00873e86387c

SHA256
07b106d51bc285c1e583c1a99e5b357bf0eb1eb7aeccb47e0560673c5d2d1c85

SHA512
350129537e92429033cba473d1a2304da0e383d4b132e56812f539b28f6fbbeb77704b5949410023e2c74c3208175a2546b830df9682c9e3729436f85996d4c4

Download Submit
\Program Files (x86)\Adobe\acrotray.exe

Filesize
88KB

MD5
99eb8b8998801d2bb74c411e565d0961

SHA1
17f45f62bcfd7f052a3e456aadb8d566035cbf79

SHA256
5b9ac7fa92f1d8cb97ae1c978782236a0de0eb50fc81a9d165e2e12afbf17b3c

SHA512
b8feddef24587b13b50f0fc9c5a54d6e57eeab310ef25a89866bce725835b77a6968c05c7c356514f20d1bb13cb34ceb54216703f6320eeb064306b074cbeded

Download Submit
\Program Files (x86)\Adobe\acrotray.exe

Filesize
88KB

MD5
99eb8b8998801d2bb74c411e565d0961

SHA1
17f45f62bcfd7f052a3e456aadb8d566035cbf79

SHA256
5b9ac7fa92f1d8cb97ae1c978782236a0de0eb50fc81a9d165e2e12afbf17b3c

SHA512
b8feddef24587b13b50f0fc9c5a54d6e57eeab310ef25a89866bce725835b77a6968c05c7c356514f20d1bb13cb34ceb54216703f6320eeb064306b074cbeded

Download Submit
memory/1408-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1408-55-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download