ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Size

57KB
MD5

c000b6bc63f8f6da787d8581289254a7
SHA1

12e95ac16e0c5d8df2d9e51a7da311be310f7acb
SHA256

ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4
SHA512

18397a9d2f4a02d89372fd372f6480a8a0e5ed46c416cba315bae732b4c07623bfb8b162279579a86b7a5a3bebb2eb09172f8c4eef2e49876e6b7e786ef9fbe8
SSDEEP

1536:o77/KSRNddvzL+nlAuRDDWTqRJWx02X0yYD4uM/BS2x95biTvvu/:o77/KSRNddvzL+nlAuRDDWTqRJ80EbYA

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3832	acrotray.exe
4612	acrotray.exe
4592	acrotray .exe
2804	acrotray .exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	acrotray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	acrotray .exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe"	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\acrotray .exe	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
File created	C:\Program Files (x86)\Adobe\acrotray.exe	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90cd09a05207d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000402"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2752190291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1117"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\megawebfind.com\Total = "1117"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c4893bfee90164c89f01cb7c55822840000000002000000000010660000000100002000000086fab011e26c4ca1891e70787b39e7c96303eaf57cc3610369575de3d1af8547000000000e800000000200002000000093f968fd7c30a9872b22a8dd8284ae437c8178ceee9ed0b63d970ee8181ce10e20000000f49b12b833b349a144e408a7492239f90cd0e27d51958fd57ec8a4ef93b3d5d9400000005a72b9112a228f19541dcf3259c17c95af8ca83fa0784d6646a8060c313313e6cbdf573fb19dc0a3c2bfdc29f0532cb4a538d8400f5240b4f03c79a2749ffbec	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\megawebfind.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www6.megawebfind.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CF8F2F8B-7345-11ED-A0EE-62142853BA25} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\megawebfind.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000402"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c4893bfee90164c89f01cb7c5582284000000000200000000001066000000010000200000000e76275f466262c196172cf786ac9729f88f88849ae375ce38b8cf10fe131f3b000000000e8000000002000020000000a8976796d5fd405e02c9c2a2d4269e88780ff287562dda2db3a2e28db59f4cd020000000522925ecb12413c9002c0f7393ca79599c485972dafbf5802bb8c07bb64bee8a400000005e2b1f82ba4aa90f4f19838e358c6ca5189b90ae4cf9b7a3977a4f36203a1e1ace9d13a6326b6ba1603e60a94199d77c361c3467083c81b234f8971200e5ec70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409a0eb05207d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\megawebfind.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www6.megawebfind.com\ = "1117"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2752190291"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
3832	acrotray.exe
3832	acrotray.exe
3832	acrotray.exe
3832	acrotray.exe
3832	acrotray.exe
3832	acrotray.exe
4612	acrotray.exe
4612	acrotray.exe
4612	acrotray.exe
4612	acrotray.exe
4592	acrotray .exe
4592	acrotray .exe
4592	acrotray .exe
4592	acrotray .exe
4592	acrotray .exe
4592	acrotray .exe
2804	acrotray .exe
2804	acrotray .exe
2804	acrotray .exe
2804	acrotray .exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
4612	acrotray.exe
4612	acrotray.exe
2804	acrotray .exe
2804	acrotray .exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
4612	acrotray.exe
4612	acrotray.exe
2804	acrotray .exe
2804	acrotray .exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
4612	acrotray.exe
4612	acrotray.exe
2804	acrotray .exe
2804	acrotray .exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
4612	acrotray.exe
4612	acrotray.exe
2804	acrotray .exe
2804	acrotray .exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
4612	acrotray.exe
4612	acrotray.exe
2804	acrotray .exe
2804	acrotray .exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
4612	acrotray.exe
4612	acrotray.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Token: SeDebugPrivilege	644	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
Token: SeDebugPrivilege	3832	acrotray.exe
Token: SeDebugPrivilege	4612	acrotray.exe
Token: SeDebugPrivilege	4592	acrotray .exe
Token: SeDebugPrivilege	2804	acrotray .exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
212	IEXPLORE.EXE
212	IEXPLORE.EXE
1748	iexplore.exe
1748	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
1748	iexplore.exe
1748	iexplore.exe
4072	IEXPLORE.EXE
4072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 644	848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	82
PID 848 wrote to memory of 644	848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	82
PID 848 wrote to memory of 644	848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	82
PID 848 wrote to memory of 3832	848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	83
PID 848 wrote to memory of 3832	848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	83
PID 848 wrote to memory of 3832	848	ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe	83
PID 1748 wrote to memory of 212	1748	iexplore.exe	86
PID 1748 wrote to memory of 212	1748	iexplore.exe	86
PID 1748 wrote to memory of 212	1748	iexplore.exe	86
PID 3832 wrote to memory of 4612	3832	acrotray.exe	87
PID 3832 wrote to memory of 4612	3832	acrotray.exe	87
PID 3832 wrote to memory of 4612	3832	acrotray.exe	87
PID 3832 wrote to memory of 4592	3832	acrotray.exe	88
PID 3832 wrote to memory of 4592	3832	acrotray.exe	88
PID 3832 wrote to memory of 4592	3832	acrotray.exe	88
PID 4592 wrote to memory of 2804	4592	acrotray .exe	89
PID 4592 wrote to memory of 2804	4592	acrotray .exe	89
PID 4592 wrote to memory of 2804	4592	acrotray .exe	89
PID 1748 wrote to memory of 2556	1748	iexplore.exe	98
PID 1748 wrote to memory of 2556	1748	iexplore.exe	98
PID 1748 wrote to memory of 2556	1748	iexplore.exe	98
PID 1748 wrote to memory of 4072	1748	iexplore.exe	99
PID 1748 wrote to memory of 4072	1748	iexplore.exe	99
PID 1748 wrote to memory of 4072	1748	iexplore.exe	99

C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
"C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe
  "C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Program Files (x86)\Adobe\acrotray.exe
  "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Program Files (x86)\Adobe\acrotray.exe
    "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Program Files (x86)\Adobe\acrotray .exe
    "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Program Files (x86)\Adobe\acrotray .exe
      "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\ad488d3f91755d7beea5ec900566495da8515e3d8af9f7f75ad20638a15f58b4.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:3584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:17418 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:82948 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
76KB

MD5
aa5b003ecf07ac343d65f67b23a27750

SHA1
c3af0ff3c999d4e22d22001aea8fce766436584c

SHA256
2b8c32aaf81401733fde01fa99d998302596eee168fec92250ee598e8b95412b

SHA512
4627686f589edbac3b3b8ccb863acc79d550c609f80a8559b34b4104a8c42bea292da51c2746ec4942a2db9d0ae6a73eaec0d34b3d549ebd3f0e00a9c4f454e7

Download Submit
C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
76KB

MD5
aa5b003ecf07ac343d65f67b23a27750

SHA1
c3af0ff3c999d4e22d22001aea8fce766436584c

SHA256
2b8c32aaf81401733fde01fa99d998302596eee168fec92250ee598e8b95412b

SHA512
4627686f589edbac3b3b8ccb863acc79d550c609f80a8559b34b4104a8c42bea292da51c2746ec4942a2db9d0ae6a73eaec0d34b3d549ebd3f0e00a9c4f454e7

Download Submit
C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
76KB

MD5
aa5b003ecf07ac343d65f67b23a27750

SHA1
c3af0ff3c999d4e22d22001aea8fce766436584c

SHA256
2b8c32aaf81401733fde01fa99d998302596eee168fec92250ee598e8b95412b

SHA512
4627686f589edbac3b3b8ccb863acc79d550c609f80a8559b34b4104a8c42bea292da51c2746ec4942a2db9d0ae6a73eaec0d34b3d549ebd3f0e00a9c4f454e7

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
66KB

MD5
0997d81dd07e0137b9bc0dd50b539b96

SHA1
34331ecd56b6bf3c25f3b7e396a1337418c9adf1

SHA256
c0379bc3b02e78d7c409a8e1875df668356e1137f55b5c38b77506dec8bf2095

SHA512
22465cd7e34f706dcaa6a24c275c73b5fba6c39ebbd591d9b60e2d7bfd103d3aa8cd1ba443fb296a13e3e51eaecbd74a527a9616b83031eaabb1bf3bd790be71

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
66KB

MD5
0997d81dd07e0137b9bc0dd50b539b96

SHA1
34331ecd56b6bf3c25f3b7e396a1337418c9adf1

SHA256
c0379bc3b02e78d7c409a8e1875df668356e1137f55b5c38b77506dec8bf2095

SHA512
22465cd7e34f706dcaa6a24c275c73b5fba6c39ebbd591d9b60e2d7bfd103d3aa8cd1ba443fb296a13e3e51eaecbd74a527a9616b83031eaabb1bf3bd790be71

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
66KB

MD5
0997d81dd07e0137b9bc0dd50b539b96

SHA1
34331ecd56b6bf3c25f3b7e396a1337418c9adf1

SHA256
c0379bc3b02e78d7c409a8e1875df668356e1137f55b5c38b77506dec8bf2095

SHA512
22465cd7e34f706dcaa6a24c275c73b5fba6c39ebbd591d9b60e2d7bfd103d3aa8cd1ba443fb296a13e3e51eaecbd74a527a9616b83031eaabb1bf3bd790be71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
11acbd1ce7fe1ce8a86bf584c02067d4

SHA1
fb871afaf09064ce8d079f5e39aaed3a4bdc0a57

SHA256
f24e309dd00df0d4bb5e7c4992a985f60b21b90aa1bbc7a2806053f2a6661596

SHA512
f6348b65224116a591d011a83b7fbf947c7c9ab00a58fab927fad7fb4cef952f0fb4ecc88babe3ee20dbaab18059d9fababf326f8bf9a0ca248a054939051662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9ccc194c1a42036ca347fdd612d547bb

SHA1
497c54f07d2fbd57c1a00876fa720375e6eb6c39

SHA256
7ad4a4ba6d111a828f13de58e2b0efdd49da969f8fa4f4d9dfb32eedc32e82bb

SHA512
f0792ef38109ae7930b059d99fc6c0bde6bc1c32bd21b52b97b9f99c91925d5648966c87e61ddbdfe03f8b89acecc8c00ebba2726ac3dba8c16a3c85b462ae77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
863d87567b4073a159a05dd4175e9e63

SHA1
15bf86ed91e5d69366cada4ffd5ab911bff7a460

SHA256
d66fc07bda766bdfe60ee64ea24f35e4a2b1b3f93d95d2c5136edd3bbd280075

SHA512
0e57365cd1f377b2203ab2939fae8ac75676a8a96e67a4b406a640fba5f0a8902b52c8d311e7559d74ef8e68685ab58111d71f4bd42c9128356ec385f5986ff0

Download Submit
memory/848-132-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download