raccoon | 086597278e12f85f681434711e5c61d4ab0ae8637eb02da51980c381428144f5

Modify Registry

Processes:

MsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe

Sets file execution options in registry 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

AdobeARM.exeRdrCEF.exeRdrCEF.exeAcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	AdobeARM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	RdrCEF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	RdrCEF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	AcroRd32.exe

Executes dropped EXE 14 IoCs

Processes:

setup.exeMSI12EF.tmpFullTrustNotifier.exeRdrServicesUpdater.exearmsvc.exeAcroRd32.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeAdobeARM.exeReader_sl.exe

pid	process
408	setup.exe
4664	MSI12EF.tmp
3472	FullTrustNotifier.exe
1968	RdrServicesUpdater.exe
3600	armsvc.exe
4288	AcroRd32.exe
2060	RdrCEF.exe
2076	RdrCEF.exe
660	RdrCEF.exe
5008	RdrCEF.exe
520	RdrCEF.exe
760	RdrCEF.exe
4192	AdobeARM.exe
4872	Reader_sl.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

pid	process
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe

Registers COM server for autorun 1 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl64.dll"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

AcroRd32.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AcroRd32.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AcroRd32.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 11 IoCs

Processes:

msiexec.exemsiexec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib110.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

MsiExec.exeRdrServicesUpdater.exemsiexec.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg	MsiExec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot_2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_gif_Exp.gif	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ESP\Edit_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF64.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\createpdf.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_thumbnailview_18.svg	MsiExec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.jpg	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg	MsiExec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_share_attach_18@2x.png	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down-pressed.gif	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_it_135x40.svg	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\added.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\sample-thumb.png	MsiExec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ar_get.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js	MsiExec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons2x.png	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png	MsiExec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-hover_32.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\desktop-tool-view.css	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\delete.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-hover.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h.png	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_link_18.svg	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview-hover.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\ui-strings.js	RdrServicesUpdater.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\acrocef.exe.15EE1C08_ED51_465D_B6F3_FB152B1CC435	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\acropdf64.dll	msiexec.exe
File created	C:\Windows\Installer\e584e6d.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584e72.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f4e.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584f04.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f13.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\ahclient.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\EScript.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584ed5.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584ef8.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584f3e.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584eaf.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584ec8.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584f53.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\prcr.x3d	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ViewerPS.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584eb5.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584eee.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f58.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\drvSOFT.x3d	msiexec.exe
File opened for modification	C:\Windows\Installer\e584e88.HDR	msiexec.exe
File created	C:\Windows\Installer\e584e8f.HDR	msiexec.exe
File created	C:\Windows\Installer\e584ea5.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\AcroRd32.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\libcef.dll.15EE1C08_ED51_465D_B6F3_FB152B1CC435	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\icucnv40.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e584e5c.HDR	msiexec.exe
File created	C:\Windows\Installer\e584e73.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\Edit_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\acrotextextractor.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58AD.tmp	msiexec.exe
File created	C:\Windows\Installer\e584eb2.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584f41.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f46.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\brdlang32.esp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1254.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\CollectSignatures.aapp7	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI373F.tmp	msiexec.exe
File created	C:\Windows\Installer\e584ec4.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584ed6.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f42.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f16.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\displaylanguagenames.es_pa.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\DataMatrix.pmp	msiexec.exe
File created	C:\Windows\Installer\e584ee7.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\displaylanguagenames.es_sv.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\AGM.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\Edit_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12DE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584e6d.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584eb2.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f4f.HDR	msiexec.exe
File created	C:\Windows\Installer\e584ef5.HDR	msiexec.exe
File created	C:\Windows\Installer\e584f24.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e584f52.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\MCIMPP.mpp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744CAF070E41400\15.7.20033\EPDF_Full.aapp	msiexec.exe
File created	C:\Windows\Installer\e584e76.HDR	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exeAcroRd32.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroRd32.exe = "11000"	AcroRd32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\Policy = "3"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppName = "RdrCEF.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppName = "AcroRd32.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe

Modifies data under HKEY_USERS 7 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithProgids\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell\Printto\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" /t \"%1\" \"%2\" \"%3\" \"%4\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA74301B744CAF070E41400\Language = "1034"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AFormAut.App\ = "AFormApp Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Adobe.AcrobatSearch	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\4\ = "NotesDocInfo, 1, 1, 2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00FFD6C4-1A94-44BC-AD3E-8AC18552E3E6}\{B4848E37-7C66-40A6-9F66-D3A9BC8F4636}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CD069A0-50AA-11D1-B8F0-00A0C9259304}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.FDFDoc\shell\Open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\8\ = "Rich Text Format, 1, 1, 1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\VersionIndependentProgID\ = "Adobe.Reader.BitmapFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68AB67CA7DA74301B744CAF070E41400\Plugins = "ReaderProgramFiles"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.fdf	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.XFDFDoc\shell\Print	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\ddeexec\topic\ = "Control"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler\ = "Adobe PDF Preview Handler for Vista"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE}\ = "CAcroPDPage"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\ = "Adobe Acrobat 7.0 Browser Control Type Library 1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\CurVer\ = "AcroExch.acrobatsecuritysettings.1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\ToolboxBitmap32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xdp+xml\Extension = ".xdp"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\protocol\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\ = "Adobe Acrobat Sharepoint OpenDocuments Component"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\OpenWithProgids	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3F0-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3F1-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2018\DefaultIcon\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf\CLSID = "{CA8A9780-280D-11CF-A24D-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker\CLSID\ = "{BD57A9B2-4E7D-4892-9107-9F4106472DA4}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Control	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\acrobat2018\shell\open\ddeexec\topic	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3EC-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\1\ = "14,1,64,1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41C5FFFE-36DD-415D-9ED0-2976A342A1C8}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\ = "Read"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\OpenWithProgids\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.FDFDoc\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\ProxyStubClsid32\ = "{12BA069D-0FC6-4577-97C6-5DF634CE6E84}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\MiscStatus	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.api	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xfd	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/pdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EB-4981-101B-9CA8-9240CE2738AE}\ = "CAcroPDAnnot"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\NumMethods\ = "7"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\DefaultIcon\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Read\ = "Abrir con Adobe Acrobat Reader DC"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{F2383816-917A-46CC-AD2A-5013BED3800F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4A894040-247E-4AFF-BB08-3489E9905235}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.FDFDoc\AcrobatVersion	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\TypeLib\Version = "3.0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeAcroRd32.exe

pid	process
868	MsiExec.exe
868	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	216	msiexec.exe
Token: SeSecurityPrivilege	392	msiexec.exe
Token: SeCreateTokenPrivilege	216	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	216	msiexec.exe
Token: SeLockMemoryPrivilege	216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	216	msiexec.exe
Token: SeMachineAccountPrivilege	216	msiexec.exe
Token: SeTcbPrivilege	216	msiexec.exe
Token: SeSecurityPrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeLoadDriverPrivilege	216	msiexec.exe
Token: SeSystemProfilePrivilege	216	msiexec.exe
Token: SeSystemtimePrivilege	216	msiexec.exe
Token: SeProfSingleProcessPrivilege	216	msiexec.exe
Token: SeIncBasePriorityPrivilege	216	msiexec.exe
Token: SeCreatePagefilePrivilege	216	msiexec.exe
Token: SeCreatePermanentPrivilege	216	msiexec.exe
Token: SeBackupPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeShutdownPrivilege	216	msiexec.exe
Token: SeDebugPrivilege	216	msiexec.exe
Token: SeAuditPrivilege	216	msiexec.exe
Token: SeSystemEnvironmentPrivilege	216	msiexec.exe
Token: SeChangeNotifyPrivilege	216	msiexec.exe
Token: SeRemoteShutdownPrivilege	216	msiexec.exe
Token: SeUndockPrivilege	216	msiexec.exe
Token: SeSyncAgentPrivilege	216	msiexec.exe
Token: SeEnableDelegationPrivilege	216	msiexec.exe
Token: SeManageVolumePrivilege	216	msiexec.exe
Token: SeImpersonatePrivilege	216	msiexec.exe
Token: SeCreateGlobalPrivilege	216	msiexec.exe
Token: SeCreateTokenPrivilege	216	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	216	msiexec.exe
Token: SeLockMemoryPrivilege	216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	216	msiexec.exe
Token: SeMachineAccountPrivilege	216	msiexec.exe
Token: SeTcbPrivilege	216	msiexec.exe
Token: SeSecurityPrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeLoadDriverPrivilege	216	msiexec.exe
Token: SeSystemProfilePrivilege	216	msiexec.exe
Token: SeSystemtimePrivilege	216	msiexec.exe
Token: SeProfSingleProcessPrivilege	216	msiexec.exe
Token: SeIncBasePriorityPrivilege	216	msiexec.exe
Token: SeCreatePagefilePrivilege	216	msiexec.exe
Token: SeCreatePermanentPrivilege	216	msiexec.exe
Token: SeBackupPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeShutdownPrivilege	216	msiexec.exe
Token: SeDebugPrivilege	216	msiexec.exe
Token: SeAuditPrivilege	216	msiexec.exe
Token: SeSystemEnvironmentPrivilege	216	msiexec.exe
Token: SeChangeNotifyPrivilege	216	msiexec.exe
Token: SeRemoteShutdownPrivilege	216	msiexec.exe
Token: SeUndockPrivilege	216	msiexec.exe
Token: SeSyncAgentPrivilege	216	msiexec.exe
Token: SeEnableDelegationPrivilege	216	msiexec.exe
Token: SeManageVolumePrivilege	216	msiexec.exe
Token: SeImpersonatePrivilege	216	msiexec.exe
Token: SeCreateGlobalPrivilege	216	msiexec.exe
Token: SeCreateTokenPrivilege	216	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	216	msiexec.exe
Token: SeLockMemoryPrivilege	216	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

216 msiexec.exe
216 msiexec.exe

pid	process
216	msiexec.exe
216	msiexec.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

Adobe Reader W10.exesetup.exeAcroRd32.exeAdobeARM.exe

pid	process
4824	Adobe Reader W10.exe
4824	Adobe Reader W10.exe
4824	Adobe Reader W10.exe
408	setup.exe
408	setup.exe
408	setup.exe
408	setup.exe
408	setup.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4288	AcroRd32.exe
4192	AdobeARM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Adobe Reader W10.exesetup.exemsiexec.exerundll32.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4824 wrote to memory of 408	4824	Adobe Reader W10.exe	setup.exe
PID 4824 wrote to memory of 408	4824	Adobe Reader W10.exe	setup.exe
PID 4824 wrote to memory of 408	4824	Adobe Reader W10.exe	setup.exe
PID 408 wrote to memory of 216	408	setup.exe	msiexec.exe
PID 408 wrote to memory of 216	408	setup.exe	msiexec.exe
PID 408 wrote to memory of 216	408	setup.exe	msiexec.exe
PID 392 wrote to memory of 868	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 868	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 868	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 3188	392	msiexec.exe	srtasks.exe
PID 392 wrote to memory of 3188	392	msiexec.exe	srtasks.exe
PID 392 wrote to memory of 4452	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 4452	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 4452	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 752	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 752	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 752	392	msiexec.exe	MsiExec.exe
PID 392 wrote to memory of 4664	392	msiexec.exe	MSI12EF.tmp
PID 392 wrote to memory of 4664	392	msiexec.exe	MSI12EF.tmp
PID 392 wrote to memory of 4664	392	msiexec.exe	MSI12EF.tmp
PID 392 wrote to memory of 3472	392	msiexec.exe	FullTrustNotifier.exe
PID 392 wrote to memory of 3472	392	msiexec.exe	FullTrustNotifier.exe
PID 392 wrote to memory of 3472	392	msiexec.exe	FullTrustNotifier.exe
PID 392 wrote to memory of 1968	392	msiexec.exe	RdrServicesUpdater.exe
PID 392 wrote to memory of 1968	392	msiexec.exe	RdrServicesUpdater.exe
PID 392 wrote to memory of 1968	392	msiexec.exe	RdrServicesUpdater.exe
PID 392 wrote to memory of 4632	392	msiexec.exe	rundll32.exe
PID 392 wrote to memory of 4632	392	msiexec.exe	rundll32.exe
PID 4632 wrote to memory of 1784	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 1784	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 1784	4632	rundll32.exe	rundll32.exe
PID 4288 wrote to memory of 2060	4288	AcroRd32.exe	RdrCEF.exe
PID 4288 wrote to memory of 2060	4288	AcroRd32.exe	RdrCEF.exe
PID 4288 wrote to memory of 2060	4288	AcroRd32.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe
PID 2060 wrote to memory of 2076	2060	RdrCEF.exe	RdrCEF.exe

C:\Users\Admin\AppData\Local\Temp\Adobe Reader W10.exe
"C:\Users\Admin\AppData\Local\Temp\Adobe Reader W10.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AC0F074E4100}\setup.exe
"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AC0F074E4100}\setup.exe" /msi DISABLE_CACHE=1
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AC0F074E4100}\AcroRead.msi" DISABLE_CACHE=1 REBOOT="ReallySuppress" PATCH="C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AC0F074E4100}\AcroRdrDCUpd2000920063.msp"
3⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:216

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Sets file execution options in registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9CA6B6A33558D3810FD12102DF0F30C3 C
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:868

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3188

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C157A227C12E883F0F9D8027C31A69A0
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4452

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 22A57C6DF40177FB208E5F9D4C86451F E Global\MSI0000
2⤵
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:752

C:\Windows\Installer\MSI12EF.tmp
"C:\Windows\Installer\MSI12EF.tmp" /b 5 120 0
2⤵
- Executes dropped EXE
PID:4664

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
2⤵
- Executes dropped EXE
PID:3472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 20.009.20063 19.010.20069.0
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1968

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll",CreateReaderUserSettings
2⤵
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll",CreateReaderUserSettings
3⤵
PID:1784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3800

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:3600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1840,12680376146050673477,12833168073936337656,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.9.20063 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=15614261659580506198 --mojo-platform-channel-handle=1868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
- Executes dropped EXE
PID:2076

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1840,12680376146050673477,12833168073936337656,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.9.20063 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=8500862331438473455 --renderer-client-id=2 --mojo-platform-channel-handle=1892 --allow-no-sandbox-job /prefetch:1
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:660

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1840,12680376146050673477,12833168073936337656,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.9.20063 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=2525642789466578465 --mojo-platform-channel-handle=2096 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
- Executes dropped EXE
PID:5008

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1840,12680376146050673477,12833168073936337656,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.9.20063 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=4823836970138637012 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
- Executes dropped EXE
PID:520

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1840,12680376146050673477,12833168073936337656,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.9.20063 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=666074929620331664 --renderer-client-id=6 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job /prefetch:1
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:760

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:20.0 /MODE:3
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
3⤵
- Executes dropped EXE
PID:4872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery