raccoon | 04cb991f7c25f60abc3773ccdc93595c272f0471b04fabf574839ac023b66989

Modify Registry

Processes:

MsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe

Sets file execution options in registry 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\MitigationOptions = "256"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

MSICBCA.tmpAcroCEF.exeAcroCEF.exeAcroCEF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	MSICBCA.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	AcroCEF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	AcroCEF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	AcroCEF.exe

Executes dropped EXE 16 IoCs

Processes:

6AA0C534-B069-4C3A-8705-FDF735017A4Esetup.exeMSI5CC3.tmpFullTrustNotifier.exeADelRCP.exeSingleClientServicesUpdater.exearmsvc.exeSingleClientServicesUpdater.exeMSICBCA.tmpAcrobat.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exe

pid	process
2264	6AA0C534-B069-4C3A-8705-FDF735017A4E
2284	setup.exe
3180	MSI5CC3.tmp
3488	FullTrustNotifier.exe
4876	ADelRCP.exe
1232	SingleClientServicesUpdater.exe
3740	armsvc.exe
4492	SingleClientServicesUpdater.exe
452	MSICBCA.tmp
3820	Acrobat.exe
2728	AcroCEF.exe
4848	AcroCEF.exe
3664	AcroCEF.exe
3516	AcroCEF.exe
3216	AcroCEF.exe
2284	AcroCEF.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

pid	process
1844	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1BFA8EF7-4C47-4FA8-94AA-3F9DFDBE58C5}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FF76CB60-2EC8-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF76CB60-2EC8-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FF76CB60-2E68-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF76CB60-2E68-101B-B02E-04021C009402}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\plug_ins\\Accessibility.api"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\ViewerPS.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1BFA8EF7-4C47-4FA8-94AA-3F9DFDBE58C5}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl64.dll"	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Acrobat.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Acrobat.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Acrobat.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 11 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib110.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

readerdc64_it_hi_mdr_install.exe

description pid process target process

PID 4528 set thread context of 5024 4528 readerdc64_it_hi_mdr_install.exe explorer.exe

description	pid	process	target process
PID 4528 set thread context of 5024	4528	readerdc64_it_hi_mdr_install.exe	explorer.exe

Drops file in Program Files directory 64 IoCs

Processes:

MsiExec.exeSingleClientServicesUpdater.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress_spinner_dark.gif	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\en_GB.dic	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\S_AcrobatSolid_18_N.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-filepicker-dropin\1.0.0_1.0.0\filepicker.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\large_trefoil.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_unselected_18.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\it_IT\Compare.ITA	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_filterselected-down_32.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dummy.dic	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\s_empty_no_signed_in_state.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Sign_White@1x.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fr_get.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\test\DropinHarness\private\dc-sdk-dev-manifest.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\images\themes\dark\Close.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\selector.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\license.html	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\de-de\Q3_2022_send-in-bulk.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\dc_review_upsell.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nl_135x40.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons2x.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_defaultuseravatar_6.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\WelcomeCardAcro-2x.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Standard.pdf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\main.css	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_checkbox_unselected_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\nub.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\s_shared_multi_filetype.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_defaultuseravatar_5.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_sortedby_up_selected_18.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\ui-strings.js	SingleClientServicesUpdater.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e59d0c3.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\fillsign.aapp1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1257.TXT	msiexec.exe
File created	C:\Windows\Installer\e59cfca.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d05c.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\F_CENTRAL_mfc120u_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\e59d027.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B9A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d016.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d04c.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_base.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\Forms_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\tesselate.x3d	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\e59cfe4.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\armsvc.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\OptimizePDF_R_CTX.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BDD.tmp	msiexec.exe
File created	C:\Windows\Installer\e59d02b.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cfe5.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d100.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\IA32.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.uk_ua.t	msiexec.exe
File created	C:\Windows\Installer\e59d0a4.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\_32bitmapibroker.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.cs.txt	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.ru_ru.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.sv.txt	msiexec.exe
File created	C:\Windows\Installer\e59cfcf.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d068.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d0d7.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\EPDF_Full.aapp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.it_ch.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\certificates_r.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cfca.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d024.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\concrt140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File created	C:\Windows\Installer\e59cfff.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d038.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cff8.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d01f.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d02d.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d033.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d0d8.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cff7.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\concrt140.dll.CC943011_A332_3C6E_AE5A_D28E3EC152B8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.es_bo.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\fillsign.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cfbd.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cfdb.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\CRClient.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\F_CENTRAL_mfcm120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\PDFPrevHndlr.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.ar.txt	msiexec.exe
File created	C:\Windows\Installer\e59d0f2.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.lt.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	msiexec.exe
File created	C:\Windows\Installer\e59cfce.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d00e.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d097.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d05c.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d096.HDR	msiexec.exe
File created	C:\Windows\Installer\e59d09a.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA040133017706CB5110E47A00\21.1.20135\displaylanguagenames.lv_lv.t	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4680 4876 WerFault.exe ADelRCP.exe

pid	pid_target	process	target process
4680	4876	WerFault.exe	ADelRCP.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exeMsiExec.exeAcrobat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrodist.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroDist.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	Acrobat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Acrobat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000004af14679cc3bd901	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000b2564979cc3bd901	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\AppID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.PDDoc\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Acrobat.XFDFDoc\shell\Print\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdp\Acrobat.XDPDoc	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4B777E9-F040-4084-BE29-3A8F84782D32}\ = "CExcelSheetsProxy"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdobeAcrobat.OpenDocuments.3\CLSID\ = "{24DA047B-40C0-4018-841B-6B7409F730FC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.RMFFile\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Rect\CLSID\ = "{6D12C400-4E34-101B-9CA8-9240CE2738AE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D24CBB-332E-4ABD-8F70-F060998C0167}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\DefaultIcon\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\MiscStatus	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\DocObject	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.RMFFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF\CurVer\ = "AcroPDF.PDF.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Point.1\CLSID\ = "{335E7240-6B49-101B-9CA8-9240CE2738AE}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\0\ = "Embed Source,1,8,1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\ = "CAcroAVPageView"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Acrobat.acrobatsecuritysettings.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD0B497B-DACD-4C71-9EA7-8A6EB3D14999}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{564CF8B7-AF59-4ACA-9641-0294FA30C041}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\shell\Open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Time\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XFDFDoc\shell\Print\command\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\" /p /h \"%1\" "	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5007373A-20D7-458F-9FFB-ABC900E3A831}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroBroker.Broker	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\DocObject\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Acrobat.Sequence\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-1040-1033-7760-BC15014EA700}\\_PDFFile.ico,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{78165D71-DF28-11d3-9A89-005004A56D53}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.acrobatsecuritysettings.1\shell\Print\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\1.0\FLAGS	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Print	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.pdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XDPDoc\BrowseInPlace = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{81F9B44F-BA3A-4F5D-9B51-090C74A9B3A4}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\TypeLib\Version = "3.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroAccess.AcrobatAccess.1\ = "AcrobatAccess Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C523F390-9C83-11D3-9094-00104BD0D535}\3.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1ACFD784-DE28-47E2-B5F7-8602EC765AF3}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{895A0964-AE59-41CE-98DD-E880F78B0F2A}\ = "COutlookItemProxy"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\OpenWithProgids	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\1.0\0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\AcrobatPDXFileType\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DefaultExtension	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Adobe.Acrobat.HTMLPreview.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5621F897-1374-414A-AE0C-3759580E9B8A}\ = "COutlookCOMAddInObjectProxy"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmf\OpenWithProgids	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell\Print	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5007373A-20D7-458F-9FFB-ABC900E3A831}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\TypeLib\Version = "1.1"	msiexec.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

readerdc64_it_hi_mdr_install.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	readerdc64_it_hi_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	readerdc64_it_hi_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	readerdc64_it_hi_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_it_hi_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_it_hi_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_it_hi_mdr_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	readerdc64_it_hi_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_it_hi_mdr_install.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

readerdc64_it_hi_mdr_install.exeMsiExec.exeMsiExec.exeMsiExec.exeSingleClientServicesUpdater.exeMsiExec.exemsedge.exemsedge.exeAcroCEF.exeMsiExec.exe

pid	process
4528	readerdc64_it_hi_mdr_install.exe
4528	readerdc64_it_hi_mdr_install.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
1744	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
3376	MsiExec.exe
3376	MsiExec.exe
3376	MsiExec.exe
3376	MsiExec.exe
1232	SingleClientServicesUpdater.exe
1232	SingleClientServicesUpdater.exe
3256	MsiExec.exe
3256	MsiExec.exe
3256	MsiExec.exe
3256	MsiExec.exe
3256	MsiExec.exe
3256	MsiExec.exe
2044	msedge.exe
2044	msedge.exe
3672	msedge.exe
3672	msedge.exe
3516	AcroCEF.exe
4416	MsiExec.exe
4416	MsiExec.exe
4416	MsiExec.exe
4416	MsiExec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3672 msedge.exe
3672 msedge.exe
3672 msedge.exe
3672 msedge.exe
3672 msedge.exe
3672 msedge.exe

pid	process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

setup.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2284	setup.exe
Token: SeIncreaseQuotaPrivilege	2284	setup.exe
Token: SeSecurityPrivilege	1564	msiexec.exe
Token: SeCreateTokenPrivilege	2284	setup.exe
Token: SeAssignPrimaryTokenPrivilege	2284	setup.exe
Token: SeLockMemoryPrivilege	2284	setup.exe
Token: SeIncreaseQuotaPrivilege	2284	setup.exe
Token: SeMachineAccountPrivilege	2284	setup.exe
Token: SeTcbPrivilege	2284	setup.exe
Token: SeSecurityPrivilege	2284	setup.exe
Token: SeTakeOwnershipPrivilege	2284	setup.exe
Token: SeLoadDriverPrivilege	2284	setup.exe
Token: SeSystemProfilePrivilege	2284	setup.exe
Token: SeSystemtimePrivilege	2284	setup.exe
Token: SeProfSingleProcessPrivilege	2284	setup.exe
Token: SeIncBasePriorityPrivilege	2284	setup.exe
Token: SeCreatePagefilePrivilege	2284	setup.exe
Token: SeCreatePermanentPrivilege	2284	setup.exe
Token: SeBackupPrivilege	2284	setup.exe
Token: SeRestorePrivilege	2284	setup.exe
Token: SeShutdownPrivilege	2284	setup.exe
Token: SeDebugPrivilege	2284	setup.exe
Token: SeAuditPrivilege	2284	setup.exe
Token: SeSystemEnvironmentPrivilege	2284	setup.exe
Token: SeChangeNotifyPrivilege	2284	setup.exe
Token: SeRemoteShutdownPrivilege	2284	setup.exe
Token: SeUndockPrivilege	2284	setup.exe
Token: SeSyncAgentPrivilege	2284	setup.exe
Token: SeEnableDelegationPrivilege	2284	setup.exe
Token: SeManageVolumePrivilege	2284	setup.exe
Token: SeImpersonatePrivilege	2284	setup.exe
Token: SeCreateGlobalPrivilege	2284	setup.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Acrobat.exemsedge.exe

pid process

3820 Acrobat.exe
3672 msedge.exe
3672 msedge.exe
3672 msedge.exe
3672 msedge.exe

pid	process
3820	Acrobat.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

readerdc64_it_hi_mdr_install.exe6AA0C534-B069-4C3A-8705-FDF735017A4Esetup.exeADelRCP.exeAcrobat.exe

pid	process
4528	readerdc64_it_hi_mdr_install.exe
4528	readerdc64_it_hi_mdr_install.exe
4528	readerdc64_it_hi_mdr_install.exe
4528	readerdc64_it_hi_mdr_install.exe
2264	6AA0C534-B069-4C3A-8705-FDF735017A4E
2284	setup.exe
2284	setup.exe
2284	setup.exe
4876	ADelRCP.exe
3820	Acrobat.exe
3820	Acrobat.exe
3820	Acrobat.exe
3820	Acrobat.exe
3820	Acrobat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

readerdc64_it_hi_mdr_install.exe6AA0C534-B069-4C3A-8705-FDF735017A4Emsiexec.exeMsiExec.exesvchost.exeMSICBCA.tmpmsedge.exe

description	pid	process	target process
PID 4528 wrote to memory of 2264	4528	readerdc64_it_hi_mdr_install.exe	6AA0C534-B069-4C3A-8705-FDF735017A4E
PID 4528 wrote to memory of 2264	4528	readerdc64_it_hi_mdr_install.exe	6AA0C534-B069-4C3A-8705-FDF735017A4E
PID 4528 wrote to memory of 2264	4528	readerdc64_it_hi_mdr_install.exe	6AA0C534-B069-4C3A-8705-FDF735017A4E
PID 2264 wrote to memory of 2284	2264	6AA0C534-B069-4C3A-8705-FDF735017A4E	setup.exe
PID 2264 wrote to memory of 2284	2264	6AA0C534-B069-4C3A-8705-FDF735017A4E	setup.exe
PID 1564 wrote to memory of 1844	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 1844	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 1844	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 1744	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 1744	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 4832	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 4832	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 3376	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 3376	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 3376	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 3180	1564	msiexec.exe	MSI5CC3.tmp
PID 1564 wrote to memory of 3180	1564	msiexec.exe	MSI5CC3.tmp
PID 1564 wrote to memory of 3180	1564	msiexec.exe	MSI5CC3.tmp
PID 1564 wrote to memory of 3488	1564	msiexec.exe	FullTrustNotifier.exe
PID 1564 wrote to memory of 3488	1564	msiexec.exe	FullTrustNotifier.exe
PID 1564 wrote to memory of 3488	1564	msiexec.exe	FullTrustNotifier.exe
PID 3376 wrote to memory of 4876	3376	MsiExec.exe	ADelRCP.exe
PID 3376 wrote to memory of 4876	3376	MsiExec.exe	ADelRCP.exe
PID 1564 wrote to memory of 1232	1564	msiexec.exe	SingleClientServicesUpdater.exe
PID 1564 wrote to memory of 1232	1564	msiexec.exe	SingleClientServicesUpdater.exe
PID 4888 wrote to memory of 4492	4888	svchost.exe	SingleClientServicesUpdater.exe
PID 4888 wrote to memory of 4492	4888	svchost.exe	SingleClientServicesUpdater.exe
PID 1564 wrote to memory of 452	1564	msiexec.exe	MSICBCA.tmp
PID 1564 wrote to memory of 452	1564	msiexec.exe	MSICBCA.tmp
PID 452 wrote to memory of 552	452	MSICBCA.tmp	msiexec.exe
PID 452 wrote to memory of 552	452	MSICBCA.tmp	msiexec.exe
PID 452 wrote to memory of 2192	452	MSICBCA.tmp	cmd.exe
PID 452 wrote to memory of 2192	452	MSICBCA.tmp	cmd.exe
PID 1564 wrote to memory of 3256	1564	msiexec.exe	MsiExec.exe
PID 1564 wrote to memory of 3256	1564	msiexec.exe	MsiExec.exe
PID 4528 wrote to memory of 3820	4528	readerdc64_it_hi_mdr_install.exe	Acrobat.exe
PID 4528 wrote to memory of 3820	4528	readerdc64_it_hi_mdr_install.exe	Acrobat.exe
PID 4528 wrote to memory of 3672	4528	readerdc64_it_hi_mdr_install.exe	msedge.exe
PID 4528 wrote to memory of 3672	4528	readerdc64_it_hi_mdr_install.exe	msedge.exe
PID 4528 wrote to memory of 5024	4528	readerdc64_it_hi_mdr_install.exe	explorer.exe
PID 4528 wrote to memory of 5024	4528	readerdc64_it_hi_mdr_install.exe	explorer.exe
PID 4528 wrote to memory of 5024	4528	readerdc64_it_hi_mdr_install.exe	explorer.exe
PID 3672 wrote to memory of 3452	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 3452	3672	msedge.exe	msedge.exe
PID 4528 wrote to memory of 5024	4528	readerdc64_it_hi_mdr_install.exe	explorer.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe
PID 3672 wrote to memory of 2404	3672	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\readerdc64_it_hi_mdr_install.exe
"C:\Users\Admin\AppData\Local\Temp\readerdc64_it_hi_mdr_install.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528

C:\Users\Admin\AppData\Local\Adobe\03E85A89-C932-435E-A031-75CDB7B55AA5\70C07A6D-D08C-45BB-9457-0AD5C86CDA4A\6AA0C534-B069-4C3A-8705-FDF735017A4E
"C:\Users\Admin\AppData\Local\Adobe\03E85A89-C932-435E-A031-75CDB7B55AA5\70C07A6D-D08C-45BB-9457-0AD5C86CDA4A\6AA0C534-B069-4C3A-8705-FDF735017A4E" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1040-1033-7760-BC15014EA700}\setup.exe
"C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1040-1033-7760-BC15014EA700}\setup.exe" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES DISABLE_CACHE=1
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3820

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --locale=it-it --backgroundcolor=16514043
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:2728

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --field-trial-handle=1584,12043493235264732758,15369510908055371796,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/22.1.20169 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=OAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1604 --allow-no-sandbox-job /prefetch:2
4⤵
- Executes dropped EXE
PID:4848

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1584,12043493235264732758,15369510908055371796,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/22.1.20169 Chrome/80.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --allow-no-sandbox-job /prefetch:8
4⤵
- Executes dropped EXE
PID:3664

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,12043493235264732758,15369510908055371796,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/22.1.20169 Chrome/80.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --allow-no-sandbox-job /prefetch:8
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1584,12043493235264732758,15369510908055371796,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/22.1.20169 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3216

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --field-trial-handle=1584,12043493235264732758,15369510908055371796,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --log-severity=disable --product-version="ReaderServices/22.1.20169 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2524 --allow-no-sandbox-job /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://get.adobe.com/reader/completion/adm/?exitcode=0&type=install&mdr=true&workflow=64
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffccf646f8,0x7fffccf64708,0x7fffccf64718
3⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
3⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
3⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
3⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
3⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 /prefetch:8
3⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
3⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
3⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 /prefetch:8
3⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
3⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15627875524961016036,12563103105905907264,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
3⤵
PID:3288

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
2⤵
PID:5024

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Sets file execution options in registry
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DF1ECBFE98216EE1DE36FC92AEFC3266
2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1844

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding AFF2E0BE99EA72AA0CF98995830F50E3
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1744

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 2ED8EEECFD73D5E83AD89FBD28F7243E E Global\MSI0000
2⤵
- Sets file execution options in registry
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4832

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2F5F573CB4B00B4479476C47035BFB3D E Global\MSI0000
2⤵
- Modifies Installed Components in the registry
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3376

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4876

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4876 -s 408
4⤵
- Program crash
PID:4680

C:\Windows\Installer\MSI5CC3.tmp
"C:\Windows\Installer\MSI5CC3.tmp" /b 2 120 0
2⤵
- Executes dropped EXE
PID:3180

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
2⤵
- Executes dropped EXE
PID:3488

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe" 22.001.20169 --SingleClientApp
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1232

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
--postMsg
3⤵
- Executes dropped EXE
PID:4492

C:\Windows\Installer\MSICBCA.tmp
"C:\Windows\Installer\MSICBCA.tmp" {AC76BA86-1040-1033-7760-BC15014EA700} 1
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\system32\msiexec.exe
msiexec.exe /i {AC76BA86-1040-1033-7760-BC15014EA700} REINSTALLMODE=omus REINSTALL=ALL IS_SEC_INSTALL=1 /qn
3⤵
PID:552

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Windows\Installer\MSICBCA.tmp"
3⤵
PID:2192

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding D43F8AF101E10CEF174369F4B5893C0D
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3256

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding AD6ED7973B536E25584C3A74511FB85D E Global\MSI0000
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 4876 -ip 4876
1⤵
PID:1656

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

System Information Discovery