Malware Analysis Report

2024-10-19 01:07

Sample ID 230426-l3jvzaae4s
Target AdobePDFReader (9).msi
SHA256 9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5
Tags
bumblebee ad2404 trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5

Threat Level: Known bad

The file AdobePDFReader (9).msi was found to be: Known bad.

Malicious Activity Summary

bumblebee ad2404 trojan

BumbleBee

Blocklisted process makes network request

Executes dropped EXE

Enumerates connected drives

Suspicious use of NtCreateThreadExHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Modifies system certificate store

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-26 10:03

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-26 10:03

Reported

2023-04-26 10:06

Platform

win10v2004-20230220-en

Max time kernel

142s

Max time network

152s

Command Line

msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\AdobePDFReader (9).msi"

Signatures

BumbleBee

trojan bumblebee

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\e56e871.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE9D8.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e56e873.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e56e871.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027c70fafd0cbe6b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027c70faf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090027c70faf000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3540 wrote to memory of 976 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 3540 wrote to memory of 976 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 3540 wrote to memory of 3808 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 3808 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 4824 N/A C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
PID 3540 wrote to memory of 4824 N/A C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
PID 3540 wrote to memory of 4824 N/A C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
PID 3808 wrote to memory of 4044 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 3808 wrote to memory of 4044 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4044 wrote to memory of 4120 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 4044 wrote to memory of 4120 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 3808 wrote to memory of 3132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 3808 wrote to memory of 3132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 3132 wrote to memory of 4676 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 3132 wrote to memory of 4676 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\AdobePDFReader (9).msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ad.ps1"

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

"C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fvm103p4\fvm103p4.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF198.tmp" "c:\Users\Admin\AppData\Local\Temp\fvm103p4\CSCB4920C87D7A48769577EE592287E221.TMP"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3zvnmlsg\3zvnmlsg.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A7.tmp" "c:\Users\Admin\AppData\Local\Temp\3zvnmlsg\CSC87DE922EDDD940C5865B97C3A81DEAA.TMP"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 163.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 58.250.217.23.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 geo-dc.adobe.com udp
GB 96.16.108.178:443 geo-dc.adobe.com tcp
US 8.8.8.8:53 rdc.adobe.io udp
US 54.227.187.23:443 rdc.adobe.io tcp
US 8.8.8.8:53 178.108.16.96.in-addr.arpa udp
US 8.8.8.8:53 dlmping2.adobe.com udp
GB 96.16.108.178:443 dlmping2.adobe.com tcp
US 8.8.8.8:53 stats.adobe.com udp
US 8.8.8.8:53 platformdl.adobe.com udp
US 63.140.62.160:80 stats.adobe.com tcp
US 8.8.8.8:53 23.187.227.54.in-addr.arpa udp
US 8.8.8.8:53 160.62.140.63.in-addr.arpa udp
US 8.8.8.8:53 137.232.44.23.in-addr.arpa udp
KR 111.219.156.41:173 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
EG 156.160.224.122:140 tcp
US 93.184.220.29:80 tcp
NL 84.53.175.11:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 74.245.135.210:183 tcp
AR 181.99.61.79:390 tcp
DE 137.248.56.132:206 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

MD5 eb17c8572700a9b7bbfb6c1142ad443e
SHA1 74022bd63cf919ac44af0dcbe0e4c14756c34b2e
SHA256 302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52
SHA512 e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0

C:\Config.Msi\e56e872.rbs

MD5 b0b2312fa4766dd0e959973c649089a9
SHA1 6614cabbde4a3b76883dc8179e245300c9d0dc27
SHA256 ccb607617670dc19cad6398bdc357b161288428bf4dfb14498b8c5ede13a28bc
SHA512 57770bf092f110b323f60dac9a69ba8bc6d5ee7cc028fd292269bee11b3131b29bb5267e4ac11b88747c53c4a53992c1d7263aac9b22cfdff2e47264147a54df

C:\Windows\Installer\e56e871.msi

MD5 fadc9824c68402143239f764c99bb82d
SHA1 7eb72321c2c1e25b11c9d44229af22a179e27ce8
SHA256 9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5
SHA512 916b9b9836d5003193cf4f52c501a90ba16f18ca13a05325f9e11a6ee9d05b927013c09524757f33efd153c0e1d25648233e79f9a8eaa81fd69ed79282268ef6

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1uvrpdvj.aeh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3808-167-0x000001DB1EE60000-0x000001DB1EE82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ad.ps1

MD5 4e0e85a590f4972732f1f0de81aa5507
SHA1 8e1bcab1ac25c59c1203d808f04b53b1db5fd7eb
SHA256 bde15453821fff0d2ed08a8c10885c9ab4ec1ccc6b4b23a41e9e324e4e80a195
SHA512 2b874cf59cdc7298b7fcf6712db3ec4013fcd87b7c7bb44400a789821b35bc57e3ff4e98ccfe93bc4cb420d25b2d3e6967eab2e98abf43bb16543f454cef8953

memory/4824-172-0x0000000000E00000-0x0000000001239000-memory.dmp

memory/3808-174-0x000001DB05530000-0x000001DB05540000-memory.dmp

memory/3808-173-0x000001DB05530000-0x000001DB05540000-memory.dmp

memory/4824-175-0x0000000001770000-0x0000000001773000-memory.dmp

memory/3808-176-0x000001DB05530000-0x000001DB05540000-memory.dmp

\??\Volume{af0fc727-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a572d271-88ca-4f20-9298-bb2ba8fc64dc}_OnDiskSnapshotProp

MD5 3e15a7ab429c8f9aaffde70973c2973f
SHA1 9eadcfc6dc7328a34267df7b52a571fc836293d6
SHA256 db07e17e470e65d66337d01fe15044f78ebd80fe6c4ca447ebd313e58506a4d5
SHA512 5da1b7c3ca75993a1984300265977c260b7a1f03726e4d5928b809f86c89f88fb064c658eea0e91e6686f628751e4ab0cf72c0bd0a0b891a27d89dc6a6239306

\??\c:\Users\Admin\AppData\Local\Temp\fvm103p4\fvm103p4.cmdline

MD5 bddc513157958ce638c9bb4d7e579177
SHA1 0e78d0e09d9fb5b37a2d407cec44c6d971dd3289
SHA256 7a551f6cdd6a4c3135c8a2255ef316a1d0fa7ae1446f8d765a642a7c3e15c715
SHA512 429e4dad9ca15acda2f1ef524f232b941733f30b410529fcc0e9e0fe5e6ca967b0f6ace02a2e0ae69f07d40306e0616b246737aee2bdb3e5bf3c470670cfb321

\??\c:\Users\Admin\AppData\Local\Temp\fvm103p4\fvm103p4.0.cs

MD5 b611be9282deb44eed731f72bcbb2b82
SHA1 cc1d606d853bbabd5fef87255356a0d54381c289
SHA256 ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6
SHA512 63b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

MD5 eb17c8572700a9b7bbfb6c1142ad443e
SHA1 74022bd63cf919ac44af0dcbe0e4c14756c34b2e
SHA256 302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52
SHA512 e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0

\??\c:\Users\Admin\AppData\Local\Temp\fvm103p4\CSCB4920C87D7A48769577EE592287E221.TMP

MD5 848447206a26a92e673e0617d0d9ab48
SHA1 8a1319ef3a1a15eccfed87e0fe9ee9cb726d17cf
SHA256 6c90eb3451b6baa442540866e0a15375a04014e0d69a4e004e4dd39895a49884
SHA512 4c70eb3fdda6b0ac1ee38339d624cb33c0efa7ea2ca9eec0d976527d3016d8efa1b6648cde8cda5f9a6c1ff0909a59500da926d1e1baa9b03a11e30cb4525970

C:\Users\Admin\AppData\Local\Temp\RESF198.tmp

MD5 e7b2966f6d7794f284de666cb9c09979
SHA1 75f7fd7d48a97081a0970cd65ecc3770c260cfbd
SHA256 ba2827d6cd5ba704f9c4f5cc361ef3a00ef31a8f4aaf27119f10cb89adc0bb92
SHA512 9c65d4ae99e298400a172413ef84b6e4d413fc81be665e8330d34d0918a8b87730a86db0e6be146a4860ad74c7c61948ec52979a3d139f8494e4ce96e4223e40

\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

MD5 7c2eafef617edb5a647fe783e809a5d3
SHA1 2bebf29a5d51921cea604f920d1ab886387f025f
SHA256 0872b47cc63f07789adc13d0cb3b0885b1319a9c0ca86e2b25e50b2f8c2bd0ed
SHA512 8842e6a6516c4ed0d17cc1ea8614a77e5a4b07030de2d19e6cf75a462936b0bbf37fc3a09b1b85779aa7ed00a90b85b177f0d2572282286b6e8abc2c74ca2c09

C:\Users\Admin\AppData\Local\Temp\fvm103p4\fvm103p4.dll

MD5 bce01f4840eeb799d883797c22d8adfb
SHA1 3b33da7cb79d3db24f8cffd45b7ba4eea586386e
SHA256 8ff9902118975b2ca1be0d8e2c09ba2e91b2959e934c101a91e0d2e00fe58c2c
SHA512 683333741fb017bbfd27d2684a2c8126ade5443b639ad28781961e57eb32be72e36d92ad3f25b6dd428b119d3bc2093bf4826e9527d95c7abdfe31ae933eaa10

C:\Users\Admin\AppData\Local\Adobe\F17FE353-247D-42F3-AA23-E39EDB4A3FB2\progressbar_blue_active_100.png

MD5 bb94a177f10bf764d11f94d24a5db5aa
SHA1 6864b58952b19248f4c5ea5c8764c52e207268a7
SHA256 caafea31074ba909ec57c9dcdd1b1c0256e5626939cc768b8a041fe42762e230
SHA512 d2875eb5ad9ff76ff233ada04fa77aecdbb0c9a80bcd85b0c50087786b47e97feec189d18164e15784cd96850849ee4e1920d7d98157ca7ad317ba03e8c66111

\??\c:\Users\Admin\AppData\Local\Temp\3zvnmlsg\3zvnmlsg.cmdline

MD5 6aa40ccf8e1d81fb75ce06c753fc733d
SHA1 346bfe9e854e81d8ad768971ce2c4d3cf48c9446
SHA256 ce03fd4a9e23103da8faf5e13ce84f955014b5985a39d526d8efd85bd3a56847
SHA512 8e553da9ebf8de1e7be5ab507eccf30655b75d9e829ad0fac0bc6d73818edbd9b0261ce293b9336f1bb5cf4df5c2234c138510ac444c6f332b117ccbb7e63fd2

\??\c:\Users\Admin\AppData\Local\Temp\3zvnmlsg\3zvnmlsg.0.cs

MD5 2bb8d0ee93aeae61a09adf4db6f29c1c
SHA1 8da3034bb8f84ea2522e276b492b2797b5db30ca
SHA256 68d44e3c373d2aec9dacf51326cbfebcba76c1c1a56545e5e1cbf58b44a9f817
SHA512 b3ec6841a9541e96a671a7d81378293567972541d9cdfc3137b478d9b4d3cccd4b5f536d0f059ee9c12fe9ba86bca62b795139a5215843465cb751e0ade95677

\??\c:\Users\Admin\AppData\Local\Temp\3zvnmlsg\CSC87DE922EDDD940C5865B97C3A81DEAA.TMP

MD5 1968374df95fd3d7cbc8aa6b5391a5ac
SHA1 65780214ae8ca8b048705217242b5c50d7cd8753
SHA256 83b37f41eff27b6e840786f5f0ef691bd5e706700c961f84b2a062922f2c5582
SHA512 444ac3e5e5e636d45b44526344cd9861f5793b73dbcd26174bbcfdd18e5ed9b0a7f84ffb8a34d6737e5485f41d62ab8a07194b809061e79eaa3ca35f7e880942

C:\Users\Admin\AppData\Local\Temp\RES6A7.tmp

MD5 77e0721c172a65ce80f3498351173f30
SHA1 4e82af83a86f2c04604dc7a80a4d42679e1d23a6
SHA256 fea41572fc9b1019b6165c5ed2286ff3598cda7d76d257d6f9b1a86b2a1338a3
SHA512 bf339a1d62c493d77a9798c76ad32b13db7d2f91841b06644741d5851bf8cf6f2bfc7f970b29e94ca367012d98f7aa0ac04e535948a7358f639ceadd26d4a686

C:\Users\Admin\AppData\Local\Temp\3zvnmlsg\3zvnmlsg.dll

MD5 78576c7fd79beb001cebb716917b7bdc
SHA1 7109bd70d8fc957bab309735cf9b5c35154ab86e
SHA256 91fb1970fa87da8f064ff7df16c9e73a8e2ccda924eeb441c2a45f914c2346f6
SHA512 62653acee4844dcdaec6edac441fc7d8bfe93110480150217128a0306d452e1237c35cc8707432f69fdcf3990d508d885c4525fafa40594a89ae8d36d978349e

memory/3808-268-0x000001DB05530000-0x000001DB05540000-memory.dmp

memory/3808-269-0x000001DB1F1B0000-0x000001DB1F31A000-memory.dmp

memory/3808-275-0x000001DB1F320000-0x000001DB1F48A000-memory.dmp

memory/3808-277-0x000001DB1F320000-0x000001DB1F3DE000-memory.dmp

memory/4824-279-0x0000000000E00000-0x0000000001239000-memory.dmp

memory/3808-280-0x000001DB1F320000-0x000001DB1F48A000-memory.dmp

memory/3808-281-0x00007FFDEB910000-0x00007FFDEB911000-memory.dmp

memory/3808-282-0x000001DB1F320000-0x000001DB1F48A000-memory.dmp

memory/3808-283-0x000001DB05530000-0x000001DB05540000-memory.dmp

memory/3808-284-0x000001DB05530000-0x000001DB05540000-memory.dmp

memory/3808-285-0x000001DB05530000-0x000001DB05540000-memory.dmp

memory/4824-289-0x0000000000E00000-0x0000000001239000-memory.dmp

memory/3808-290-0x000001DB05530000-0x000001DB05540000-memory.dmp

memory/4824-297-0x0000000000E00000-0x0000000001239000-memory.dmp

memory/4824-309-0x0000000000E00000-0x0000000001239000-memory.dmp

memory/4824-330-0x0000000000E00000-0x0000000001239000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-26 10:03

Reported

2023-04-26 10:06

Platform

win7-20230220-en

Max time kernel

143s

Max time network

152s

Command Line

msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\AdobePDFReader (9).msi"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6c58ad.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\Installer\6c58ac.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6c58ac.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\6c58ad.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5B5A.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\6c58af.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1284 wrote to memory of 812 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1284 wrote to memory of 812 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1284 wrote to memory of 812 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1284 wrote to memory of 304 N/A C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
PID 1284 wrote to memory of 304 N/A C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
PID 1284 wrote to memory of 304 N/A C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
PID 1284 wrote to memory of 304 N/A C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe
PID 812 wrote to memory of 1944 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 812 wrote to memory of 1944 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 812 wrote to memory of 1944 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 1944 wrote to memory of 1108 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1944 wrote to memory of 1108 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1944 wrote to memory of 1108 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\AdobePDFReader (9).msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000005C" "0000000000000060"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ad.ps1"

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

"C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\266qb-wg.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CAA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6CA9.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 geo-dc.adobe.com udp
GB 96.16.108.178:443 geo-dc.adobe.com tcp
US 8.8.8.8:53 rdc.adobe.io udp
US 54.227.187.23:443 rdc.adobe.io tcp
US 8.8.8.8:53 dlmping2.adobe.com udp
US 8.8.8.8:53 stats.adobe.com udp
GB 96.16.108.178:443 dlmping2.adobe.com tcp
US 63.140.62.135:80 stats.adobe.com tcp
US 8.8.8.8:53 platformdl.adobe.com udp

Files

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

MD5 eb17c8572700a9b7bbfb6c1142ad443e
SHA1 74022bd63cf919ac44af0dcbe0e4c14756c34b2e
SHA256 302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52
SHA512 e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0

C:\Config.Msi\6c58ae.rbs

MD5 6ac681127ce03a0c9b0547f33bd80844
SHA1 ce2bb65b35cdd482109b789bfb52bb95fcfcf309
SHA256 5eca4fa9bd95839d86538b4d9399e82c89902c61c8c2b6788f4ca4b8327613b4
SHA512 a56161f29db139498c4c0803ebcb3f849dbe1ffecfcacc520b06f0c12568f8867e0c5c821f8c8d5f210c2f11786173cea672ab4075e2e56bb03253b018beeef7

C:\Windows\Installer\6c58ac.msi

MD5 fadc9824c68402143239f764c99bb82d
SHA1 7eb72321c2c1e25b11c9d44229af22a179e27ce8
SHA256 9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5
SHA512 916b9b9836d5003193cf4f52c501a90ba16f18ca13a05325f9e11a6ee9d05b927013c09524757f33efd153c0e1d25648233e79f9a8eaa81fd69ed79282268ef6

memory/304-79-0x0000000001260000-0x0000000001699000-memory.dmp

memory/304-80-0x00000000000F0000-0x00000000000F3000-memory.dmp

memory/812-88-0x000000001B240000-0x000000001B522000-memory.dmp

memory/812-89-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe

MD5 eb17c8572700a9b7bbfb6c1142ad443e
SHA1 74022bd63cf919ac44af0dcbe0e4c14756c34b2e
SHA256 302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52
SHA512 e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0

C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ad.ps1

MD5 4e0e85a590f4972732f1f0de81aa5507
SHA1 8e1bcab1ac25c59c1203d808f04b53b1db5fd7eb
SHA256 bde15453821fff0d2ed08a8c10885c9ab4ec1ccc6b4b23a41e9e324e4e80a195
SHA512 2b874cf59cdc7298b7fcf6712db3ec4013fcd87b7c7bb44400a789821b35bc57e3ff4e98ccfe93bc4cb420d25b2d3e6967eab2e98abf43bb16543f454cef8953

memory/812-92-0x0000000002A20000-0x0000000002AA0000-memory.dmp

memory/812-93-0x0000000002A20000-0x0000000002AA0000-memory.dmp

memory/812-94-0x0000000002A20000-0x0000000002AA0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\266qb-wg.cmdline

MD5 c60306a797ff1770076d1d5b2d9a6d9e
SHA1 b0496fbead382cacf135e36cb898790b14876b9a
SHA256 2e1dcd07ca8d886d19bc5442def2eae25b10d5746a20b30447087d3f7b069eee
SHA512 867a1f4efd259d07173b0fcc01d3498e03079d4baa041c1104c074440121fcf1679b8e5cad2e02f2f9cd9335789f829901e8c890e9c6dc303e49caa095d0702b

\??\c:\Users\Admin\AppData\Local\Temp\266qb-wg.0.cs

MD5 b611be9282deb44eed731f72bcbb2b82
SHA1 cc1d606d853bbabd5fef87255356a0d54381c289
SHA256 ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6
SHA512 63b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4

\??\c:\Users\Admin\AppData\Local\Temp\CSC6CA9.tmp

MD5 7c2856fe765e4403120b40966df11f0d
SHA1 6dfd19e86659b1ce6259ff1bd074fc57c9dc165f
SHA256 e62d1bada1a77eee5c5205f15ae9ddf82d12e6a21fa4006b253a56ddb34197a9
SHA512 264ce1b2fe6e42350d592ef43e15ba2262a0bc004460890da9f1f36e298a0b2ef52fc3ee26742f8a21090ab79177a459a6cc03d54c08757726e56670fc57a5ec

C:\Users\Admin\AppData\Local\Temp\266qb-wg.pdb

MD5 c70151470cba4ac1f71267cae9864088
SHA1 cf382ea973e056d82eb8d7d8b76b1ea3ad73c20d
SHA256 fb5d42dbb8180c25a4ab3d22e50f92b0b638c90975610557b31e3a91e2f237a4
SHA512 9cbbbaf157ad36706869aeb19ea35c2ae743684a6d91056af8f65696560c8775304e59d22add551f99401abdd1a07358dfe1ebc8e82ac8e4a4c6461a95e819ba

memory/812-110-0x0000000002770000-0x0000000002778000-memory.dmp

memory/1944-109-0x0000000002030000-0x00000000020B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\266qb-wg.dll

MD5 1ddf29008ab4bba24142bce69e1a96af
SHA1 5419af1c52478fd26411ae1a701c40a513f4a220
SHA256 6189a2fe03891d8d8db608f05d21faf2c02d68395f098df7e4a9422b235ce112
SHA512 783d072fc6932e3003f2d4008e2b5dbc439a5321e98538faabf103d9e77349ffbd8614df5deb7fdc1b75a03efcb396dafc1c199dce5c93b77ec21ecd6effaa02

C:\Users\Admin\AppData\Local\Temp\RES6CAA.tmp

MD5 f0ade2a3dda553cc625715e8a6c78637
SHA1 94b0b9ea23ec65df7ee45335421dcb613cc2b608
SHA256 195b9aef99bffad60e17c24fbd7c4089fb85249b59d326146759de77b40f3625
SHA512 484e72791b5c9ccbcf36aee5e019d4be6d97f900fd492e2b6189ebcf5f24b4fa87903f0d8a7e4d02fcab8be33b1f55ba6a92f27653bfe3f30e7f0ab3e59f239f

memory/304-164-0x0000000001260000-0x0000000001699000-memory.dmp

memory/304-165-0x0000000001260000-0x0000000001699000-memory.dmp

memory/1944-166-0x0000000002030000-0x00000000020B0000-memory.dmp

memory/304-186-0x0000000001260000-0x0000000001699000-memory.dmp

memory/304-197-0x0000000001260000-0x0000000001699000-memory.dmp

memory/304-198-0x0000000001260000-0x0000000001699000-memory.dmp

memory/304-199-0x0000000001260000-0x0000000001699000-memory.dmp

memory/304-200-0x0000000001260000-0x0000000001699000-memory.dmp

memory/304-203-0x0000000001260000-0x0000000001699000-memory.dmp