lumma | hxxp://get[.]adobe[.]com/reader/

Modify Registry

Processes:

MsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe

Sets file execution options in registry 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

msiexec.exeMsiExec.exeMsiExec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

MSIC380.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	MSIC380.tmp

Executes dropped EXE 13 IoCs

Processes:

readerdc64_en_l_mdr_install.exe8A2AD632-2EC6-4117-86F1-E54AB2DB92B3setup.exeMSI6D7E.tmpFullTrustNotifier.exeADelRCP.exearmsvc.exeSingleClientServicesUpdater.exeSingleClientServicesUpdater.exeMSIC380.tmparmsvc.exeAcrobat.exeAcrobat.exe

pid	process
4512	readerdc64_en_l_mdr_install.exe
3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
4552	setup.exe
2736	MSI6D7E.tmp
652	FullTrustNotifier.exe
2528	ADelRCP.exe
2880	armsvc.exe
4312	SingleClientServicesUpdater.exe
5184	SingleClientServicesUpdater.exe
5368	MSIC380.tmp
5132	armsvc.exe
8	Acrobat.exe
2072	Acrobat.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

pid	process
1704	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1704	MsiExec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exeMsiExec.exeADelRCP.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\AcrobatInfo.exe\" /PDFShell"	ADelRCP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF76CB60-2EC8-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1BFA8EF7-4C47-4FA8-94AA-3F9DFDBE58C5}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF76CB60-2E68-101B-B02E-04021C009402}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\AcrobatInfo.exe\" /PDFShell"	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\plug_ins\\Accessibility.api"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\ViewerPS.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FF76CB60-2E68-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FF76CB60-2EC8-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41	upx
C:\Users\Admin\Downloads\readerdc64_en_l_mdr_install.exe	upx
C:\Users\Admin\Downloads\readerdc64_en_l_mdr_install.exe	upx
behavioral1/memory/4512-3319-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-3478-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-3582-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-3960-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-4159-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-4482-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-5665-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-7343-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-15361-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-16849-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-18925-0x0000000000F60000-0x0000000001342000-memory.dmp	upx
behavioral1/memory/4512-20345-0x0000000000F60000-0x0000000001342000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 3 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

readerdc64_en_l_mdr_install.exe

description pid process target process

PID 4512 set thread context of 5032 4512 readerdc64_en_l_mdr_install.exe explorer.exe

description	pid	process	target process
PID 4512 set thread context of 5032	4512	readerdc64_en_l_mdr_install.exe	explorer.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exeSingleClientServicesUpdater.exeMsiExec.exeMsiExec.exe

description	ioc	process
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\ANCUtility.dll	msiexec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\th_get.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\images\acrobat_pdf.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.sl.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT	msiexec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\images\[email protected]	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview_selected-hover.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\dc-core.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_history_18.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\s_delete_18.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\end-of-document-checkmark.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\cef_extensions.pak	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_radio_selected_18.svg	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\FAB-blue.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts\AdobeCleanUX-LightIt.otf	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Resource\Font\MinionPro-BoldIt.otf	msiexec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\	msiexec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\images\S_LinkCopiedSuccess_16_N.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\be_get.svg	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster2x.jpg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6297-chunk.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\selector.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\s_folder-disabled_32.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\share.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\uss-search\css\main.css	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\AppStore_icon.svg	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\selector.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small2x.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\desktop-tool-view.css	SingleClientServicesUpdater.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\acrobat_sl.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.hu.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_RightsManagementFile.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9da2.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e00.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e19.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9e8d.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.es_co.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\displaylanguagenames.en_us_p	msiexec.exe
File created	C:\Windows\Installer\e5a9e96.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobepdf.xdc	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDXFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\e5a9dd7.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9de0.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9e0f.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e6a.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\DirectInk.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Exch_Acrobat.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\SendMail.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\_difr.x3d	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.zh_tw_s	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TURKISH.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9e38.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9d85.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9d86.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9dd6.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9e74.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e88.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Combine_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\rt3d.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.el.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.he_il.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.nl_nl.t	msiexec.exe
File created	C:\Windows\Installer\e5a9db8.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9e09.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e90.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE58C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\nppdf32.dll_Apollo	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC77C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a9da1.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9dad.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9ded.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Edit_R_Exp_RHP.aapp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.pt_br.t	msiexec.exe
File created	C:\Windows\Installer\e5a9dc4.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9dfb.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e11.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9e4c.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e5d.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\dummy.dic	msiexec.exe
File created	C:\Windows\Installer\e5a9d84.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9daf.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9dfd.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a9e32.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9e71.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ar_ma.t	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9801.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a9d8c.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14C6.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrodist.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroDist.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe

Modifies data under HKEY_USERS 23 IoCs

Processes:

msiexec.exeMsiExec.exeAcrobat.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d7d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000007a6decd1fd9ad901	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000007a6decd1fd9ad901	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\	Acrobat.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6D987BC-1266-400B-8D09-EB47A3B1D374}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcrobatPDXFileType\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A0CE495-7D8E-4DD1-ADBD-EB4DD3FB2B6A}\ = "CPowerPointPresentationsProxy"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdobeAcrobat.OpenDocuments.3\ = "Adobe Acrobat Sharepoint OpenDocuments Component"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.pdfxml.1\shell\Printto\command\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\" /t \"%1\" \"%2\" \"%3\" \"%4\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD60A736-62F6-4194-97D0-45F444D9E813}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD0B497B-DACD-4C71-9EA7-8A6EB3D14999}\ = "CIConnectionPointProxy"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9B4CD3ED-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\1.0\HELPDIR	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\AcroExch.FDFDoc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AFormAut.App\ = "AFormApp Class"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.RMFFile\EditFlags = 00000100	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\ = "Adobe PDF Reader"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C523F390-9C83-11D3-9094-00104BD0D535}\3.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Rect	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdp\OpenWithProgids\Acrobat.XDPDoc = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9B4CD3EB-4981-101B-9CA8-9240CE2738AE}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1268A4C-B74B-454B-93CB-0BF1365609CC}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.pdfxml.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3ED-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fcdt\FormsCentral.fcdt	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Acrobat.pdfxml.1\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1ACFD784-DE28-47E2-B5F7-8602EC765AF3}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CE4A8D5-0DF2-40AA-B25D-39EAD2FC884A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6D987BC-1266-400B-8D09-EB47A3B1D374}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4B777E9-F040-4084-BE29-3A8F84782D32}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\Programmable	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.FDFDoc\shell\Read	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2021.oauth2\shell\open\ddeexec\application\ = "AcroViewA21"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4C64AF6-D1CD-4D49-AE49-83D87B97CD7C}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Plugin\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\Programmable\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AdobeAcrobat.OpenDocuments\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Matrix\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdp\OpenWithProgids\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdfxml	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Lang	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AE983F2-986B-4B2B-A680-C8C23AE7A1BD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1268A4C-B74B-454B-93CB-0BF1365609CC}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03C2AEA5-BEFA-4C84-A187-C9245AC784F6}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.AVDoc\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{673E8454-7646-11D1-B90B-00A0C9259304}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker\ = "Broker Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\launchreader\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76D6FD18-D3CF-41DF-AD4D-05CA3C41A9EB}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36DE898D-AD48-40A5-B4B2-123F916BFBAB}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}\ = "ISPOpenDocuments"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3EC-4981-101B-9CA8-9240CE2738AE}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC815B7A-828C-47E3-9E95-EF8D93F9A641}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\readerdc64_en_l_mdr_install.exe:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\readerdc64_en_l_mdr_install.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

readerdc64_en_l_mdr_install.exeMsiExec.exeMsiExec.exeMsiExec.exeADelRCP.exeSingleClientServicesUpdater.exeMsiExec.exeMsiExec.exe

pid	process
4512	readerdc64_en_l_mdr_install.exe
4512	readerdc64_en_l_mdr_install.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1976	MsiExec.exe
1396	MsiExec.exe
1396	MsiExec.exe
2528	ADelRCP.exe
2528	ADelRCP.exe
1396	MsiExec.exe
1396	MsiExec.exe
4312	SingleClientServicesUpdater.exe
4312	SingleClientServicesUpdater.exe
5752	MsiExec.exe
5752	MsiExec.exe
5752	MsiExec.exe
5752	MsiExec.exe
5752	MsiExec.exe
5752	MsiExec.exe
5588	MsiExec.exe
5588	MsiExec.exe
5588	MsiExec.exe
5588	MsiExec.exe
5588	MsiExec.exe
5588	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exereaderdc64_en_l_mdr_install.exe8A2AD632-2EC6-4117-86F1-E54AB2DB92B3setup.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2812	firefox.exe
Token: SeDebugPrivilege	2812	firefox.exe
Token: SeDebugPrivilege	4512	readerdc64_en_l_mdr_install.exe
Token: SeDebugPrivilege	4512	readerdc64_en_l_mdr_install.exe
Token: SeDebugPrivilege	4512	readerdc64_en_l_mdr_install.exe
Token: SeDebugPrivilege	4512	readerdc64_en_l_mdr_install.exe
Token: SeDebugPrivilege	4512	readerdc64_en_l_mdr_install.exe
Token: SeDebugPrivilege	2812	firefox.exe
Token: SeDebugPrivilege	2812	firefox.exe
Token: SeDebugPrivilege	2812	firefox.exe
Token: SeDebugPrivilege	3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
Token: SeDebugPrivilege	3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
Token: SeDebugPrivilege	3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
Token: SeDebugPrivilege	3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
Token: SeDebugPrivilege	3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
Token: SeDebugPrivilege	3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
Token: SeDebugPrivilege	3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
Token: SeDebugPrivilege	2812	firefox.exe
Token: SeShutdownPrivilege	4552	setup.exe
Token: SeIncreaseQuotaPrivilege	4552	setup.exe
Token: SeSecurityPrivilege	4044	msiexec.exe
Token: SeCreateTokenPrivilege	4552	setup.exe
Token: SeAssignPrimaryTokenPrivilege	4552	setup.exe
Token: SeLockMemoryPrivilege	4552	setup.exe
Token: SeIncreaseQuotaPrivilege	4552	setup.exe
Token: SeMachineAccountPrivilege	4552	setup.exe
Token: SeTcbPrivilege	4552	setup.exe
Token: SeSecurityPrivilege	4552	setup.exe
Token: SeTakeOwnershipPrivilege	4552	setup.exe
Token: SeLoadDriverPrivilege	4552	setup.exe
Token: SeSystemProfilePrivilege	4552	setup.exe
Token: SeSystemtimePrivilege	4552	setup.exe
Token: SeProfSingleProcessPrivilege	4552	setup.exe
Token: SeIncBasePriorityPrivilege	4552	setup.exe
Token: SeCreatePagefilePrivilege	4552	setup.exe
Token: SeCreatePermanentPrivilege	4552	setup.exe
Token: SeBackupPrivilege	4552	setup.exe
Token: SeRestorePrivilege	4552	setup.exe
Token: SeShutdownPrivilege	4552	setup.exe
Token: SeDebugPrivilege	4552	setup.exe
Token: SeAuditPrivilege	4552	setup.exe
Token: SeSystemEnvironmentPrivilege	4552	setup.exe
Token: SeChangeNotifyPrivilege	4552	setup.exe
Token: SeRemoteShutdownPrivilege	4552	setup.exe
Token: SeUndockPrivilege	4552	setup.exe
Token: SeSyncAgentPrivilege	4552	setup.exe
Token: SeEnableDelegationPrivilege	4552	setup.exe
Token: SeManageVolumePrivilege	4552	setup.exe
Token: SeImpersonatePrivilege	4552	setup.exe
Token: SeCreateGlobalPrivilege	4552	setup.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe
Token: SeRestorePrivilege	4044	msiexec.exe
Token: SeTakeOwnershipPrivilege	4044	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

2812 firefox.exe
2812 firefox.exe
2812 firefox.exe
2812 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2812 firefox.exe
2812 firefox.exe
2812 firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

firefox.exereaderdc64_en_l_mdr_install.exe8A2AD632-2EC6-4117-86F1-E54AB2DB92B3setup.exeADelRCP.exe

pid	process
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
4512	readerdc64_en_l_mdr_install.exe
4512	readerdc64_en_l_mdr_install.exe
4512	readerdc64_en_l_mdr_install.exe
4512	readerdc64_en_l_mdr_install.exe
3920	8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
4552	setup.exe
4552	setup.exe
4552	setup.exe
2528	ADelRCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 1928 wrote to memory of 2812	1928	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1748	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1748	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 1300	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 3068	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 3068	2812	firefox.exe	firefox.exe
PID 2812 wrote to memory of 3068	2812	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" http://get.adobe.com/reader/
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" http://get.adobe.com/reader/
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.0.1986016805\1235038374" -parentBuildID 20221007134813 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33c305dd-748b-4236-9582-c7af4a705143} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 1932 18c2e819258 gpu
    3⤵
    PID:1748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.1.579136581\1111105538" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f958fa8-e885-48a6-9498-7ac06e983d3b} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 2440 18c20872b58 socket
    3⤵
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.2.1510172535\1652655456" -childID 1 -isForBrowser -prefsHandle 3344 -prefMapHandle 3084 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73851dff-d63d-459a-b51b-5827cdabe1e5} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 3096 18c3160c158 tab
    3⤵
    PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.3.1455343554\998645316" -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c03987b-18fe-448d-aa92-e6e359223179} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 3992 18c2085ca58 tab
    3⤵
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.4.2119285091\1766609624" -childID 3 -isForBrowser -prefsHandle 4628 -prefMapHandle 4632 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da54d3c4-e424-4973-b01e-b7209e211363} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 4616 18c33706258 tab
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.5.1985408190\2062093196" -childID 4 -isForBrowser -prefsHandle 4960 -prefMapHandle 4680 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56e47db3-e581-4519-b516-2db9971c3a3d} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 3456 18c3451bb58 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.6.491997557\404717951" -childID 5 -isForBrowser -prefsHandle 5096 -prefMapHandle 5100 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7ba0ac2-5671-4a9e-b226-809bfb1fcced} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 5092 18c3451af58 tab
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.7.159374545\1895036072" -childID 6 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33e5d593-c7a6-479a-b088-a3eedcbee613} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 5240 18c347de258 tab
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.8.49871745\20144528" -childID 7 -isForBrowser -prefsHandle 9656 -prefMapHandle 9660 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {251a2b60-c721-4881-ae53-5c5781d7626c} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 9644 18c35e90b58 tab
    3⤵
    PID:1716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.10.679664477\480131538" -childID 9 -isForBrowser -prefsHandle 9304 -prefMapHandle 9300 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99b1ec56-6559-4093-b467-f6bb0241410b} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 9312 18c35e93b58 tab
    3⤵
    PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.9.2081011585\306415870" -childID 8 -isForBrowser -prefsHandle 9496 -prefMapHandle 9492 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff26d344-fe7d-4714-a86a-b84924c8823a} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 9508 18c35e90e58 tab
    3⤵
    PID:1968
- - C:\Users\Admin\Downloads\readerdc64_en_l_mdr_install.exe
    "C:\Users\Admin\Downloads\readerdc64_en_l_mdr_install.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4512
  - - C:\Users\Admin\AppData\Local\Adobe\0B35E025-7353-456E-8CC0-A54D390C567A\0E91CAAA-DBFC-48FB-A13B-C61D951628CB\8A2AD632-2EC6-4117-86F1-E54AB2DB92B3
      "C:\Users\Admin\AppData\Local\Adobe\0B35E025-7353-456E-8CC0-A54D390C567A\0E91CAAA-DBFC-48FB-A13B-C61D951628CB\8A2AD632-2EC6-4117-86F1-E54AB2DB92B3" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3920
    - - C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe
        
        "C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES DISABLE_CACHE=1
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4552
  - - C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      PID:8
    - - C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:2072
    - - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --backgroundcolor=16777215
        5⤵
        
        PID:5600
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --mojo-platform-channel-handle=1512 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
        6⤵
        
        PID:5300
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
        6⤵
        
        PID:4204
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --first-renderer-process --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2256 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
        6⤵
        
        PID:4708
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
        6⤵
        
        PID:4524
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2588 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
        6⤵
        
        PID:5420
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2608 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
        6⤵
        
        PID:2828
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2792 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
        6⤵
        
        PID:5756
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --mojo-platform-channel-handle=2016 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
        6⤵
        
        PID:1588
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --mojo-platform-channel-handle=2932 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
        6⤵
        
        PID:5876
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_2\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3428 --field-trial-handle=1664,i,6188866453242936923,12511241408443660201,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
        6⤵
        
        PID:5816
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i {AC76BA86-1033-1033-7760-BC15014EA700} CLEANUP_CEFFOLDER=1 DISABLE_FIU_CHECK=1 /qn
        5⤵
        
        PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://get.adobe.com/reader/completion/adm/?exitcode=0&type=install&mdr=true&workflow=64
      4⤵
      PID:5940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa06ae46f8,0x7ffa06ae4708,0x7ffa06ae4718
        5⤵
        
        PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7567592111587883867,6580222578951377149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
        5⤵
        
        PID:3468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7567592111587883867,6580222578951377149,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
        5⤵
        
        PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7567592111587883867,6580222578951377149,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
        5⤵
        
        PID:3748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7567592111587883867,6580222578951377149,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
        5⤵
        
        PID:4580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7567592111587883867,6580222578951377149,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
        5⤵
        
        PID:1332
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\system32\explorer.exe"
      4⤵
      PID:5032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Sets file execution options in registry
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F5C7F6E70217803A02677E15DE535BA
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:1704
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A6CBF61D488D3B51D0FB2F9C426AD412
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D8F4AC45493549E99591A612A608282F E Global\MSI0000
  2⤵
  - Sets file execution options in registry
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3153131EDFE90DDAFAD7DB06E6CA93B E Global\MSI0000
  2⤵
  - Modifies Installed Components in the registry
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe
    "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2528
- C:\Windows\Installer\MSI6D7E.tmp
  "C:\Windows\Installer\MSI6D7E.tmp" /b 2 120 0
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
  "C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe" 23.003.20201 --SingleClientApp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
    --postMsg
    3⤵
    - Executes dropped EXE
    PID:5184
- C:\Windows\Installer\MSIC380.tmp
  "C:\Windows\Installer\MSIC380.tmp" {AC76BA86-1033-1033-7760-BC15014EA700} 1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5368
- - C:\Windows\system32\msiexec.exe
    msiexec.exe /i {AC76BA86-1033-1033-7760-BC15014EA700} REINSTALLMODE=omus REINSTALL=ALL IS_SEC_INSTALL=1 /qn
    3⤵
    PID:5500
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\Installer\MSIC380.tmp"
    3⤵
    PID:5672
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F5FD3782C4B6E580F8B6D26D57B8635D
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5752
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8784E781B50AA13646AD50616FF221A0 E Global\MSI0000
  2⤵
  - Sets file execution options in registry
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5588
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D3424382830E3AF8253AA7C15D96777E E Global\MSI0000
  2⤵
  PID:6120
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 22F856118D54DABD66C1F4DFDFAD1AC1
  2⤵
  PID:7060

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:2880

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery