Malware Analysis Report

2025-03-14 22:30

Sample ID 240304-rjve9acb3s
Target b2557187fa21cd913b1dc3155f2ddda4
SHA256 0d95bbeb32ab569237edada99840347966c9248ac8dc22396231a7539d22bd0b
Tags
evasion persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0d95bbeb32ab569237edada99840347966c9248ac8dc22396231a7539d22bd0b

Threat Level: Known bad

The file b2557187fa21cd913b1dc3155f2ddda4 was found to be: Known bad.

Malicious Activity Summary

evasion persistence upx

Modifies firewall policy service

Adds policy Run key to start application

Modifies Installed Components in the registry

UPX packed file

Adds Run key to start application

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-04 14:13

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-04 14:13

Reported

2024-03-04 14:16

Platform

win7-20240221-en

Max time kernel

148s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b2557187fa21cd913b1dc3155f2ddda4.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Adobbe\new.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\WinDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC} C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC} C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2744 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 2500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2844 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2844 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2844 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2844 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3020 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3020 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3020 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3020 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe

"C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 zdanz.dyndns.org udp

Files

memory/2744-9-0x00000000778D1000-0x00000000778D2000-memory.dmp

memory/2744-8-0x0000000075E40000-0x0000000075EE0000-memory.dmp

memory/2744-7-0x0000000076E60000-0x0000000076F70000-memory.dmp

memory/2744-0-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-11-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-12-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2744-16-0x0000000000400000-0x0000000000473000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-04 14:13

Reported

2024-03-04 14:16

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b2557187fa21cd913b1dc3155f2ddda4.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Adobbe\new.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\WinDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC} C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC} C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{1BCBBEFD-3CD8-21DE-6012-8DCAECDD9EEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Adobbe\\new.exe" C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4864 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1576 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1576 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4620 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4620 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4620 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3852 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3852 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3852 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 5064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 5064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 5064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe

"C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobbe\new.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b2557187fa21cd913b1dc3155f2ddda4.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 146.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 zdanz.dyndns.org udp
US 8.8.8.8:53 zdanz.dyndns.org udp

Files

memory/4864-0-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4864-8-0x0000000076730000-0x00000000767AA000-memory.dmp

memory/4864-9-0x0000000077806000-0x0000000077807000-memory.dmp

memory/4864-7-0x0000000077660000-0x0000000077750000-memory.dmp

memory/4864-10-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4864-13-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4864-16-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4864-17-0x0000000077660000-0x0000000077750000-memory.dmp

memory/4864-18-0x0000000076730000-0x00000000767AA000-memory.dmp