Overview

overview

6

Static

static

1

8.3.0_Adbe...US.msi

windows7-x64

6

Resubmissions

28/04/2024, 17:00

240428-vjbvpacf3v6

28/04/2024, 16:58

240428-vhb43ace816

28/04/2024, 16:57

240428-vgg9pace7v6

28/04/2024, 16:55

240428-ve3gvace4v6

28/04/2024, 16:52

240428-vdlspscd916

Analysis

  • max time kernel
    67s
  • max time network
    73s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 16:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8.3.0_AdbeRdr830_en_US.msi
  • Size 33.8MB
  • Sample240428-vdlspscd91
  • SHA256 c790688ef44768de819049d4cad1da5a56adb14c739e6077f8c7ecd927094578
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
adwarepersistencestealer

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Blocklisted process makes network request 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 44 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8.3.0_AdbeRdr830_en_US.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1284
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E9BA29599FF3E942A5F4CEFD52FC4B56 C
      2⤵
      • Loads dropped DLL
      PID:2540
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B1DD91D071ABE1C1963B7186696FA0DF
      2⤵
      • Drops file in System32 directory
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1028
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C7A456D9C3FC4349B26E63518D0ECF27 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
        "C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=5
        3⤵
        • Executes dropped EXE
        PID:1516
    • C:\Windows\syswow64\MsiExec.exe
      "C:\Windows\syswow64\MsiExec.exe" /Z "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2692
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:680
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:756
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:1300
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B0" "00000000000005C4"
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          PID:2980

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              f775535.rbs
              • Path C:\Config.Msi\f775535.rbs
              • Size 466KB
              • SHA256 4a5cb8403d6ba5ec870cda8eae28c185fbd1ddbabacd26de7eec8d2be3b4a1c2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              f775536.rbf
              • Path C:\Config.Msi\f775536.rbf
              • Size 2KB
              • SHA256 472777ad833be4d0805c65fac7079bbc78330d66fad5d176ef0b90a067016614
              • MD5 SHA1 SHA512
              Submit Download

              f775537.rbf
              • Path C:\Config.Msi\f775537.rbf
              • Size 1KB
              • SHA256 93055381eb43b8833da2db109ad989a1ec9448124e90458222d38f80d4ee3a4d
              • MD5 SHA1 SHA512
              Submit Download

              f77562d.rbf
              • Path C:\Config.Msi\f77562d.rbf
              • Size 3B
              • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
              • MD5 SHA1 SHA512
              Submit Download

              AdobeUpdaterPrefs.dat
              • Path C:\Users\Admin\AppData\Local\Adobe\Updater6\AdobeUpdaterPrefs.dat
              • Size 198B
              • SHA256 a0a5eaf1aa3b38cb3487634b6d76f153c2c28c63a95508a6cd6e389129d62f2f
              • MD5 SHA1 SHA512
              Submit Download

              MSI986B.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI986B.tmp
              • Size 48KB
              • SHA256 bec93eab72916acf1a650be51d661ebb0b83f7edf61b495d58c5f2bf231edb9d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSI9A7E.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI9A7E.tmp
              • Size 60KB
              • SHA256 df50c0242690c81b6b1ccc43d7a95a1f2a2c0b964652530e8e7582b0d15a21b3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSI9AAE.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI9AAE.tmp
              • Size 93KB
              • SHA256 10179b633b475f23604bab98e7c14a55a833ae92f0f9c6bc66c3c8d910300795
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSI5428.tmp
              • Path C:\Windows\Installer\MSI5428.tmp
              • Size 112KB
              • SHA256 030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSI54F4.tmp
              • Path C:\Windows\Installer\MSI54F4.tmp
              • Size 156KB
              • SHA256 b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MSI5534.tmp
              • Path C:\Windows\Installer\MSI5534.tmp
              • Size 84KB
              • SHA256 5fec0c3e5c0dafcb9950eb84e2b5e59a679877bd128bb9cf7290b47ed76f9495
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AdobeUpdater.dll
              • Path \Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll
              • Size 509KB
              • SHA256 7de1126a16072b1518b57b910b13419912c2b844b11613fbd2d6a11e8fd79358
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              authplay.dll
              • Path \Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll
              • Size 3.5MB
              • SHA256 bc4f488a26fd622c64f01e579d74b27047ada3e26a73ae8529222b1b8029d04e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Updater.api
              • Path \Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api
              • Size 165KB
              • SHA256 0df6ab70121fb80cb050d287d5d156c103fe7448c1ba97c525c945248b576d2e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Adobe_Updater.exe
              • Path \Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
              • Size 2.4MB
              • SHA256 5a9619856991c1184c789d732f7c597cbe8d0add0732660a4ba358c6a3f258f8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/2256-195-0x0000000073840000-0x00000000738C3000-memory.dmp
              Download