519251cd4fd2f91ef8f1d98da76425dca81d601a814593c598197c9ca2f720ed

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docusment/1/1.exe
Size

378KB
MD5

2df98c8120ba718a0bb30f6e16b30dbe
SHA1

9f293a5de204b05b2e2114bc662e6d51dc198071
SHA256

abcf2c8bab98cedb1bd973a0cefa747e6fe9d835248e4471f7cf9c26446abe6e
SHA512

cf5969519cf8d01fc33f7fcc7f73c50f79f16838a4d910ca3c23b65350e5c31df91d9a7a45b2935d60ec61108583b06bea3534c8750d4f8712216ed90fd987e1
SSDEEP

6144:yJSEaqLpUx+9rtlmKPeTyQ0Sl9xbAOtT9YoB4kPW7X:yJSEpUxsOHb3T34kPWD

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeManagerJJz = "\"C:\\ProgramData\\AdobeManagerJJz\\Adobe Geniune Helper.exe\" 493"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeManagerJJz = "\"C:\\ProgramData\\AdobeManagerJJz\\Adobe Geniune Helper.exe\" 493"	1.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Public\Publics\desktop.ini	1.exe
File opened for modification	C:\Users\Public\Publics\desktop.ini	1.exe
File created	C:\ProgramData\AdobeManager\desktop.ini	1.exe
File opened for modification	C:\ProgramData\AdobeManager\desktop.ini	1.exe

Executes dropped EXE 1 IoCs

pid	Process
4996	Adobe Geniune Helper.exe

Loads dropped DLL 1 IoCs

pid	Process
4996	Adobe Geniune Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adobe Geniune Helper.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	1.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\ms-pu	1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\CLSID = 34003200310037003800380033003200340034003900420030004300350031000000	1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 4996	348	1.exe	93
PID 348 wrote to memory of 4996	348	1.exe	93
PID 348 wrote to memory of 4996	348	1.exe	93

C:\Users\Admin\AppData\Local\Temp\Docusment\1\1.exe
"C:\Users\Admin\AppData\Local\Temp\Docusment\1\1.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:348
- C:\ProgramData\AdobeManagerJJz\Adobe Geniune Helper.exe
  "C:\ProgramData\AdobeManagerJJz\Adobe Geniune Helper.exe" 493
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AdobeManagerJJz\Adobe Geniune Helper.exe

Filesize
378KB

MD5
2df98c8120ba718a0bb30f6e16b30dbe

SHA1
9f293a5de204b05b2e2114bc662e6d51dc198071

SHA256
abcf2c8bab98cedb1bd973a0cefa747e6fe9d835248e4471f7cf9c26446abe6e

SHA512
cf5969519cf8d01fc33f7fcc7f73c50f79f16838a4d910ca3c23b65350e5c31df91d9a7a45b2935d60ec61108583b06bea3534c8750d4f8712216ed90fd987e1

Download Submit
C:\ProgramData\AdobeManagerJJz\libcef.dll

Filesize
130KB

MD5
c38f92b1484e0ffeb3c30402d7a6beac

SHA1
c3389f6e31a4ae5d9ba8c19251981942c69faea6

SHA256
b9d51c938e7ce79a577358534e3d628ed41288b4d469bb7c20837a54044fc1b6

SHA512
4ea0cf165630bbaa6c261f892216ab931bf8b67036d0547579e657d648ce48bfc4da30be3992053b20bd6a834e9a9b39b96eb9250427c12137c8cba8ada5dd5a

Download Submit
memory/348-1-0x0000000000F10000-0x0000000001010000-memory.dmp

Filesize
1024KB

Download
memory/348-2-0x0000000001210000-0x0000000004E6B000-memory.dmp

Filesize
60.4MB

Download
memory/348-9-0x0000000000F10000-0x0000000001010000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads