Malware Analysis Report

2025-04-03 19:53

Sample ID 241109-xv9bfazjgs
Target 853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N
SHA256 853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6
Tags
discovery evasion persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6

Threat Level: Known bad

The file 853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N was found to be: Known bad.

Malicious Activity Summary

discovery evasion persistence upx

Modifies firewall policy service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 19:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 19:11

Reported

2024-11-09 19:13

Platform

win7-20240903-en

Max time kernel

119s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\conhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\conhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Console Window Host = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\conhost.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2500 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 2744 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1452 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1452 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1452 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2744 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 2744 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 2744 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 2744 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 1988 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 2224 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2232 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2232 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2232 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2232 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2344 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2344 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2344 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2344 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1052 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe

"C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe"

C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe

"C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\TYUIV.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Console Window Host" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe" /f

C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe

"C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe"

C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe

"C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe"

C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe

"C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\conhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\conhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 go00l5.no-ip.info udp
ID 212.117.50.228:3333 go00l5.no-ip.info tcp
ID 212.117.50.228:3333 go00l5.no-ip.info tcp
US 8.8.8.8:53 udp

Files

memory/2500-2-0x0000000000230000-0x0000000000231000-memory.dmp

\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe

MD5 f5abfa079f2a97aadae5ffbfb9517640
SHA1 7309cd3a24a6f215739e09c204b12ec247bbd6da
SHA256 853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6
SHA512 b6e48862667dac7fb31c94b75fd4e2b590e1cf3e0ed56e39ebacfc34f5d4eaca4057178fa65be0d8a36dad5f274134da1d6e835eda5af0439c2db5568a06d956

memory/2744-459-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2744-463-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TYUIV.bat

MD5 0d0a854e96bddf0e7df7f5f024674226
SHA1 f45ca9c7f935422ddfb0550febdfc7a09baf2d98
SHA256 5bab0b5c3ef8a28a7246854074a5a469c602a10ac803d18f2102399597d35907
SHA512 8b6db387b3bb5774c691bcdd4d9f3a147e1556eee89fe1de929464510c01b14495157c14cbb355fc850b79dee500b8be7ae7a0c3b5ea0916d6eb9154f9ae73a8

\Users\Admin\AppData\Roaming\Adobe\conhost.exe

MD5 d0922bc16f7f2a165ee44e100e144334
SHA1 3bfde3214de00775c7db3356b548b01164866941
SHA256 2befe921fcb84b5349716c5533e7d9d3e21a13bc05c131fba06b2c3e159e77d5
SHA512 f5c5939cfd70accd6eb449d88ff06a59bfcce9a985d38b806aaeb8a51e80a9f92fd711ffbc56956167c26ace1792a00860142a9936c882ab480a6917f0d5d56d

memory/2744-505-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2744-1066-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2224-1060-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1968-1050-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1968-1074-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2224-1077-0x0000000000400000-0x000000000047B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 19:11

Reported

2024-11-09 19:13

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\conhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\conhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Console Window Host = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\conhost.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4704 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe
PID 4952 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Windows\SysWOW64\cmd.exe
PID 4952 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Windows\SysWOW64\cmd.exe
PID 516 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 516 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 516 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4952 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4952 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4952 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 4468 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe
PID 2864 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2864 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4944 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4944 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4316 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4316 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4316 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4220 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4220 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4220 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2332 wrote to memory of 4160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2332 wrote to memory of 4160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2332 wrote to memory of 4160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe

"C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe"

C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe

"C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ITYUI.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Console Window Host" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe" /f

C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe

"C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe"

C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe

"C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe"

C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe

"C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\conhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\conhost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 go00l5.no-ip.info udp
ID 212.117.50.228:3333 go00l5.no-ip.info tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
ID 212.117.50.228:3333 go00l5.no-ip.info tcp
US 8.8.8.8:53 1go00l5.no-ip.info udp

Files

memory/4704-3-0x00000000024D0000-0x00000000024D1000-memory.dmp

memory/4704-4-0x0000000002510000-0x0000000002511000-memory.dmp

memory/4704-2-0x0000000002490000-0x0000000002491000-memory.dmp

memory/4704-5-0x0000000002490000-0x0000000002491000-memory.dmp

memory/4704-6-0x0000000002510000-0x0000000002511000-memory.dmp

memory/4952-7-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6N.exe

MD5 f5abfa079f2a97aadae5ffbfb9517640
SHA1 7309cd3a24a6f215739e09c204b12ec247bbd6da
SHA256 853ea91c6f3b5f1ab709422a7be3f115b2d4e75621270866d70c14dd1d1681a6
SHA512 b6e48862667dac7fb31c94b75fd4e2b590e1cf3e0ed56e39ebacfc34f5d4eaca4057178fa65be0d8a36dad5f274134da1d6e835eda5af0439c2db5568a06d956

memory/4952-10-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4952-12-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ITYUI.txt

MD5 0d0a854e96bddf0e7df7f5f024674226
SHA1 f45ca9c7f935422ddfb0550febdfc7a09baf2d98
SHA256 5bab0b5c3ef8a28a7246854074a5a469c602a10ac803d18f2102399597d35907
SHA512 8b6db387b3bb5774c691bcdd4d9f3a147e1556eee89fe1de929464510c01b14495157c14cbb355fc850b79dee500b8be7ae7a0c3b5ea0916d6eb9154f9ae73a8

C:\Users\Admin\AppData\Roaming\Adobe\conhost.exe

MD5 275069150564c3aac3281fbff1aaec69
SHA1 ba43b550a7bcf7ba8d38f6a17ba2cadf5477c5cb
SHA256 bde305fad049c056a5347d3f91c39f311f3e05127f1ef307b805384b714ad436
SHA512 9219fdb39adbeeb0b9fe7f0ecb0ea2583e54ed7c2732e944652c85b0d586ba9b447ef7fde5e25427ffd572611eb76bf9ce491d9cd3b65b0308bcc3eecfc05fdb

memory/4952-38-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4468-41-0x0000000000400000-0x0000000000456000-memory.dmp

memory/4468-40-0x0000000000400000-0x0000000000456000-memory.dmp

memory/4468-42-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2864-50-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2864-56-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2864-54-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4952-65-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4468-62-0x0000000000400000-0x0000000000456000-memory.dmp

memory/4892-68-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2864-69-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2864-73-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2864-76-0x0000000000400000-0x000000000047B000-memory.dmp