Overview

overview

8

Static

static

3

Adobe_Acro...8A.exe

windows10-2004-x64

7

Adobe_Acro...8A.exe

windows11-ltsc_2024-x64

7

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ay.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ON.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows11-ltsc_2024-x64

3

$TEMP/$R0.exe

windows10-2004-x64

1

$TEMP/$R0.exe

windows11-ltsc_2024-x64

1

$TEMP/$_65_.exe

windows10-2004-x64

1

$TEMP/$_65_.exe

windows11-ltsc_2024-x64

1

$_34_.exe

windows10-2004-x64

1

$_34_.exe

windows11-ltsc_2024-x64

1

CBBackupPlan.exe

windows10-2004-x64

1

CBBackupPlan.exe

windows11-ltsc_2024-x64

1

CBFS6Net.dll

windows10-2004-x64

1

CBFS6Net.dll

windows11-ltsc_2024-x64

1

Cloud.AzureClient.dll

windows10-2004-x64

1

Cloud.AzureClient.dll

windows11-ltsc_2024-x64

1

Cloud.Back...ge.dll

windows10-2004-x64

1

Cloud.Back...ge.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe
  • Size 24.8MB
  • Sample260620-arftdsdx51
  • SHA256 f11345c8996c1750815b1d25269ca69c7b3a931ebfb244cd85c23b299d92fdcb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryinstallerpersistenceransomwarespywaretrojan

Malware Config

Targets

    • Target
      Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe
    • Size 24.8MB
    • SHA256 f11345c8996c1750815b1d25269ca69c7b3a931ebfb244cd85c23b299d92fdcb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryspywaretrojan
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 21KB
    • SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 10KB
    • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/UAC.dll
    • Size 17KB
    • SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarediscoverypersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsArray.dll
    • Size 12KB
    • SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14
    • Target
      $PLUGINSDIR/nsJSON.dll
    • Size 21KB
    • SHA256 15b527ac5d224b2b684ef07fecd6d71d61f05955e3a2bd3dd1de6378e927b3f8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/processwork.dll
    • Size 231KB
    • SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      $TEMP/$R0
    • Size 47KB
    • SHA256 b3076560d5321b9d8d99221194376241e5277957c8eb4b0eba689b616e803ac7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      $TEMP/$_65_
    • Size 47KB
    • SHA256 b3076560d5321b9d8d99221194376241e5277957c8eb4b0eba689b616e803ac7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      $_34_
    • Size 2.6MB
    • SHA256 42400a7e092c84a29ad7f5c29c8f4cbff8e825f0940ba4951fab5f536c703d43
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      CBBackupPlan.exe
    • Size 1.1MB
    • SHA256 352b9b4574d89ff6316297a78058ccdb34a362400b9b9199e8ea776ac52789bd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      CBFS6Net.dll
    • Size 336KB
    • SHA256 2ad750b27fdb15dd5ccd5a08d2e13d7ed844089f00482850cc6edfaf4c2726bb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      Cloud.AzureClient.dll
    • Size 352KB
    • SHA256 9ece6b28a1501bc7ff7844a0acf65bf6019abdda840972b6e3d1456486f9755a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      Cloud.Backup.DiskImage.BootImage.dll
    • Size 282KB
    • SHA256 11c9668a4356563b89888059bcdc90cecd18230039f30f490449078c2a6100ed
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

installer
Score
3/10

behavioral1

defense_evasiondiscoveryspywaretrojan
Score
7/10

behavioral2

defense_evasiondiscoveryspywaretrojan
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral11

discovery
Score
3/10

behavioral12

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral13

discovery
Score
3/10

behavioral14

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10