Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 00:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AdbeRdr1000_it_IT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
AdbeRdr1000_it_IT.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target AdbeRdr1000_it_IT.exe
- Size 34.2MB
- Sample260714-amkxjsds41
- SHA256 65f9936c1303c4f0ca4d68f681fc11221a9e069c4536c2fe1fa90ddc0ae9fb34
- MD5 6c4e809917b1991a7464fdaed2ec7954
- SHA1 9ba97c6b713d37762bd8208c686ec71a104ba8cb
- SHA512 d5e8a6400ee917f26248a6ab902bea23a5cfc799c8898b9c7491d538d41773d07cb8dbaff212c692a4854f46a2dcd093da455a407168336ff30383525b0cdf86
- SSDEEP 786432:tzK8i4XHEOm6YTARnqWjChmcszmtGaVVd7FJD2s2xs4pb9f8Le:IJ4XHAFTARqWjfRmtGw7FJ6x3Nh8Le
- TLSH T1B077332125C1AC37D53A1B3148FF93B44356BC7E6F534ABB34166229F871681FE2A60E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4844 setup.exe - Loads dropped DLL 2 IoCs
pid Process 5864 MsiExec.exe 5864 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2500 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdbeRdr1000_it_IT.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2500 msiexec.exe Token: SeIncreaseQuotaPrivilege 2500 msiexec.exe Token: SeSecurityPrivilege 6056 msiexec.exe Token: SeCreateTokenPrivilege 2500 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2500 msiexec.exe Token: SeLockMemoryPrivilege 2500 msiexec.exe Token: SeIncreaseQuotaPrivilege 2500 msiexec.exe Token: SeMachineAccountPrivilege 2500 msiexec.exe Token: SeTcbPrivilege 2500 msiexec.exe Token: SeSecurityPrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeLoadDriverPrivilege 2500 msiexec.exe Token: SeSystemProfilePrivilege 2500 msiexec.exe Token: SeSystemtimePrivilege 2500 msiexec.exe Token: SeProfSingleProcessPrivilege 2500 msiexec.exe Token: SeIncBasePriorityPrivilege 2500 msiexec.exe Token: SeCreatePagefilePrivilege 2500 msiexec.exe Token: SeCreatePermanentPrivilege 2500 msiexec.exe Token: SeBackupPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeShutdownPrivilege 2500 msiexec.exe Token: SeDebugPrivilege 2500 msiexec.exe Token: SeAuditPrivilege 2500 msiexec.exe Token: SeSystemEnvironmentPrivilege 2500 msiexec.exe Token: SeChangeNotifyPrivilege 2500 msiexec.exe Token: SeRemoteShutdownPrivilege 2500 msiexec.exe Token: SeUndockPrivilege 2500 msiexec.exe Token: SeSyncAgentPrivilege 2500 msiexec.exe Token: SeEnableDelegationPrivilege 2500 msiexec.exe Token: SeManageVolumePrivilege 2500 msiexec.exe Token: SeImpersonatePrivilege 2500 msiexec.exe Token: SeCreateGlobalPrivilege 2500 msiexec.exe Token: SeCreateTokenPrivilege 2500 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2500 msiexec.exe Token: SeLockMemoryPrivilege 2500 msiexec.exe Token: SeIncreaseQuotaPrivilege 2500 msiexec.exe Token: SeMachineAccountPrivilege 2500 msiexec.exe Token: SeTcbPrivilege 2500 msiexec.exe Token: SeSecurityPrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeLoadDriverPrivilege 2500 msiexec.exe Token: SeSystemProfilePrivilege 2500 msiexec.exe Token: SeSystemtimePrivilege 2500 msiexec.exe Token: SeProfSingleProcessPrivilege 2500 msiexec.exe Token: SeIncBasePriorityPrivilege 2500 msiexec.exe Token: SeCreatePagefilePrivilege 2500 msiexec.exe Token: SeCreatePermanentPrivilege 2500 msiexec.exe Token: SeBackupPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeShutdownPrivilege 2500 msiexec.exe Token: SeDebugPrivilege 2500 msiexec.exe Token: SeAuditPrivilege 2500 msiexec.exe Token: SeSystemEnvironmentPrivilege 2500 msiexec.exe Token: SeChangeNotifyPrivilege 2500 msiexec.exe Token: SeRemoteShutdownPrivilege 2500 msiexec.exe Token: SeUndockPrivilege 2500 msiexec.exe Token: SeSyncAgentPrivilege 2500 msiexec.exe Token: SeEnableDelegationPrivilege 2500 msiexec.exe Token: SeManageVolumePrivilege 2500 msiexec.exe Token: SeImpersonatePrivilege 2500 msiexec.exe Token: SeCreateGlobalPrivilege 2500 msiexec.exe Token: SeCreateTokenPrivilege 2500 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2500 msiexec.exe Token: SeLockMemoryPrivilege 2500 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2500 msiexec.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5780 AdbeRdr1000_it_IT.exe 5780 AdbeRdr1000_it_IT.exe 5780 AdbeRdr1000_it_IT.exe 4844 setup.exe 4844 setup.exe 4844 setup.exe 2500 msiexec.exe 6056 msiexec.exe 5864 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5780 wrote to memory of 4844 5780 AdbeRdr1000_it_IT.exe 87 PID 4844 wrote to memory of 2500 4844 setup.exe 88 PID 6056 wrote to memory of 5864 6056 msiexec.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdbeRdr1000_it_IT.exe"C:\Users\Admin\AppData\Local\Temp\AdbeRdr1000_it_IT.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1040-7B44-AA0000000001}\setup.exe"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1040-7B44-AA0000000001}\setup.exe" /msi DISABLE_CACHE=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1040-7B44-AA0000000001}\AcroRead.msi" DISABLE_CACHE=1 REBOOT="ReallySuppress" PATCH=""3⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2500
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1F6D1B52F65941F7F887211010304F57 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5864
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRAMDATA\ADOBE\SETUP\{AC76BA86-7AD7-1040-7B44-AA0000000001}\Abcpy.ini
- Size 1KB
- SHA256 2c3dfca37d2618d54781b65d12ad25651eef1f6b321808826e5c22acc0fe2901
- MD5 8e50f582a84c800ed8919f84c77332ca
- SHA1 5c818feb6ec42660b894a9641002874241ab865f
- SHA512 7b7e45303881b77d33f844eb76937ac0c021d626b15eb11843cb0478fa218b85ed7781c0c612e7b113decc299ebc63c466b9bde197b80500568c4f0c2dd7db3e
- TLSH T1663175DD360F1D4224A32A6A52BF29D09253FC3AD33535287D6FB444031DBEC02BA16B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1040-7B44-AA0000000001}\AcroRead.msi
- Size 2.2MB
- SHA256 17cc3c9b89a6e5bb9cfe48680d2c729ccb39129e4b3a9b8de3345b007aae8483
- MD5 607f2eb11c5b7c38628d3c3ba9c3788d
- SHA1 6bdcb30857e06eb031aac3397f6251de98aba832
- SHA512 902003f55ef87daff353c76a22f526125cd3e40e280e3bc70755e4e4594830162046ae383813aa084395e55f3369f3e1fe30d3e45f6ca981bcc6b4d97bdc27a5
- SSDEEP 49152:MdiINCJbMJ6MgqGKMF94nyrH9jUmkcJ1I6o+2f:3bMAMgqWj8M1n4f
- TLSH T14FB55B05B240887FE4662570846EAB2005563DFC1FA3D29BBB58761BBE733C26137A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1040-7B44-AA0000000001}\Setup.ini
- Size 292B
- SHA256 ee4e9382bc653372715eee74cdc2de5bed837ee00d2aba0ff22bd387aefec99a
- MD5 dd5d07acdd743bdf4e1e390bf7c98520
- SHA1 d686fdd98ae1de9b105ea22f82e3f70425b5e91a
- SHA512 29abf037c35de61bd4b5225c4337b13401378b422cb90fd7abc10e4c06a7a8a1bfac4ea75d0578918abfe12f82469555a9f91a95f57916a5dbb9eabbb71aa13f
- TLSH T176E0EB0B43A16AB6B84023D0958F0AA232FCF304000BE00ED0C9490BFDE64B3237C2BE
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1040-7B44-AA0000000001}\setup.exe
- Size 329KB
- SHA256 8cba9b49314bb3b80a7cd89c5fef9eb3cb883fadd941cc89015229a35333ec35
- MD5 87193020b1461efbfff8ab743d929212
- SHA1 0f32a5c572271725d846f89b5896c9694f5e4d12
- SHA512 1a7e254c0d3c0f13e3c00def671c386aa7a5b109bc4d4da9f40d2ac980412bb6a2857e74e793a5c54c6d641471c1dd541f5fb2c4da16491e0a32a975436d4db2
- SSDEEP 6144:XQU4MpOTGlPVsyMwnQQQjB5eLhCB1wQhjEaHVpACc83ERdO:gU4kOyEjB5etCB1wQh3edO
- TLSH T19974060277F58435F6F32B31AD7582745A7BBC31AD39C20E23842A2D5E70A91DA68773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\31067\ExtractFiles.ini
- Size 3KB
- SHA256 d0e2d0be335e4bbc9edcba3fea097e1f075656ce58a09c24d8227d0566ede890
- MD5 c73ad7b4a36215ed793a88d7374490a5
- SHA1 040ecf033bf98c5b7fea4e2e6f5b348e3fec6cd9
- SHA512 9bef912e67f6d8136343ef553c29b186afc31bac646f547670ab1040c719ce5c0d01be966a84401dfbda36107e27e53c47bab2944452ae913e111d25e538df6f
- TLSH T1ED71E32177F92214F6F37F40FFF8A1A98B767ED18839D12E5291060E09B091089B2B73
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI5819.tmp
- Size 52KB
- SHA256 459f503fb8b4fc4a600261430ac77bf70118d41fa19f7b2620d43ba6e9c8fa5e
- MD5 4a908ee9c6f2f4aad63382cccee731e4
- SHA1 e572580949f277987fe232757ce88c2ac35e0223
- SHA512 75ba5856df7ed1457b6192e3b12c5dbb9cd0c6860d787357b37d5e2aabdd1dddb1fd6195064cad1b166431a71dee233b76cb6304d8e868050d79c731ef6e567f
- SSDEEP 768:Y0J8+QCTqaxxKkUmFVSarTJym3OZESrcvFKxLHlx:OCTqYttXDJT+lce/
- TLSH T116338D017DD240B7C78A4A7121E69F2B5F3F7A501FE104839FB15D9A2D367E0923A24E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI59B0.tmp
- Size 75KB
- SHA256 862ad396ee52836a9b7a8f8142a177875f79c81964b542c3168dd8b242e19a23
- MD5 0c6864f73134ebdacf4458c7a2c3251f
- SHA1 99cc4dd14f972dd58badc51ed9001dbcdb80e938
- SHA512 78048337cbdb4f7cd900366348537c80dbd9135c9a79b220895d77a494317258fc1a8ec5f7225e6652a8f44a9a2d1253a65af735a451f842d47d30376c0eb089
- SSDEEP 1536:OMAidT0wl788zBOck2tZ1QFeraLsBiud0G5yzdn5aQC3:1XI8zBFTQFerkAr2G5amL
- TLSH T15C737B1136D0C0B3C69A2931545AD7609E7EA611DEE894077FAB0BBE5F203D1AB2D31B
- MD5 SHA1 SHA512 SSDEEP TLSH