Overview

overview

7

Static

static

5

Gen-Adb/Bi...nP.exe

windows10-2004-x64

7

Gen-Adb/Bi...nP.exe

windows11-ltsc_2024-x64

7

Resubmissions

29/07/2026, 14:15

260729-rkscaahf54

29/07/2026, 14:03

260729-rcwpqshd647

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/07/2026, 14:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Gen-Adb/Binaries/AdobeGenP.exe
  • Size 1024.0MB
  • Sample260729-rcwpqshd64
  • SHA256 497c76429dcee74672d8e097917dfd1db18cc3aef17c8e635de546f9260e9185
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 60 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe
    "C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Windows\Temp\RunAsTI.exe
      C:\Windows\Temp\RunAsTI.exe "C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2640
      • C:\Windows\Temp\RunAsTI.exe
        /t /t C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5056
        • C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe
          "C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\AdobeGenP.exe"
          4⤵
          • Suspicious behavior: GetForegroundWindowSpam
          PID:3800

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\Gen-Adb\Binaries\config.ini
        • Size 7KB
        • SHA256 3709022a13f41251621c34aa2ad72301aad4d5b1ceb8a5095a3fcdaedbd73804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RunAsTI.exe
        • Path C:\Windows\Temp\RunAsTI.exe
        • Size 26KB
        • SHA256 a3e0ba70ba908de8a75825c3a1ff36147e02c686280993c2caa8a9a6968764b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download