Overview

overview

7

Static

static

5

Set-up.exe

windows10-2004-x64

7

Set-up.exe

windows11-ltsc_2024-x64

3

AdobeIPCBroker.exe

windows10-2004-x64

3

AdobeIPCBroker.exe

windows11-ltsc_2024-x64

3

customhook...ok.exe

windows10-2004-x64

3

customhook...ok.exe

windows11-ltsc_2024-x64

3

AdobePIM.dll

windows10-2004-x64

4

AdobePIM.dll

windows11-ltsc_2024-x64

4

Core.dll

windows10-2004-x64

3

Core.dll

windows11-ltsc_2024-x64

3

Adobe Upda...er.exe

windows10-2004-x64

3

Adobe Upda...er.exe

windows11-ltsc_2024-x64

3

HDHelper.exe

windows10-2004-x64

3

HDHelper.exe

windows11-ltsc_2024-x64

3

HDIM.dll

windows10-2004-x64

4

HDIM.dll

windows11-ltsc_2024-x64

4

HDPIM.dll

windows10-2004-x64

3

HDPIM.dll

windows11-ltsc_2024-x64

3

HDUWP.dll

windows10-2004-x64

3

HDUWP.dll

windows11-ltsc_2024-x64

3

HDZIP.dll

windows10-2004-x64

3

HDZIP.dll

windows11-ltsc_2024-x64

3

HUM.dll

windows10-2004-x64

3

HUM.dll

windows11-ltsc_2024-x64

3

Set-up.exe

windows10-2004-x64

3

Set-up.exe

windows11-ltsc_2024-x64

3

Setup.exe

windows10-2004-x64

4

Setup.exe

windows11-ltsc_2024-x64

4

TokenResolverx64.exe

windows10-2004-x64

1

TokenResolverx64.exe

windows11-ltsc_2024-x64

1

Uninstaller.exe

windows10-2004-x64

3

Uninstaller.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Adobe Photoshop CC 2019 v20.0.10.120 64-bits.iso
  • Size 1777.5MB
  • Sample260808-m6zw2aej4v
  • SHA256 f8936bd82a6679f6eb530f3851a126431a8c3ecb51f4476009590a3d17239a55
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Targets

    • Target
      Set-up.exe
    • Size 4.9MB
    • SHA256 ffb472a88add0abdf37afcd6fdfd00d1bb6123ff9616830c8249e3da9430d408
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    adwaredefense_evasiondiscoveryspywaretrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2
    • Target
      AdobeIPCBroker.exe
    • Size 1.0MB
    • SHA256 99557b43cd337e46afab2d277fc0e8cfe668241780e68dd4c88c9099f65c809b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      customhook/AdobeIPCBrokerCustomHook.exe
    • Size 197KB
    • SHA256 e97c8ed6d6c95556c11f73149a54b759548fd144e23f320ffa573709db9ccba7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      AdobePIM.dll
    • Size 1.8MB
    • SHA256 a89f2e855f3cf132a45f8256aac8f6f5120a3e7829c033a6c0b191feb878d6dd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral7behavioral8
    • Target
      Core.dll
    • Size 401KB
    • SHA256 8d676fbc250f4302db70596592904e2c2b38aaa478828b5b07741e01a62cd77c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      Adobe Update Helper.exe
    • Size 1.1MB
    • SHA256 5a3289b217939777811fb2334b82d87586cee56b47693daab50254674870e6cb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      HDHelper.exe
    • Size 518KB
    • SHA256 7c53937f897f7230122a300f237ac541319781c248eafbe5c452a5cf9d99c941
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      HDIM.dll
    • Size 374KB
    • SHA256 a323cd1b0307db9cfc1148d46151b7d4ef116e47b18a0860123df46aff10e2b9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral15behavioral16
    • Target
      HDPIM.dll
    • Size 2.7MB
    • SHA256 0026dfcd26fcb45dd9e6b4c44af1480292002f48dfe1fb5acc1fae730eccada1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      HDUWP.dll
    • Size 325KB
    • SHA256 6c6541988d356c55bf17ca958c45c8501a30812ab03da4553cc91b1e00972666
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      HDZIP.dll
    • Size 343KB
    • SHA256 10a1a9f2c7ee1dcef63d54ea00000f3990f3f3fb3ad60e521348b9482a7befd2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      HUM.dll
    • Size 1.3MB
    • SHA256 5f28a32b337b62a9ca5d11f73030e6ff486c0a4c18aee6563988822674a01855
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      Set-up.exe
    • Size 4.9MB
    • SHA256 576484e7c8909a9a55382072ca43f5d948f98fa35860e69a9c30d2ad07fb0509
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwaredefense_evasiondiscoveryspywaretrojan
    behavioral25behavioral26
    • Target
      Setup.exe
    • Size 532KB
    • SHA256 b5a389b9dd740aee95b4410a3d6f2908bf92b30948d0b5b2e145073ca79db36c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral27behavioral28
    • Target
      TokenResolverx64.exe
    • Size 132KB
    • SHA256 98b54428bdc353a8f6748a81d655b37b64628ffa56eda9b619499879cef039d9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      Uninstaller.exe
    • Size 890KB
    • SHA256 b8ffe77bf3bc0cc9ef3e13d516c1eafb77b8db8b5a4a62e11d9e907c01e49b6d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
5/10

behavioral1

adwaredefense_evasiondiscoveryspywaretrojan
Score
7/10

behavioral2

adwaredefense_evasiondiscoveryspywaretrojan
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
4/10

behavioral8

discovery
Score
4/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
4/10

behavioral16

discovery
Score
4/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

adwaredefense_evasiondiscoveryspywaretrojan
Score
3/10

behavioral26

adwarediscoveryspyware
Score
3/10

behavioral27

discovery
Score
4/10

behavioral28

discovery
Score
4/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10