044188a019db3c1095ae0e82dfbaf082a1e7a17b28f1d8834460db2949cdf48c

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crack.exe
Size 40.9MB
Sample260813-thmecstdkh
SHA256 044188a019db3c1095ae0e82dfbaf082a1e7a17b28f1d8834460db2949cdf48c
MD5 213cff0f7231847081e9cda48c892163
SHA1 82f8b285cb0f8b9c4a34a0a105634464c6621ac7
SHA512 cbc284999bebe8e56c2f6cfd194a98b4b27ed114fd1206967e4ea40ac7bded18e0eaa805d9b0c8176eee23baed3512fd9ac9c4715cbea3eeb0c606f54db87f05
SSDEEP 786432:k1ik3Tnrmh1RkHrVJMu/uiIV3z9GMFQXaH1HI5EvFeIYTHcbxXCAjC0GHeDoO:QiYTqiLjMurCz0Xy1/vUuzWHeDoO
TLSH
T17097332635ADD864C53530BDCE958AF947E83D20C34ACF0B01597EAD3EB77B0A889B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	crack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	crack.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
872	sc.exe
4160	sc.exe
3376	sc.exe
228	sc.exe
3096	sc.exe
3804	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3252	cmd.exe
1476	cmd.exe
3784	cmd.exe
4772	cmd.exe
4260	cmd.exe
1956	cmd.exe
1284	cmd.exe
3900	cmd.exe
3496	cmd.exe
2220	cmd.exe
2884	cmd.exe
3332	cmd.exe
1928	cmd.exe
3168	cmd.exe
1672	cmd.exe
3328	cmd.exe
820	cmd.exe
1208	cmd.exe
1400	cmd.exe
1460	cmd.exe
3720	cmd.exe
4152	cmd.exe
1216	cmd.exe
1448	cmd.exe
3096	cmd.exe
3976	cmd.exe
3200	cmd.exe
3716	cmd.exe
3992	cmd.exe
2868	cmd.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
4520	taskkill.exe
1520	taskkill.exe
3344	taskkill.exe
5116	taskkill.exe
1792	taskkill.exe
3664	taskkill.exe
1392	taskkill.exe
3976	taskkill.exe
3200	taskkill.exe
1704	taskkill.exe
1924	taskkill.exe
1436	taskkill.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	1392	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	3344	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	1792	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3664	1772	crack.exe	87
PID 1772 wrote to memory of 4520	1772	crack.exe	90
PID 1772 wrote to memory of 524	1772	crack.exe	92
PID 524 wrote to memory of 3900	524	crack.exe	93
PID 3900 wrote to memory of 3252	3900	cmd.exe	95
PID 3252 wrote to memory of 1380	3252	cmd.exe	96
PID 1772 wrote to memory of 3824	1772	crack.exe	97
PID 1772 wrote to memory of 4084	1772	crack.exe	99
PID 1772 wrote to memory of 4016	1772	crack.exe	101
PID 1772 wrote to memory of 872	1772	crack.exe	103
PID 1772 wrote to memory of 4160	1772	crack.exe	105
PID 1772 wrote to memory of 3376	1772	crack.exe	107
PID 1772 wrote to memory of 228	1772	crack.exe	109
PID 1772 wrote to memory of 3096	1772	crack.exe	111
PID 1772 wrote to memory of 3804	1772	crack.exe	113
PID 1772 wrote to memory of 1520	1772	crack.exe	115
PID 1772 wrote to memory of 1392	1772	crack.exe	117
PID 1772 wrote to memory of 3976	1772	crack.exe	119
PID 1772 wrote to memory of 3344	1772	crack.exe	121
PID 1772 wrote to memory of 5116	1772	crack.exe	123
PID 1772 wrote to memory of 3200	1772	crack.exe	125
PID 1772 wrote to memory of 1704	1772	crack.exe	127
PID 1772 wrote to memory of 1792	1772	crack.exe	129
PID 1772 wrote to memory of 4036	1772	crack.exe	131
PID 1772 wrote to memory of 4600	1772	crack.exe	133
PID 1772 wrote to memory of 656	1772	crack.exe	135
PID 1772 wrote to memory of 1088	1772	crack.exe	137
PID 1772 wrote to memory of 1924	1772	crack.exe	139
PID 1772 wrote to memory of 1436	1772	crack.exe	141
PID 1772 wrote to memory of 1216	1772	crack.exe	143
PID 1216 wrote to memory of 3496	1216	cmd.exe	145
PID 3496 wrote to memory of 5044	3496	cmd.exe	146
PID 1772 wrote to memory of 3784	1772	crack.exe	147
PID 3784 wrote to memory of 3716	3784	cmd.exe	149
PID 3716 wrote to memory of 3676	3716	cmd.exe	150
PID 1772 wrote to memory of 3992	1772	crack.exe	151
PID 3992 wrote to memory of 2220	3992	cmd.exe	153
PID 2220 wrote to memory of 4508	2220	cmd.exe	154
PID 1772 wrote to memory of 1448	1772	crack.exe	155
PID 1448 wrote to memory of 1476	1448	cmd.exe	157
PID 1476 wrote to memory of 3844	1476	cmd.exe	158
PID 1772 wrote to memory of 820	1772	crack.exe	159
PID 820 wrote to memory of 2884	820	cmd.exe	161
PID 2884 wrote to memory of 208	2884	cmd.exe	162
PID 1772 wrote to memory of 3332	1772	crack.exe	164
PID 3332 wrote to memory of 4772	3332	cmd.exe	166
PID 4772 wrote to memory of 4428	4772	cmd.exe	167
PID 1772 wrote to memory of 3096	1772	crack.exe	168
PID 3096 wrote to memory of 1928	3096	cmd.exe	170
PID 1928 wrote to memory of 4948	1928	cmd.exe	171
PID 1772 wrote to memory of 1460	1772	crack.exe	172
PID 1460 wrote to memory of 3720	1460	cmd.exe	174
PID 3720 wrote to memory of 384	3720	cmd.exe	175
PID 1772 wrote to memory of 1208	1772	crack.exe	176
PID 1208 wrote to memory of 4260	1208	cmd.exe	178
PID 4260 wrote to memory of 4284	4260	cmd.exe	179
PID 1772 wrote to memory of 3976	1772	crack.exe	180
PID 3976 wrote to memory of 2868	3976	cmd.exe	182
PID 2868 wrote to memory of 4704	2868	cmd.exe	183
PID 1772 wrote to memory of 4152	1772	crack.exe	184
PID 4152 wrote to memory of 3168	4152	cmd.exe	186
PID 3168 wrote to memory of 4720	3168	cmd.exe	187
PID 1772 wrote to memory of 1284	1772	crack.exe	188
PID 1284 wrote to memory of 3200	1284	cmd.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\crack.exe
"C:\Users\Admin\AppData\Local\Temp\crack.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im acrotray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCollabSync.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\crack.exe
  "C:\Users\Admin\AppData\Local\Temp\crack.exe" -sfxwaitall:1 "install.cmd" "%InstChk%"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\install.cmd" "%InstChk%""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3252
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
        5⤵
        
        PID:1380
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "AdobeGCInvoker-1.0"
  2⤵
  PID:3824
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Adobe-Genuine-Software-Integrity-Scheduler-1.0"
  2⤵
  PID:4084
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Adobe Acrobat Update Task"
  2⤵
  PID:4016
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop AGSService
  2⤵
  - Launches sc.exe
  PID:872
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop AGMService
  2⤵
  - Launches sc.exe
  PID:4160
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop AdobeARMservice
  2⤵
  - Launches sc.exe
  PID:3376
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete AGSService
  2⤵
  - Launches sc.exe
  PID:228
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete AGMService
  2⤵
  - Launches sc.exe
  PID:3096
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config AdobeARMservice start= disabled
  2⤵
  - Launches sc.exe
  PID:3804
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im armsvc.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im "Adobe Genuine Launcher.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCleanUpUtility.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeGCClient.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGCInvokerUtility.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGMService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3200
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im agshelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGSService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c RMDIR /s /q "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient"
  2⤵
  PID:4036
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement" /v "bIsNGLLicensing" /t REG_DWORD /d "00000001" /f
  2⤵
  PID:4600
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\Originals" /v "bDisplayedSplash" /t REG_DWORD /d "00000001" /f
  2⤵
  PID:656
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\Originals" /v "bSplashWaitScreenCount" /t REG_DWORD /d "00000003" /f
  2⤵
  PID:1088
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im acrotray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCollabSync.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrodistdll.dll" "%jAcrobat\acrodistdll.dll.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:5044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\acrodistdll.dll" "%jAcrobat\acrodistdll.dll")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:3676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrotray.exe" "%jAcrobat\acrotray.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\acrotray.exe" "%jAcrobat\acrotray.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:3844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Acrobat.dll" "%jAcrobat\Acrobat.dll.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\Acrobat.dll" "%jAcrobat\Acrobat.dll")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Adobe Crash Processor.exe" "%jAcrobat\Adobe Crash Processor.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\Adobe Crash Processor.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\CRLogTransport.exe" "%jAcrobat\CRLogTransport.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\CRLogTransport.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    PID:3200
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\LogTransport2.exe" "%jAcrobat\LogTransport2.exe.bak")
  2⤵
  - Executes a command shell one-liner
  PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    PID:3328
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\LogTransport2.exe")
  2⤵
  - Executes a command shell one-liner
  PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    PID:1400
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.cmd

Path C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\install.cmd
Size 401B
SHA256 4be87bd53502eb455dbb58a0a4b11e811fd764002db4cf48ef1eb9467995b0f1
MD5 1789e34897a44efd4d971819054692b5
SHA1 73004dc38d7827c450e06db9ccf80d52ca4bd102
SHA512 59e0c4d76701faaff6d786f762bfd507998b64fc6444eb6884e599c120d2ec58d62394bf2de53c71f0ed65d82544a5eb65c3b0532ebb905a84ab0aa8933b37b1
TLSH
T139E0AB0E8868388025C1A372ABC10C49A28EE19C209326E0CBAF646AE91092532DB4C1
MD5 SHA1 SHA512 TLSH

Submit Download