044188a019db3c1095ae0e82dfbaf082a1e7a17b28f1d8834460db2949cdf48c

Analysis

user interaction
yes
max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crack.exe
Size 40.9MB
Sample260813-thmecstdkh
SHA256 044188a019db3c1095ae0e82dfbaf082a1e7a17b28f1d8834460db2949cdf48c
MD5 213cff0f7231847081e9cda48c892163
SHA1 82f8b285cb0f8b9c4a34a0a105634464c6621ac7
SHA512 cbc284999bebe8e56c2f6cfd194a98b4b27ed114fd1206967e4ea40ac7bded18e0eaa805d9b0c8176eee23baed3512fd9ac9c4715cbea3eeb0c606f54db87f05
SSDEEP 786432:k1ik3Tnrmh1RkHrVJMu/uiIV3z9GMFQXaH1HI5EvFeIYTHcbxXCAjC0GHeDoO:QiYTqiLjMurCz0Xy1/vUuzWHeDoO
TLSH
T17097332635ADD864C53530BDCE958AF947E83D20C34ACF0B01597EAD3EB77B0A889B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3824	sc.exe
4072	sc.exe
2184	sc.exe
1572	sc.exe
4076	sc.exe
2792	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5944	cmd.exe
6020	cmd.exe
1848	cmd.exe
5548	cmd.exe
1308	cmd.exe
3632	cmd.exe
1920	cmd.exe
5344	cmd.exe
4108	cmd.exe
5940	cmd.exe
1460	cmd.exe
5628	cmd.exe
5484	cmd.exe
6016	cmd.exe
5404	cmd.exe
5108	cmd.exe
4288	cmd.exe
4624	cmd.exe
4336	cmd.exe
1304	cmd.exe
2100	cmd.exe
3092	cmd.exe
1508	cmd.exe
1916	cmd.exe
1688	cmd.exe
1184	cmd.exe
5036	cmd.exe
264	cmd.exe
4640	cmd.exe
4216	cmd.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
4256	taskkill.exe
5380	taskkill.exe
4196	taskkill.exe
1256	taskkill.exe
1292	taskkill.exe
1180	taskkill.exe
5172	taskkill.exe
5004	taskkill.exe
5980	taskkill.exe
432	taskkill.exe
6076	taskkill.exe
5316	taskkill.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	6076	taskkill.exe
Token: SeDebugPrivilege	5316	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	5380	taskkill.exe
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	5172	taskkill.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeDebugPrivilege	5004	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 432	1768	crack.exe	89
PID 1768 wrote to memory of 6076	1768	crack.exe	92
PID 1768 wrote to memory of 5804	1768	crack.exe	94
PID 5804 wrote to memory of 1916	5804	crack.exe	95
PID 1916 wrote to memory of 1308	1916	cmd.exe	97
PID 1308 wrote to memory of 1184	1308	cmd.exe	98
PID 1768 wrote to memory of 5140	1768	crack.exe	99
PID 1768 wrote to memory of 1020	1768	crack.exe	101
PID 1768 wrote to memory of 4664	1768	crack.exe	103
PID 1768 wrote to memory of 1572	1768	crack.exe	105
PID 1768 wrote to memory of 4076	1768	crack.exe	107
PID 1768 wrote to memory of 2792	1768	crack.exe	109
PID 1768 wrote to memory of 3824	1768	crack.exe	111
PID 1768 wrote to memory of 4072	1768	crack.exe	113
PID 1768 wrote to memory of 2184	1768	crack.exe	115
PID 1768 wrote to memory of 5316	1768	crack.exe	117
PID 1768 wrote to memory of 1180	1768	crack.exe	119
PID 1768 wrote to memory of 4256	1768	crack.exe	121
PID 1768 wrote to memory of 5380	1768	crack.exe	123
PID 1768 wrote to memory of 4196	1768	crack.exe	125
PID 1768 wrote to memory of 5172	1768	crack.exe	127
PID 1768 wrote to memory of 1256	1768	crack.exe	129
PID 1768 wrote to memory of 5004	1768	crack.exe	131
PID 1768 wrote to memory of 944	1768	crack.exe	133
PID 1768 wrote to memory of 1456	1768	crack.exe	135
PID 1768 wrote to memory of 5128	1768	crack.exe	137
PID 1768 wrote to memory of 5708	1768	crack.exe	139
PID 1768 wrote to memory of 1292	1768	crack.exe	141
PID 1768 wrote to memory of 5980	1768	crack.exe	143
PID 1768 wrote to memory of 4288	1768	crack.exe	145
PID 4288 wrote to memory of 3632	4288	cmd.exe	147
PID 3632 wrote to memory of 3020	3632	cmd.exe	148
PID 1768 wrote to memory of 5628	1768	crack.exe	149
PID 5628 wrote to memory of 5404	5628	cmd.exe	151
PID 5404 wrote to memory of 6108	5404	cmd.exe	152
PID 1768 wrote to memory of 1920	1768	crack.exe	153
PID 1920 wrote to memory of 1688	1920	cmd.exe	155
PID 1688 wrote to memory of 916	1688	cmd.exe	156
PID 1768 wrote to memory of 4624	1768	crack.exe	157
PID 4624 wrote to memory of 5344	4624	cmd.exe	159
PID 5344 wrote to memory of 5600	5344	cmd.exe	160
PID 1768 wrote to memory of 5944	1768	crack.exe	161
PID 5944 wrote to memory of 4336	5944	cmd.exe	163
PID 4336 wrote to memory of 256	4336	cmd.exe	164
PID 1768 wrote to memory of 264	1768	crack.exe	165
PID 264 wrote to memory of 6020	264	cmd.exe	167
PID 6020 wrote to memory of 3712	6020	cmd.exe	168
PID 1768 wrote to memory of 4108	1768	crack.exe	169
PID 4108 wrote to memory of 1848	4108	cmd.exe	171
PID 1848 wrote to memory of 2788	1848	cmd.exe	172
PID 1768 wrote to memory of 3092	1768	crack.exe	173
PID 3092 wrote to memory of 5484	3092	cmd.exe	175
PID 5484 wrote to memory of 1436	5484	cmd.exe	176
PID 1768 wrote to memory of 1184	1768	crack.exe	177
PID 1184 wrote to memory of 5108	1184	cmd.exe	179
PID 5108 wrote to memory of 5064	5108	cmd.exe	180
PID 1768 wrote to memory of 4640	1768	crack.exe	181
PID 4640 wrote to memory of 1304	4640	cmd.exe	183
PID 1304 wrote to memory of 784	1304	cmd.exe	184
PID 1768 wrote to memory of 5036	1768	crack.exe	185
PID 5036 wrote to memory of 5940	5036	cmd.exe	187
PID 5940 wrote to memory of 4996	5940	cmd.exe	188
PID 1768 wrote to memory of 5548	1768	crack.exe	189
PID 5548 wrote to memory of 4216	5548	cmd.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\crack.exe
"C:\Users\Admin\AppData\Local\Temp\crack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im acrotray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCollabSync.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Users\Admin\AppData\Local\Temp\crack.exe
  "C:\Users\Admin\AppData\Local\Temp\crack.exe" -sfxwaitall:1 "install.cmd" "%InstChk%"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\install.cmd" "%InstChk%""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1308
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
        5⤵
        
        PID:1184
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "AdobeGCInvoker-1.0"
  2⤵
  PID:5140
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Adobe-Genuine-Software-Integrity-Scheduler-1.0"
  2⤵
  PID:1020
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Adobe Acrobat Update Task"
  2⤵
  PID:4664
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop AGSService
  2⤵
  - Launches sc.exe
  PID:1572
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop AGMService
  2⤵
  - Launches sc.exe
  PID:4076
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop AdobeARMservice
  2⤵
  - Launches sc.exe
  PID:2792
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete AGSService
  2⤵
  - Launches sc.exe
  PID:3824
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete AGMService
  2⤵
  - Launches sc.exe
  PID:4072
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config AdobeARMservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2184
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im armsvc.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5316
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im "Adobe Genuine Launcher.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCleanUpUtility.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeGCClient.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5380
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGCInvokerUtility.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGMService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5172
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im agshelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGSService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c RMDIR /s /q "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient"
  2⤵
  PID:944
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement" /v "bIsNGLLicensing" /t REG_DWORD /d "00000001" /f
  2⤵
  PID:1456
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\Originals" /v "bDisplayedSplash" /t REG_DWORD /d "00000001" /f
  2⤵
  PID:5128
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\Originals" /v "bSplashWaitScreenCount" /t REG_DWORD /d "00000003" /f
  2⤵
  PID:5708
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im acrotray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCollabSync.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrodistdll.dll" "%jAcrobat\acrodistdll.dll.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\acrodistdll.dll" "%jAcrobat\acrodistdll.dll")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:6108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrotray.exe" "%jAcrobat\acrotray.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\acrotray.exe" "%jAcrobat\acrotray.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:5600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Acrobat.dll" "%jAcrobat\Acrobat.dll.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\Acrobat.dll" "%jAcrobat\Acrobat.dll")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:3712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Adobe Crash Processor.exe" "%jAcrobat\Adobe Crash Processor.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:5064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\Adobe Crash Processor.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\CRLogTransport.exe" "%jAcrobat\CRLogTransport.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\CRLogTransport.exe")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    PID:4216
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:5780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\LogTransport2.exe" "%jAcrobat\LogTransport2.exe.bak")
  2⤵
  - Executes a command shell one-liner
  PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    PID:1460
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\LogTransport2.exe")
  2⤵
  - Executes a command shell one-liner
  PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    PID:1508
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.cmd

Path C:\Users\Admin\AppData\Local\Temp\Acrobat Temp\install.cmd
Size 401B
SHA256 4be87bd53502eb455dbb58a0a4b11e811fd764002db4cf48ef1eb9467995b0f1
MD5 1789e34897a44efd4d971819054692b5
SHA1 73004dc38d7827c450e06db9ccf80d52ca4bd102
SHA512 59e0c4d76701faaff6d786f762bfd507998b64fc6444eb6884e599c120d2ec58d62394bf2de53c71f0ed65d82544a5eb65c3b0532ebb905a84ab0aa8933b37b1
TLSH
T139E0AB0E8868388025C1A372ABC10C49A28EE19C209326E0CBAF646AE91092532DB4C1
MD5 SHA1 SHA512 TLSH

Submit Download