Overview

overview

10

Static

static

10

7091ded12f...30.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    112s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/08/2026, 08:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7091ded12f4626367a74e0a8947099863b5cb0b1321a3f9a46227e518c816830.exe
  • Size 3.3MB
  • Sample260831-kapp3sfd49
  • SHA256 7091ded12f4626367a74e0a8947099863b5cb0b1321a3f9a46227e518c816830
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverylunampersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Lunam

    Lunam is a Windows trojan written in Visual Basic.

    trojanlunam
  • Detects Lunam 29 IoCs
  • Executes dropped EXE 59 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 60 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7091ded12f4626367a74e0a8947099863b5cb0b1321a3f9a46227e518c816830.exe
    "C:\Users\Admin\AppData\Local\Temp\7091ded12f4626367a74e0a8947099863b5cb0b1321a3f9a46227e518c816830.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3256
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4424
  • \??\c:\Program Files\EditConvert.exe
    "c:\Program Files\EditConvert.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3452
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3564
  • \??\c:\Program Files\DenySync.exe
    "c:\Program Files\DenySync.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3956
  • C:\WINDOWS\system32\Taskmgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3952
  • \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
    "c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4796
  • \??\c:\Program Files\DismountEnable.exe
    "c:\Program Files\DismountEnable.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1176
  • \??\c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
    "c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4848
  • \??\c:\Program Files\MountResolve.exe
    "c:\Program Files\MountResolve.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2484
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3652
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2080
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1300
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3836
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1752
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3344
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5092
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5044
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1436
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2280
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1836
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5176
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5184
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5228
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5236
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5288
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5300
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5308
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5440
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5508
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5604
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5628
  • \??\c:\Users\Admin\AppData\Roaming\ClearConvertTo\EnablePing.exe
    c:\Users\Admin\AppData\Roaming\ClearConvertTo\EnablePing.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6076
  • \??\c:\Users\Admin\AppData\Roaming\DisableReset\SkipApprove.exe
    c:\Users\Admin\AppData\Roaming\DisableReset\SkipApprove.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6084
  • \??\c:\Users\Admin\AppData\Roaming\GroupRegister.exe
    c:\Users\Admin\AppData\Roaming\GroupRegister.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6132
  • \??\c:\Users\Admin\AppData\Roaming\FindApprove\RemoveLock.exe
    c:\Users\Admin\AppData\Roaming\FindApprove\RemoveLock.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5296
  • \??\c:\Users\Admin\AppData\Roaming\EnterResolve.exe
    c:\Users\Admin\AppData\Roaming\EnterResolve.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5812
  • \??\c:\Users\Admin\AppData\Roaming\MergePublish\SuspendComplete.exe
    c:\Users\Admin\AppData\Roaming\MergePublish\SuspendComplete.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6096
  • \??\c:\Users\Admin\AppData\Roaming\MergePublish\FormatTrace.exe
    c:\Users\Admin\AppData\Roaming\MergePublish\FormatTrace.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6192
  • \??\c:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe
    "c:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6276
  • \??\c:\Users\Admin\AppData\Roaming\SplitUndo\UndoUnregister.exe
    c:\Users\Admin\AppData\Roaming\SplitUndo\UndoUnregister.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6612
  • \??\c:\Users\Admin\AppData\Roaming\RemoveDisconnect.exe
    c:\Users\Admin\AppData\Roaming\RemoveDisconnect.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6644
  • \??\c:\Users\Admin\AppData\Roaming\UninstallDisable\BlockCompress.exe
    c:\Users\Admin\AppData\Roaming\UninstallDisable\BlockCompress.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6676
  • \??\c:\Users\Admin\AppData\Roaming\ReceiveGrant\PublishClose.exe
    c:\Users\Admin\AppData\Roaming\ReceiveGrant\PublishClose.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6692
  • \??\c:\Users\Admin\AppData\Roaming\UninstallAssert\AddShow.exe
    c:\Users\Admin\AppData\Roaming\UninstallAssert\AddShow.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6704
  • \??\c:\Users\Admin\AppData\Roaming\UninstallAssert\PushWrite.exe
    c:\Users\Admin\AppData\Roaming\UninstallAssert\PushWrite.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6784
  • \??\c:\Users\Admin\AppData\Roaming\UninstallDisable\OutTest.exe
    c:\Users\Admin\AppData\Roaming\UninstallDisable\OutTest.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6864
  • \??\c:\Users\Admin\Downloads\FindEnter.exe
    c:\Users\Admin\Downloads\FindEnter.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7276
  • \??\c:\Users\Admin\Desktop\InitializeAdd.exe
    c:\Users\Admin\Desktop\InitializeAdd.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7292
  • \??\c:\Users\Admin\Documents\RemoveFind.exe
    c:\Users\Admin\Documents\RemoveFind.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7308
  • \??\c:\Users\Admin\Documents\ExitDismount.exe
    c:\Users\Admin\Documents\ExitDismount.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7412
  • \??\c:\Users\Admin\Downloads\DebugMerge.exe
    c:\Users\Admin\Downloads\DebugMerge.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7428
  • \??\c:\Users\Admin\Documents\InvokePing.exe
    c:\Users\Admin\Documents\InvokePing.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7444
  • \??\c:\Users\Admin\Desktop\MeasureExit.exe
    c:\Users\Admin\Desktop\MeasureExit.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7568
  • \??\c:\Users\Admin\Documents\InstallUnblock.exe
    c:\Users\Admin\Documents\InstallUnblock.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7584
  • \??\c:\Users\Admin\Documents\WatchInstall.exe
    c:\Users\Admin\Documents\WatchInstall.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7616
  • \??\c:\Users\Admin\Documents\BlockWatch.exe
    c:\Users\Admin\Documents\BlockWatch.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7628
  • \??\c:\Users\Admin\Desktop\ConvertFromSearch.exe
    c:\Users\Admin\Desktop\ConvertFromSearch.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7636
  • \??\c:\Users\Admin\Music\ExportRevoke.exe
    c:\Users\Admin\Music\ExportRevoke.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7644
  • \??\c:\Users\Admin\Desktop\EnableInvoke.exe
    c:\Users\Admin\Desktop\EnableInvoke.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7652
  • \??\c:\Users\Admin\Music\RemoveBlock.exe
    c:\Users\Admin\Music\RemoveBlock.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:7880

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AdobeID.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
        • Size 3.3MB
        • SHA256 5ec4eaea906ac26327886e00f8ba640b50c38974152abe624d07438522074d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HomeBanner_Dark.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
        • Size 3.3MB
        • SHA256 d7907df7252c01c8338b5281693ee10eb997800a8e7fd61dd2ed09beaee9677a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MobileAcrobatCard_Dark.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
        • Size 3.6MB
        • SHA256 e4b00ec1e2604d66ca1a4e2762374c2e2682fcba58c339acc6d3ed1bbba78005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MobileScanCard_Dark.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
        • Size 3.3MB
        • SHA256 2e3145051e802a721476a8ccadcf5eddac3af4bf1ae6a141b8fbe1801ee7c8f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Adobe Cloud Services.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
        • Size 3.6MB
        • SHA256 89137bba620597f7be4390b72084a788c9bc0160ffc5947c1486bfb1aa4b519d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Adobe Sign White Paper.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
        • Size 3.7MB
        • SHA256 a4649cd89379986282c0c8968bc771807b36f796a2212689de2a051eb5855ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Bus Schedule.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
        • Size 4.2MB
        • SHA256 cfe8ac238504df77b6af35e8f9d28eaf4b0bf6fe1904ed0be143db632386f525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Welcome.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
        • Size 3.3MB
        • SHA256 1b6af47abe28ae895cda75c02e000895ac5a7670c5a11f4efb4a11d7a8b4016c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SignHere.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
        • Size 3.3MB
        • SHA256 978c6466b5a1e073e9ddf2d022e3a9b1c8514ff81a128f304c0c64efda7e3c03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ENUtxt.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
        • Size 3.3MB
        • SHA256 aa7bd25401fd099e7400f0ca3bcb4b138ee1ceb7c24382b9cff8b67808dea4b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DenySync.exe
        • Path C:\Program Files\DenySync.exe
        • Size 3.7MB
        • SHA256 2dfed6e445e3dfb790d1b686b060777b4668a90862043224d81399c5a69735bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PROTTPLN.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
        • Size 3.3MB
        • SHA256 aa9188fdddeaedbaa2cd5950425c94d897a9dd62e8534182de127a3e6e5393a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EXCEL12.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
        • Size 3.3MB
        • SHA256 3c48b7ae49306c3161aa426370c5cff138476f75a3dd24746b59ecd6e52ea200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EnablePing.exe
        • Path C:\Users\Admin\AppData\Roaming\ClearConvertTo\EnablePing.exe
        • Size 3.6MB
        • SHA256 823117bbf332e18fcf522fb9f64bf32b808e8ef18b68011a30703157f355021d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
        • Size 3.4MB
        • SHA256 b94df09add584273eb90338ff2892cafa3028a69c114add0f7a6fe240b6c4a92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DefaultID.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
        • Size 3.3MB
        • SHA256 d0bc25c3c34d69915cbde951711dc33a46ceb71a5d329876c0822aefb70e9db2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PDFSigQFormalRep.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
        • Size 3.7MB
        • SHA256 eb27004e581d7331b5dbc1e1e03befee2067432a3d3ac9b0b05433669430507c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HomeBanner_Light.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
        • Size 3.3MB
        • SHA256 301a8693c564833a11bfd6efda1473110925621d6f6179a3e8ebb094957586eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Complex Machine.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
        • Size 3.4MB
        • SHA256 954d9e7e2a8f23166d626bf6cc0f916b292ca562fd0c27457a453fcb839770de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Dynamic.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
        • Size 3.3MB
        • SHA256 bcb614bcdb6a9143aa90383da10a75c2b780f475e59214c613fcff0805d7ba2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StandardBusiness.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
        • Size 3.4MB
        • SHA256 00535dfba1d2959cdf799568c19b60ba5e22b831e129c208bfb083857510b491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Words.exe
        • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
        • Size 3.4MB
        • SHA256 a589e4d120399d233d8c0ae3c87e2cbdeebe83a3d2aefb6cc09633848e9c01b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountEnable.exe
        • Path \??\c:\Program Files\DismountEnable.exe
        • Size 3.7MB
        • SHA256 b37eacc864ac45edb7b09981a635f49b904968cc7708faefe457db70a17d3e72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EditConvert.exe
        • Path \??\c:\Program Files\EditConvert.exe
        • Size 3.6MB
        • SHA256 e09e6a1a3b7124e089ffb4bfa8cbaa584c988039500313c1079b0c5cb9f90671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PROTTPLV.exe
        • Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
        • Size 3.3MB
        • SHA256 efa01cbbda0dcd5628e532f2be97da2bec30b21c84f8a88087b3e8706219b39e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SOLVSAMP.exe
        • Path \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
        • Size 3.4MB
        • SHA256 51c1a66e6879357f960ac957044b9a12bd69a12025034fd097df39b39a8bab31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MountResolve.exe
        • Path \??\c:\Program Files\MountResolve.exe
        • Size 3.7MB
        • SHA256 8f4c1731fc2e4d8d9b7143edb5cf02c125df7dc9e4ec04c1b1188d3c7a199e69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SkipApprove.exe
        • Path \??\c:\Users\Admin\AppData\Roaming\DisableReset\SkipApprove.exe
        • Size 3.6MB
        • SHA256 e22f2ce3a26abaabf5ef46e5cf6192deba8496b240a37ee5cf6cc5174ef9c665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        adobe acrobat pro dc.exe
        • Path \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sample-files\assets\sample files\adobe acrobat pro dc.exe
        • Size 3.4MB
        • SHA256 5633969656f3ea4cc5145a7f45600084c815e8103f27b2c180e1ee3cb32397b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3952-58-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-53-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-52-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-57-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-47-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-46-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-56-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-55-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-54-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download

        memory/3952-48-0x0000013D3EE60000-0x0000013D3EE61000-memory.dmp
        Download