82b3eba4774fa1c3defb060b52d7957842f453fb46ae9811f8f40448f84c6a9d

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe
Size 32.8MB
Sample261001-xt4dsswgne
SHA256 82b3eba4774fa1c3defb060b52d7957842f453fb46ae9811f8f40448f84c6a9d
MD5 0964a985714e9d30a4cf361bee0c1dce
SHA1 297d60702e197dffdfa3ae40a6f69d6e9bd18b17
SHA512 79bd8005e3f4961929c975214daff32099954edda8a9f58ca3a74334e6c778d643f9a04dcbf5c61b515a1a995d9045d1eceefd7136569cec6cf6db49849f9422
SSDEEP 786432:8rzenuc8zGK1RlrK50/dGEClgytNo/BDpxFIJzs0y1a:QKnuc8qKw50/P17BlTIxyM
TLSH
T13D7733123B54C636DA645A72DD5783F91638EE00CB40CB4773C17F0B7EF23A666A8296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2712	sc.exe
3872	sc.exe
3164	sc.exe
1136	sc.exe
5688	sc.exe
5112	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3176	cmd.exe
3932	cmd.exe
5176	cmd.exe
4608	cmd.exe
4648	cmd.exe
500	cmd.exe
5404	cmd.exe
4868	cmd.exe
5856	cmd.exe
3288	cmd.exe
760	cmd.exe
4828	cmd.exe
2740	cmd.exe
1952	cmd.exe
2340	cmd.exe
4804	cmd.exe
2472	cmd.exe
1172	cmd.exe
4656	cmd.exe
1804	cmd.exe
5368	cmd.exe
3436	cmd.exe
4488	cmd.exe
796	cmd.exe
3940	cmd.exe
5580	cmd.exe
5248	cmd.exe
4016	cmd.exe
5192	cmd.exe
1140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
3696	taskkill.exe
1840	taskkill.exe
3884	taskkill.exe
1212	taskkill.exe
972	taskkill.exe
908	taskkill.exe
4308	taskkill.exe
1168	taskkill.exe
5712	taskkill.exe
752	taskkill.exe
4940	taskkill.exe
1884	taskkill.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	taskkill.exe
Token: SeDebugPrivilege	1168	taskkill.exe
Token: SeDebugPrivilege	1840	taskkill.exe
Token: SeDebugPrivilege	5712	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3696	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	89
PID 2296 wrote to memory of 1168	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	92
PID 2296 wrote to memory of 2724	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	94
PID 2724 wrote to memory of 2740	2724	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	95
PID 2740 wrote to memory of 4016	2740	cmd.exe	97
PID 4016 wrote to memory of 5920	4016	cmd.exe	98
PID 2296 wrote to memory of 4636	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	99
PID 2296 wrote to memory of 5884	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	101
PID 2296 wrote to memory of 5260	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	103
PID 2296 wrote to memory of 2712	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	105
PID 2296 wrote to memory of 3872	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	107
PID 2296 wrote to memory of 3164	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	109
PID 2296 wrote to memory of 1136	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	111
PID 2296 wrote to memory of 5688	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	113
PID 2296 wrote to memory of 5112	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	115
PID 2296 wrote to memory of 1840	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	117
PID 2296 wrote to memory of 5712	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	119
PID 2296 wrote to memory of 752	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	121
PID 2296 wrote to memory of 4940	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	123
PID 2296 wrote to memory of 3884	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	125
PID 2296 wrote to memory of 1212	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	127
PID 2296 wrote to memory of 1884	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	129
PID 2296 wrote to memory of 972	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	131
PID 2296 wrote to memory of 3372	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	133
PID 2296 wrote to memory of 4004	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	135
PID 2296 wrote to memory of 4460	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	137
PID 2296 wrote to memory of 2188	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	139
PID 2296 wrote to memory of 908	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	141
PID 2296 wrote to memory of 4308	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	143
PID 2296 wrote to memory of 5192	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	145
PID 5192 wrote to memory of 1804	5192	cmd.exe	147
PID 1804 wrote to memory of 3276	1804	cmd.exe	148
PID 2296 wrote to memory of 5368	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	149
PID 5368 wrote to memory of 3176	5368	cmd.exe	151
PID 3176 wrote to memory of 5748	3176	cmd.exe	152
PID 2296 wrote to memory of 3932	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	153
PID 3932 wrote to memory of 3288	3932	cmd.exe	155
PID 3288 wrote to memory of 4524	3288	cmd.exe	156
PID 2296 wrote to memory of 760	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	157
PID 760 wrote to memory of 4804	760	cmd.exe	159
PID 4804 wrote to memory of 3508	4804	cmd.exe	160
PID 2296 wrote to memory of 5176	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	161
PID 5176 wrote to memory of 5404	5176	cmd.exe	163
PID 5404 wrote to memory of 2764	5404	cmd.exe	164
PID 2296 wrote to memory of 2472	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	165
PID 2472 wrote to memory of 1952	2472	cmd.exe	167
PID 1952 wrote to memory of 8	1952	cmd.exe	168
PID 2296 wrote to memory of 4868	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	169
PID 4868 wrote to memory of 4828	4868	cmd.exe	171
PID 4828 wrote to memory of 4824	4828	cmd.exe	172
PID 2296 wrote to memory of 3436	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	173
PID 3436 wrote to memory of 4608	3436	cmd.exe	175
PID 4608 wrote to memory of 3228	4608	cmd.exe	176
PID 2296 wrote to memory of 4488	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	177
PID 4488 wrote to memory of 796	4488	cmd.exe	179
PID 796 wrote to memory of 3440	796	cmd.exe	180
PID 2296 wrote to memory of 2340	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	181
PID 2340 wrote to memory of 3940	2340	cmd.exe	183
PID 3940 wrote to memory of 4912	3940	cmd.exe	184
PID 2296 wrote to memory of 5856	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	185
PID 5856 wrote to memory of 1140	5856	cmd.exe	187
PID 1140 wrote to memory of 2448	1140	cmd.exe	188
PID 2296 wrote to memory of 1172	2296	2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe	189
PID 1172 wrote to memory of 5580	1172	cmd.exe	191

C:\Users\Admin\AppData\Local\Temp\2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im acrotray.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCollabSync.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_0964a985714e9d30a4cf361bee0c1dce_elex_wannacry.exe" -sfxwaitall:1 "install.cmd" "%InstChk%"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Acrobat 32-bit Temp\install.cmd" "%InstChk%""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4016
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "AdobeGCInvoker-1.0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4636
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Adobe-Genuine-Software-Integrity-Scheduler-1.0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5884
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Adobe Acrobat Update Task"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5260
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" stop AGSService
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" stop AGMService
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3872
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" stop AdobeARMservice
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3164
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" delete AGSService
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" delete AGMService
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5688
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" config AdobeARMservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5112
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im armsvc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im "Adobe Genuine Launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5712
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCleanUpUtility.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeGCClient.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGCInvokerUtility.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGMService.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im agshelper.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AGSService.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c RMDIR /s /q "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c RMDIR /s /q "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement" /v "bIsNGLLicensing" /t REG_DWORD /d "00000001" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\Originals" /v "bDisplayedSplash" /t REG_DWORD /d "00000001" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im acrotray.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im AdobeCollabSync.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrodistdll.dll" "%jAcrobat\acrodistdll.dll.bak")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      PID:3276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat 32-bit Temp\acrodistdll.dll" "%jAcrobat\acrodistdll.dll")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrotray.exe" "%jAcrobat\acrotray.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat 32-bit Temp\acrotray.exe" "%jAcrobat\acrotray.exe")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Acrobat.dll" "%jAcrobat\Acrobat.dll.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:2764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat 32-bit Temp\Acrobat.dll" "%jAcrobat\Acrobat.dll")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:8
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:4824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "C:\Users\Admin\AppData\Local\Temp\Acrobat 32-bit Temp\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:3228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Adobe Crash Processor.exe" "%jAcrobat\Adobe Crash Processor.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\Adobe Crash Processor.exe")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\CRLogTransport.exe" "%jAcrobat\CRLogTransport.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\CRLogTransport.exe")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5580
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:4024
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\LogTransport2.exe" "%jAcrobat\LogTransport2.exe.bak")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4648
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:1116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\LogTransport2.exe")
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
      4⤵
      System Location Discovery: System Language Discovery
      PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

install.cmd

Path C:\Users\Admin\AppData\Local\Temp\Acrobat 32-bit Temp\install.cmd
Size 405B
SHA256 242401a21f83a353fab490f18639664a6f6bf8300634211b866db2682e588598
MD5 aa0dafa16870e1ec5e217b4f7e0fe493
SHA1 2b8d0620f69109755216a50c0d2067aeb205c05a
SHA512 96e3ef5e1861a42b3e4329b836932edff6a9014f7f363155e53a9e0742ffa5b7b8771a68e725fb0fb320d4c6117277c572b8852dc9cb97464fd4527820754e10
TLSH
T1B3E02B0E8968388165D59372ABC14C49A39EE59C255726908FEF646AF92092532DB4C1
MD5 SHA1 SHA512 TLSH

Submit Download