Overview

overview

8

Static

static

3

AdobeReade...Ha.exe

windows10-2004-x64

8

AdobeReade...Ha.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe
  • Size 4.2MB
  • Sample261113-2453lasz3n
  • SHA256 71221ba23f1fbbf032641829a09878046494e5818014cd737f054ac13cb6feeb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionransomware

Malware Config

Targets

    • Target
      AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe
    • Size 4.2MB
    • SHA256 71221ba23f1fbbf032641829a09878046494e5818014cd737f054ac13cb6feeb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionransomware

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks