Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im acrotray.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AdobeCollabSync.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im armsvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im "Adobe Genuine Launcher.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AdobeCleanUpUtility.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AdobeGCClient.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AGCInvokerUtility.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AGMService.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im agshelper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AGSService.exe
Modifies file system
Creates the following files
- %TEMP%\acrobat 32-bit temp\install.cmd
- %TEMP%\acrobat 32-bit temp\acrotray.exe
- %TEMP%\acrobat 32-bit temp\adobecollabsync.exe
- %TEMP%\acrobat 32-bit temp\acrobat.dll
- %TEMP%\acrobat 32-bit temp\acrodistdll.dll
Deletes the following system files
- <SYSTEM32>\tasks\adobe acrobat update task
Deletes following files that it created itself
- %TEMP%\acrobat 32-bit temp\acrobat.dll
- %TEMP%\acrobat 32-bit temp\acrodistdll.dll
- %TEMP%\acrobat 32-bit temp\acrotray.exe
- %TEMP%\acrobat 32-bit temp\adobecollabsync.exe
- %TEMP%\acrobat 32-bit temp\install.cmd
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Acrobat 32-bit Temp\install.cmd" "%InstChk%""
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "AdobeGCInvoker-1.0"
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "Adobe-Genuine-Software-Integrity-Scheduler-1.0"
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "Adobe Acrobat Update Task"
- '%WINDIR%\syswow64\sc.exe' stop AGSService
- '%WINDIR%\syswow64\sc.exe' stop AGMService
- '%WINDIR%\syswow64\sc.exe' stop AdobeARMservice
- '%WINDIR%\syswow64\sc.exe' delete AGSService
- '%WINDIR%\syswow64\sc.exe' delete AGMService
- '%WINDIR%\syswow64\sc.exe' config AdobeARMservice start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c RMDIR /s /q "%CommonProgramFiles(x86)%\Adobe\AdobeGCClient"
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement" /v "bIsNGLLicensing" /t REG_DWORD /d "00000001" /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\Originals" /v "bDisplayedSplash" /t REG_DWORD /d "00000001" /f
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrodistdll.dll" "%jAcrobat\acrodistdll.dll.bak")
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
- '%WINDIR%\syswow64\reg.exe' QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\acrodistdll.dll" "%jAcrobat\acrodistdll.dl...
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrotray.exe" "%jAcrobat\acrotray.exe.bak")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\acrotray.exe" "%jAcrobat\acrotray.exe")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Acrobat.dll" "%jAcrobat\Acrobat.dll.bak")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\Acrobat.dll" "%jAcrobat\Acrobat.dll")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe.bak")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\AdobeCollabSync.exe" "%jAcrobat\AdobeColla...
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Adobe Crash Processor.exe" "%jAcrobat\Adobe Crash Processor...
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\Adobe Crash Processor.exe")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\CRLogTransport.exe" "%jAcrobat\CRLogTransport.exe.bak")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\CRLogTransport.exe")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\LogTransport2.exe" "%jAcrobat\LogTransport2.exe.bak")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\LogTransport2.exe")
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im acrotray.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AdobeCollabSync.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Acrobat 32-bit Temp\install.cmd" "%InstChk%""' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "AdobeGCInvoker-1.0"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "Adobe-Genuine-Software-Integrity-Scheduler-1.0"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "Adobe Acrobat Update Task"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop AGSService' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop AGMService' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop AdobeARMservice' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete AGSService' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete AGMService' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config AdobeARMservice start= disabled' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im armsvc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im "Adobe Genuine Launcher.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AdobeCleanUpUtility.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AdobeGCClient.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AGCInvokerUtility.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AGMService.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im agshelper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im AGSService.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c RMDIR /s /q "%CommonProgramFiles(x86)%\Adobe\AdobeGCClient"' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement" /v "bIsNGLLicensing" /t REG_DWORD /d "00000001" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\Originals" /v "bDisplayedSplash" /t REG_DWORD /d "00000001" /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrodistdll.dll" "%jAcrobat\acrodistdll.dll.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\acrodistdll.dll" "%jAcrobat\acrodistdll.dl...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\acrotray.exe" "%jAcrobat\acrotray.exe.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\acrotray.exe" "%jAcrobat\acrotray.exe")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Acrobat.dll" "%jAcrobat\Acrobat.dll.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\Acrobat.dll" "%jAcrobat\Acrobat.dll")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\AdobeCollabSync.exe" "%jAcrobat\AdobeCollabSync.exe.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat 32-bit Temp\AdobeCollabSync.exe" "%jAcrobat\AdobeColla...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\Adobe Crash Processor.exe" "%jAcrobat\Adobe Crash Processor...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\Adobe Crash Processor.exe")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\CRLogTransport.exe" "%jAcrobat\CRLogTransport.exe.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\CRLogTransport.exe")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (COPY /y "%jAcrobat\LogTransport2.exe" "%jAcrobat\LogTransport2.exe.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v Path') DO IF EXIST %j (DEL /q "%jAcrobat\LogTransport2.exe")' (with hidden window)
