Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im XD.exe
Modifies file system
Creates the following files
- %TEMP%\adobe temp\adobecert.reg
- %TEMP%\adobe temp\rewrite.cmd
- %TEMP%\adobe temp\setacl.exe
- %TEMP%\adobe temp\ngl-lib.dll
- %TEMP%\adobe temp\cinema 4d.exe
- %TEMP%\adobe temp\xd.exe
- %TEMP%\adobe temp\regrights.bkp
- unc\qazdelz*\mailslot\net\netlogon
Deletes the following files
- %TEMP%\adobe temp\adobecert.reg
- %TEMP%\adobe temp\cinema 4d.exe
- %TEMP%\adobe temp\ngl-lib.dll
- %TEMP%\adobe temp\regrights.bkp
- %TEMP%\adobe temp\rewrite.cmd
- %TEMP%\adobe temp\setacl.exe
- %TEMP%\adobe temp\xd.exe
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn list -lst "f:sddl;w:d,s,o" -bckp "%TEMP%\Adobe Temp\regrights.bkp"
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn setowner -ownr "n:qazdelz\user"
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn ace -ace " "n:qazdelz\user;p:full"
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn restore -bckp "%TEMP%\Adobe Temp\regrights.bkp"
- '%WINDIR%\syswow64\cmd.exe' /c VER | FIND "6.1" && IF NOT ERRORLEVEL 1 (REGEDIT /s "%TEMP%\Adobe Temp\adobecert.reg")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c CD /d "%sfxpath:~0,-20%\Adobe 2021" && START Set-up.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c IF EXIST "%ProgramFiles%\Maxon Cinema 4D R24\Cinema 4D.exe" ( REN "%ProgramFiles%\Maxon Cinema 4D R24\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "%TEMP%\Adobe Temp\Cinema 4D.exe" "%Progra...' (with hidden window)
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn list -lst "f:sddl;w:d,s,o" -bckp "%TEMP%\Adobe Temp\regrights.bkp"' (with hidden window)
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn setowner -ownr "n:qazdelz\user"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im XD.exe' (with hidden window)
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn ace -ace " "n:qazdelz\user;p:full"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Adobe Temp\rewrite.cmd" "' (with hidden window)
- '%TEMP%\adobe temp\setacl.exe' -on "%ProgramFiles%\WindowsApps" -ot file -actn restore -bckp "%TEMP%\Adobe Temp\regrights.bkp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c VER | FIND "6.1" && IF NOT ERRORLEVEL 1 (REGEDIT /s "%TEMP%\Adobe Temp\adobecert.reg")
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" VER "
- '%WINDIR%\syswow64\find.exe' "6.1"
- '%WINDIR%\syswow64\regedit.exe' /s "%TEMP%\Adobe Temp\adobecert.reg"
- '%WINDIR%\syswow64\cmd.exe' /c CD /d "%sfxpath:~0,-20%\Adobe 2021" && START Set-up.exe
- '%WINDIR%\syswow64\cmd.exe' /c IF EXIST "%ProgramFiles%\Maxon Cinema 4D R24\Cinema 4D.exe" ( REN "%ProgramFiles%\Maxon Cinema 4D R24\Cinema 4D.exe" "Cinema 4D.yes" && XCOPY /y /r "%TEMP%\Adobe Temp\Cinema 4D.exe" "%Progra...
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Adobe Temp\rewrite.cmd" "
