Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Adobe Unlicensed Pop-up" dir=out action=block remoteip=52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5...
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\adobe temp\blockips.cmd
- nul
Deletes the following files
- %TEMP%\adobe temp\blockips.cmd
Network activity
UDP
- DNS ASK ad##e.io
- DNS ASK 84.###.#51.205.in-addr.arpa
- DNS ASK ns####.awsdns-42.com
- DNS ASK 11#.###.#51.205.in-addr.arpa
- DNS ASK ns#####.awsdns-14.co.uk
- DNS ASK 3u######bj.adobestats.io
- DNS ASK ns#####.awsdns-48.org
- DNS ASK ad###stats.io
- DNS ASK 67.###.#51.205.in-addr.arpa
- DNS ASK ns###.awsdns-08.com
- DNS ASK 90.###.#51.205.in-addr.arpa
- DNS ASK ns#####.awsdns-43.co.uk
- DNS ASK 13#.###.#51.205.in-addr.arpa
- DNS ASK ns#####.awsdns-16.org
- DNS ASK 23#.###.#51.205.in-addr.arpa
- DNS ASK ns#####.awsdns-61.net
- DNS ASK ns####.awsdns-56.net
- DNS ASK 19#.###.#51.205.in-addr.arpa
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adobe Temp\BlockIPs.cmd" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c IF DEFINED InstChk ( START "" "<Current directory>\..\Set-up.exe" )' (with hidden window)
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adobe Temp\BlockIPs.cmd" "
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-1415.awsdns-48.org|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-1415.awsdns-48.org
- '<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.40,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,"
- '<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.27,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,"
- '<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.90,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,"
- '<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.111,"
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-1654.awsdns-14.co.uk|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-1654.awsdns-14.co.uk
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,"
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-340.awsdns-42.com|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-340.awsdns-42.com
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-962.awsdns-56.net|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-962.awsdns-56.net
- '<SYSTEM32>\findstr.exe' /l /c:",34.##3.227.236,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,"
- '<SYSTEM32>\findstr.exe' /l /c:",10#.#2.247.231,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,10#.#2.247.231,"
- '<SYSTEM32>\findstr.exe' /l /c:",18.##7.85.246,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,10#.#2.247.231,18.##7.85.246,"
- '<SYSTEM32>\findstr.exe' /l /c:",54.##4.73.197,"
- '<SYSTEM32>\nslookup.exe' -type=ns adobestats.io 8.#.8.8
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,10#.#2.247.231,18.##7.85.246,54.##4.73.197,"
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup -type=ns adobestats.io 8.#.8.8|findstr /i /l /c:"nameserver = "
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-67.awsdns-08.com|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="Adobe Unlicensed Pop-up" dir=out
- '<SYSTEM32>\ping.exe' -4 -n 2 8.#.8.8
- '<SYSTEM32>\findstr.exe' /i /l /c:"TTL="
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup -type=ns adobe.io 8.#.8.8|findstr /i /l /c:"nameserver = "
- '<SYSTEM32>\nslookup.exe' -type=ns adobe.io 8.#.8.8
- '<SYSTEM32>\findstr.exe' /i /l /c:"nameserver = "
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-1001.awsdns-61.net|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\nslookup.exe' adobe.io ns-1001.awsdns-61.net
- '<SYSTEM32>\findstr.exe' /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"
- '<SYSTEM32>\findstr.exe' /i /v /c:"Address:"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,"
- '<SYSTEM32>\findstr.exe' /l /c:",52.##2.204.11,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,"
- '<SYSTEM32>\findstr.exe' /l /c:",54.##7.187.23,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,"
- '<SYSTEM32>\findstr.exe' /l /c:",52.#.13.197,"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,"
- '<SYSTEM32>\findstr.exe' /l /c:",23.##.254.206,"
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-1159.awsdns-16.org|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\nslookup.exe' adobe.io ns-1159.awsdns-16.org
- '<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,"
- '<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-1882.awsdns-43.co.uk|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
- '<SYSTEM32>\nslookup.exe' adobe.io ns-1882.awsdns-43.co.uk
- '<SYSTEM32>\nslookup.exe' adobe.io ns-67.awsdns-08.com
- '<SYSTEM32>\cmd.exe' /c IF DEFINED InstChk ( START "" "<Current directory>\..\Set-up.exe" )
