| File name: | Anticloud for Adobe Creative Cloud 2018 Rev.4 .rar |
| Full analysis: | https://app.any.run/tasks/7d96d00d-f46c-49f9-957a-4515c91f27da |
| Verdict: | Malicious activity |
| Analysis date: | January 19, 2019, 15:16:58 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | EBA22D6FDD0D03CA090E9DBAE756E7C7 |
| SHA1: | AA0042A8F38CDF1B9A17D4B18FECD7DC37D5AB73 |
| SHA256: | A9AE226E96587E23071D943509DE2687D2474DF9EFB7C9A28910707C6716F889 |
| SSDEEP: | 98304:v7ipEsfN6CXjCZ1yFZm887HxNxKJ+ZUpo7ouM4Vo34gvU2sTSXI:v7isujrFM8GRN3NouMEgvJsmXI |
MALICIOUS
Application was dropped or rewritten from another process
- Adobe.CC2018.Anticloud.r4.exe (PID: 1948)
- Adobe.CC2018.Anticloud.r4.exe (PID: 3276)
- Adobe.CC2018.Anticloud.r4.exe (PID: 2188)
- Adobe.CC2018.Anticloud.r4.exe (PID: 3676)
Changes Image File Execution Options
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
Starts NET.EXE for service management
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
SUSPICIOUS
Executable content was dropped or overwritten
- Adobe.CC2018.Anticloud.r4.exe (PID: 3276)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.exe (PID: 1948)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
- Adobe.CC2018.Anticloud.r4.exe (PID: 2188)
- Adobe.CC2018.Anticloud.r4.exe (PID: 3676)
Reads Windows owner or organization settings
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
Reads the Windows organization settings
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
Creates or modifies windows services
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
Starts CMD.EXE for commands execution
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
INFO
Application was dropped or rewritten from another process
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3960)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 2832)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
Loads dropped or rewritten executable
- Adobe.CC2018.Anticloud.r4.tmp (PID: 3248)
- Adobe.CC2018.Anticloud.r4.tmp (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
73
Monitored processes
27
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 792 | "net.exe" stop SwitchBoard | C:\Windows\system32\net.exe | — | Adobe.CC2018.Anticloud.r4.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1840 | C:\Windows\system32\net1 stop AGSService | C:\Windows\system32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1948 | "C:\Users\admin\Desktop\Adobe.CC2018.Anticloud.r4.exe" /SPAWNWND=$3015A /NOTIFYWND=$30160 | C:\Users\admin\Desktop\Adobe.CC2018.Anticloud.r4.exe | Adobe.CC2018.Anticloud.r4.tmp | ||||||||||||
User: admin Company: Adobe Integrity Level: HIGH Description: Adobe Creative Clouds Anticloud Exit code: 0 Version: 10.0.0.250 Modules
| |||||||||||||||
| 2120 | C:\Windows\system32\net1 stop AdobeARMservice | C:\Windows\system32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2188 | "C:\Users\admin\Desktop\Adobe.CC2018.Anticloud.r4.exe" | C:\Users\admin\Desktop\Adobe.CC2018.Anticloud.r4.exe | explorer.exe | ||||||||||||
User: admin Company: Adobe Integrity Level: MEDIUM Description: Adobe Creative Clouds Anticloud Exit code: 0 Version: 10.0.0.250 Modules
| |||||||||||||||
| 2248 | C:\Windows\system32\net1 stop AGSService | C:\Windows\system32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2416 | "net.exe" stop AdobeUpdateService | C:\Windows\system32\net.exe | — | Adobe.CC2018.Anticloud.r4.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2500 | "cmd" /c MOVE /Y C:\Users\admin\AppData\Local\Temp\is-2JFTJ.tmp\amtlib.dll "C:\Program Files\WindowsApps\Adobe.CC.XD_7.0.12.9_x64__adky2gkssdxte" | C:\Windows\system32\cmd.exe | — | Adobe.CC2018.Anticloud.r4.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2532 | C:\Windows\system32\net1 stop SwitchBoard | C:\Windows\system32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2704 | "net.exe" stop AdobeUpdateService | C:\Windows\system32\net.exe | — | Adobe.CC2018.Anticloud.r4.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
540
Read events
492
Write events
36
Delete events
12
Modification events
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Anticloud for Adobe Creative Cloud 2018 Rev.4 .rar | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | @C:\Windows\system32\msinfo32.exe,-10001 |
Value: System Information File | |||
| (PID) Process: | (3248) Adobe.CC2018.Anticloud.r4.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: B00C0000DC03B2230AB0D401 | |||
Executable files
12
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3108 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3108.6754\Anticloud for Adobe Creative Cloud 2018 Rev.4\Adobe.CC2018.Anticloud.r4.exe | — | |
MD5:— | SHA256:— | |||
| 3248 | Adobe.CC2018.Anticloud.r4.tmp | C:\Users\admin\AppData\Local\Temp\is-2JFTJ.tmp\is-HP9JD.tmp | — | |
MD5:— | SHA256:— | |||
| 3248 | Adobe.CC2018.Anticloud.r4.tmp | C:\Users\admin\AppData\Local\Temp\is-2JFTJ.tmp\is-3566N.tmp | — | |
MD5:— | SHA256:— | |||
| 4056 | Adobe.CC2018.Anticloud.r4.tmp | C:\Users\admin\AppData\Local\Temp\is-V3004.tmp\is-CCJCB.tmp | — | |
MD5:— | SHA256:— | |||
| 4056 | Adobe.CC2018.Anticloud.r4.tmp | C:\Users\admin\AppData\Local\Temp\is-V3004.tmp\is-EMU0J.tmp | — | |
MD5:— | SHA256:— | |||
| 3276 | Adobe.CC2018.Anticloud.r4.exe | C:\Users\admin\AppData\Local\Temp\is-VVCDJ.tmp\Adobe.CC2018.Anticloud.r4.tmp | executable | |
MD5:— | SHA256:— | |||
| 1948 | Adobe.CC2018.Anticloud.r4.exe | C:\Users\admin\AppData\Local\Temp\is-39F5P.tmp\Adobe.CC2018.Anticloud.r4.tmp | executable | |
MD5:— | SHA256:— | |||
| 3248 | Adobe.CC2018.Anticloud.r4.tmp | C:\Users\admin\AppData\Local\Temp\is-2JFTJ.tmp\amtlib.dll | executable | |
MD5:— | SHA256:— | |||
| 3676 | Adobe.CC2018.Anticloud.r4.exe | C:\Users\admin\AppData\Local\Temp\is-U8IO0.tmp\Adobe.CC2018.Anticloud.r4.tmp | executable | |
MD5:— | SHA256:— | |||
| 3248 | Adobe.CC2018.Anticloud.r4.tmp | C:\Users\admin\AppData\Local\Temp\is-2JFTJ.tmp\SetACL.exe | executable | |
MD5:3E350EB5DF15C06DEC400A39DD1C6F29 | SHA256:427FF43693CB3CA2812C4754F607F107A6B2D3F5A8B313ADDEE57D89982DF419 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report