Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im armsvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im AGSService.exe
- '<SYSTEM32>\taskkill.exe' /f /im AGMService.exe
Modifies file system
Creates the following files
- %TEMP%\acrobat temp\install.cmd
- %TEMP%\acrobat temp\acrotray.exe
- %TEMP%\acrobat temp\acrobat.dll
- %TEMP%\acrobat temp\acrodistdll.dll
Deletes the following files
- <SYSTEM32>\tasks\adobe acrobat update task
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Acrobat Temp\install.cmd" "%InstChk%""
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrodistdll.dll" "acrodistdll.dll.bak")
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrotray.exe" "%j\acrotray.exe")
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrotray.exe" "acrotray.exe.bak")
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrodistdll.dll" "%j\acrodistdll.dll")
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\Acrobat.dll" "Acrobat.dll.bak")
- '<SYSTEM32>\sc.exe' config AGSService start= disabled
- '<SYSTEM32>\schtasks.exe' /delete /f /tn "Adobe Acrobat Update Task"
- '<SYSTEM32>\schtasks.exe' /delete /f /tn "AdobeGCInvoker-1.0"
- '<SYSTEM32>\sc.exe' config AdobeARMservice start= disabled
- '<SYSTEM32>\sc.exe' config AGMService start= disabled
- '<SYSTEM32>\schtasks.exe' /delete /f /tn "AdobeGCInvoker-1.0"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /f /tn "Adobe Acrobat Update Task"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Acrobat Temp\install.cmd" "%InstChk%""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrotray.exe" "acrotray.exe.bak")' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrodistdll.dll" "%j\acrodistdll.dll")' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrotray.exe" "%j\acrotray.exe")' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im armsvc.exe' (with hidden window)
- '<SYSTEM32>\sc.exe' config AGMService start= disabled' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im AGSService.exe' (with hidden window)
- '<SYSTEM32>\sc.exe' config AGSService start= disabled' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im AGMService.exe' (with hidden window)
- '<SYSTEM32>\sc.exe' config AdobeARMservice start= disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrodistdll.dll" "acrodistdll.dll.bak")' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\Acrobat.dll" "Acrobat.dll.bak")' (with hidden window)
