Edit tour

Windows Analysis Report
aios3.exe

Overview

General Information

Sample name:	aios3.exe
Analysis ID:	1431848
MD5:	a1ad4d0b5f70c0bf97e5ef59e814c03d
SHA1:	583b88811550e7683916795306df383f06f08237
SHA256:	ecdc7fc83fb0574ae1b35deffe21e8e778e3e21b760469851312e7d6483a8f03
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Machine Learning detection for dropped file

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

aios3.exe (PID: 5504 cmdline: "C:\Users\user\Desktop\aios3.exe" MD5: A1AD4D0B5F70C0BF97E5EF59E814C03D)

CleanUpFilesAIOS3.exe (PID: 6904 cmdline: "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" MD5: 9907BE0D71885E21F485856B1EC1489F)

cmd.exe (PID: 6952 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ZGGKNSUKOP.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1388 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1640 --field-trial-handle=1568,i,13351684638296647614,3962373673390658352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	Virustotal: Detection: 19%			Perma Link
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe (copy)	Virustotal: Detection: 19%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A

Joe Sandbox ML: detected

Source: aios3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\aios3.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\E-Sticker

Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	File opened: C:\Users\user\AppData\Roaming\Adobe	Jump to behavior

Source: Joe Sandbox View	IP Address: 184.25.164.138 184.25.164.138
Source: Joe Sandbox View	IP Address: 23.22.254.206 23.22.254.206

Source: aios3.exe	String found in binary or memory: http://www.clickteam.com
Source: aios3.exe	String found in binary or memory: http://www.clickteam.com/pub
Source: aios3.exe	String found in binary or memory: http://www.clickteam.com/pub.bmp
Source: aios3.exe	String found in binary or memory: http://www.clickteam.comc
Source: 01369b0e-588f-48a3-93ee-1c761f7cac52.tmp.16.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: aios3.exe, 00000001.00000000.1214640044.000000000042D000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename vs aios3.exe
Source: aios3.exe, 00000001.00000003.1749291168.000000000272A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs aios3.exe
Source: aios3.exe	Binary or memory string: OriginalFilename vs aios3.exe

Source: aios3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@23/113@0/3

Source: C:\Users\user\Desktop\aios3.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe

File created: C:\Users\user\AppData\Local\Temp\afolder

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "

Source: unknown	Process created: C:\Users\user\Desktop\aios3.exe "C:\Users\user\Desktop\aios3.exe"
Source: C:\Users\user\Desktop\aios3.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe"
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ZGGKNSUKOP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1640 --field-trial-handle=1568,i,13351684638296647614,3962373673390658352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\aios3.exe	Process created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1640 --field-trial-handle=1568,i,13351684638296647614,3962373673390658352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aios3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\aios3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A			Jump to dropped file
Source: C:\Users\user\Desktop\aios3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.exe			Jump to dropped file

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	11 Process Injection	11 Process Injection	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Link
C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	15%	ReversingLabs
C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.$$A	20%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe (copy)	15%	ReversingLabs
C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe (copy)	20%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Adobe\Acrobat\E-Sticker Style 3 Uninstaller.$$A	2%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
http://www.clickteam.comc	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com	01369b0e-588f-48a3-93ee-1c761f7cac52.tmp.16.dr	false	URL Reputation: safe	unknown
http://www.clickteam.com	aios3.exe	false		high
http://www.clickteam.com/pub	aios3.exe	false		high
http://www.clickteam.com/pub.bmp	aios3.exe	false		high
http://www.clickteam.comc	aios3.exe	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
184.25.164.138	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
184.31.60.185	unknown	United States	16625	AKAMAI-ASUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431848
Start date and time:	2024-04-25 21:37:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aios3.exe
Detection:	MAL
Classification:	mal52.winEXE@23/113@0/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
184.25.164.138	ppop_verification_request.zip	Get hash	malicious	Unknown	Browse
	Proposal Invitation_ Proposal is Due by the EOB May 15.eml	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	file.pdf.download.lnk	Get hash	malicious	Unknown	Browse
	Factura_SA161.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Re_ Medina County Kitchen.eml	Get hash	malicious	Unknown	Browse
	oiDDogdK9A.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse
	New_Order.xls	Get hash	malicious	Unknown	Browse
	https://enfoldindia.org/wp-content/uploads/2019/06/Restorative-Circle-Handbook-for-CCI.pdf	Get hash	malicious	Unknown	Browse
	TaxForm.lnk	Get hash	malicious	DarkGate, MailPassView	Browse
	https://ntnusa0-my.sharepoint.com/:f:/g/personal/ajaronik_ntnusa_com/EjzRads0Sf5Ivon47-zBKVABS1TZOI64W6Uv34YFqNQjmQ?e=NuZrjr	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
23.22.254.206	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5	Get hash	malicious	Remcos	Browse
	https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2facrobat.adobe.com%2fid%2furn%3aaaid%3asc%3aVA6C2%3a2a138187%2d69c4%2d4ab4%2d842d%2dee0003585bc9&umid=48a0bf19-c23f-4ede-a21a-c8110fd2ff5e&auth=3396b606d81544f1fa36c033f23b9c9aa919296a-56125daf7e96fa7cc3eab78dc35383db072b630f	Get hash	malicious	HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:aa27f609-25f0-4828-b7d2-b06346f88949?viewer%21megaVerb=group-discover	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	phish_alert_iocp_v1.4.48 (23).eml	Get hash	malicious	STRRAT	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:US:9e302e2f-d0ed-45a9-8388-cab11cb350ef	Get hash	malicious	HTMLPhisher	Browse
	https://indd.adobe.com/view/e03d439a-e68c-479a-b4c9-7ae2413a82ff	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://indd.adobe.com/view/73bb3547-7519-45db-b904-9b659611f483	Get hash	malicious	HTMLPhisher	Browse
	https://media.muckrack.com/portfolio/items/14900624/942f7bdf8b053c2baa0b4582cbf09c88.pdf	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0 - 2023-09-18T141528.409.eml	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	Iu4a4i5N15.exe	Get hash	malicious	Unknown	Browse
184.31.60.185	ppop_verification_request.zip	Get hash	malicious	Unknown	Browse
	Factura_SA161.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	python.exe	Get hash	malicious	CobaltStrike	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	23.59.235.214
	dwn1cGHIbV.elf	Get hash	malicious	Mirai	Browse	104.73.199.214
	https://bushelman-my.sharepoint.com/:b:/p/lance/ESXtc6Laa05KpaC4W3rpMEMBfLSUU1GZhgfhBL8opRqFHg?e=Wrw3le	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.223.31.42
	[EXTERNAL] New file received.eml	Get hash	malicious	HTMLPhisher	Browse	23.47.176.131
	https://www.bing.com/////////////////////ck/a?!&&p=0533e94aab0b2a6eJmltdHM9MTcxMzQ4NDgwMCZpZ3VpZD0xNDE4NDZmNi1iZWY1LTY4NjUtMjQ0YS01MjkwYmYwZTY5ODQmaW5zaWQ9NTIyMA&ptn=3&ver=2&hsh=3&fclid=141846f6-bef5-6865-244a-5290bf0e6984&u=a1aHR0cHM6Ly9reDRrc3IuYXJ0aWNsZXdyaXRpbmdnZW5lcmF0b3IueHl6Lw#vds2aa29aYmRldmluc0B3ZS13b3JsZHdpZGUuY29t	Get hash	malicious	HTMLPhisher	Browse	23.209.84.186
	lzShU2RYJa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	https://app.frame.io/presentations/da0e116a-d15f-430f-8c37-0aa7d783720f?component_clicked=digest_call_to_action&email_id=8abc710c-c18f-47f5-a884-e927cb8dcfaa&email_type=pending-reviewer-invite	Get hash	malicious	HTMLPhisher	Browse	23.199.47.148
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	96.17.209.196
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	Vidar	Browse	96.17.209.196
AMAZON-AESUS	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	54.152.115.234
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	54.163.232.163
	http://www.mh3solaroh.com/	Get hash	malicious	HTMLPhisher	Browse	23.20.165.17
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	34.196.110.25
	ZcOjro0Chh.elf	Get hash	malicious	Mirai	Browse	34.207.187.66
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	3.214.248.84
	https://app.robly.com/sites/1550c67c312457e2bb58457f78fda912/f774d7ddfffc8f1d429cd55a95adr852d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	34.231.99.77
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	3.219.101.117
	[EXTERNAL] New file received.eml	Get hash	malicious	HTMLPhisher	Browse	107.22.247.231
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/o76fri/enpmZG9tbF9zdXBlcnZpc29yMXN0X2Fzc2lzdGFudEBmZC5vcmc=	Get hash	malicious	HTMLPhisher	Browse	23.23.165.157
BBIL-APBHARTIAirtelLtdIN	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	122.185.41.86
	ppop_verification_request.zip	Get hash	malicious	Unknown	Browse	184.25.164.138
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5	Get hash	malicious	Remcos	Browse	23.209.188.17
	Proposal Invitation_ Proposal is Due by the EOB May 15.eml	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	184.25.164.138
	file.pdf.download.lnk	Get hash	malicious	Unknown	Browse	184.25.164.138
	Factura_SA161.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse	184.25.164.138
	Ud310iQZnO.elf	Get hash	malicious	Mirai	Browse	182.74.25.30
	tWpGuzQQoW.elf	Get hash	malicious	Mirai	Browse	122.185.203.209
	kGbjOmkleq.elf	Get hash	malicious	Mirai	Browse	125.23.195.204
	iH18gdEj8Y.elf	Get hash	malicious	Mirai	Browse	125.19.93.33

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.162167420777084
Encrypted:	false
SSDEEP:	6:3UDkJ39+q2PRN2nKuAl9OmbnIFUt8MUDkcOWZmw+MUDkcFVkwORN2nKuAl9Ombjd:kwJ39+vaHAahFUt8VwLW/+VwOV5JHAae
MD5:	451B0AFD74EECAA89B81144D76652A3B
SHA1:	94EAAEF70E0A5EA34E3EE85B85B00C79B17E6792
SHA-256:	EE7B37EFF06B81C124B84D3953C4EF30226D78BCDC5B450ED1FA4B36CDF37C1C
SHA-512:	6FC13C25115102CC132F9319373100EE1F99FF6F35FFE43568A7E040EA6E35127B320E513DBB5D14F9EA711612414EF3F006E986E13B26775D873783A737DF76
Malicious:	false
Reputation:	low
Preview:	2024/04/25-21:39:04.908 dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/25-21:39:04.909 dcc Recovering log #3.2024/04/25-21:39:04.909 dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Users\user\Desktop\aios3.exe
File Type:	PDF document, version 1.6 (zip deflate encoded)
Category:	dropped
Size (bytes):	12010
Entropy (8bit):	6.637069867991827
Encrypted:	false
SSDEEP:	192:NSA4TV2Y3FaIGPNlP4hLy6DNHYQM/vy82Uo/XgmMKoXqJjckAWN9:YXTV2Y3Fa1PIpyI5YQQD2U4gmMKoXIvP
MD5:	10C4F19E214B19493F567215C356D08A
SHA1:	CADB2A2B80FD9DA9998100C195BC7BA7200B0539
SHA-256:	94D4D0D651AD1A90A174212EAB5C2FCC79CED9D276BA4AECE7F12376C3B5F8A0
SHA-512:	1BCA6E8F0CCF1D361B63D6D2852820FD3226CA95E6D97E2AEF1B41530D237D4BBBD9C79421FD5D0B39E6FF4641D1A68251F092384D9C8870CF07CB04C3905D47
Malicious:	false
Preview:	%PDF-1.6.%......12 0 obj.<</Linearized 1/L 12010/O 14/E 7560/N 1/T 11703/H [ 486 192]>>.endobj. ..25 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<86F85140E103C9498ED71684432E2157><D7A64D85EFD3F242A34533F81AE90FC7>]/Index[12 38]/Info 11 0 R/Length 72/Prev 11704/Root 13 0 R/Size 50/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`..$.3...B....P..\.@.Q n..0...sA..A.....1.&F.6..F..../...0..8.5..endstream.endobj.startxref..0..%%EOF.. ..49 0 obj.<</Filter/FlateDecode/I 128/Length 100/O 85/S 42/V 101>>stream..h.b``.f``.g...J.T......TG..87.30.2.3...<+4Q..[...!..`.F............d}..y@...R...%.d.20..C.N....I..b..endstream.endobj.13 0 obj.<</AcroForm 26 0 R/Metadata 3 0 R/Names 27 0 R/Outlines 7 0 R/Pages 9 0 R/Type/Catalog>>.endobj.14 0 obj.<</Annots 30 0 R/Contents 22 0 R/CropBox[0.0 0.0 108.0 72.0]/MediaBox[0.0 0.0 108.0 72.0]/Parent 9 0 R/Resources<<>>/Rotate 0/Tabs/W/Type/Page>>.endobj.15 0 obj.<</BBox[0.0 0.0 100.3 65.4549]/Filter/FlateDeco

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.017671892017012
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aios3.exe
File size:	295'670 bytes
MD5:	a1ad4d0b5f70c0bf97e5ef59e814c03d
SHA1:	583b88811550e7683916795306df383f06f08237
SHA256:	ecdc7fc83fb0574ae1b35deffe21e8e778e3e21b760469851312e7d6483a8f03
SHA512:	ce133490821b6fdc0ec7fda09bbce5bd8fd7bc8f7e862d0e98dca6a4867e512e9f82a68fac352e73b6918e034a010a418485dbddcf911c12dfbed083081dd4c6
SSDEEP:	6144:pdKBBpxQSZrRe1pWmYTCZLKVl+ZtMIcvtEA4NtfudlIKaD:pdKBHw8mYmZ6GMpt6budmtD
TLSH:	0154F14EA2CD80B7DE57107010A5FB373B36B7E50320DD879B58DD1A9D122668B263EB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................r...............................r...........,...........6.......Rich............PE..L....t{R...

Entrypoint:	0x41c312
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x527B74DE [Thu Nov 7 11:09:18 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	90bc04cd771dd9666e2f7a223698dc3b

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23cc8	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0x2bd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x38c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2189a	0x22000	7d428061a1e87aedeb07a31c0864a2df	False	0.544189453125	data	6.619634244891906	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x206a	0x3000	bf6993bef9c1e3bc5620078729c7a209	False	0.2957356770833333	data	4.126065908846931	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x26000	0x62a0	0x6000	5c2289dfb7982b121f5a521dbb9461b8	False	0.2709147135416667	data	3.0847317297192394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2d000	0x2bd0	0x3000	d711ca0ce3f59c8343468ddf2332f20e	False	0.4558919270833333	data	4.651834735029201	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2d2d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.4864864864864865
RT_ICON	0x2d3f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.4458092485549133
RT_ICON	0x2d960	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3467741935483871
RT_ICON	0x2dc48	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.697202166064982
RT_ICON	0x2e4f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.5490405117270789
RT_DIALOG	0x2f7b8	0x26	data	English	United States	0.8421052631578947
RT_DIALOG	0x2f7e0	0x26	data	English	United States	0.8421052631578947
RT_DIALOG	0x2f808	0x7a	data	English	United States	0.6885245901639344
RT_DIALOG	0x2f888	0x26	data	English	United States	0.8421052631578947
RT_GROUP_ICON	0x2f398	0x4c	data	English	United States	0.8157894736842105
RT_VERSION	0x2f8b0	0x320	data	English	United States	0.4325
RT_MANIFEST	0x2f3e8	0x3cb	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4881565396498455

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aios3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\01369b0e-588f-48a3-93ee-1c761f7cac52.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7124

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Windows Analysis Report
aios3.exe

DLL	Import
KERNEL32.dll	GetModuleHandleA, MoveFileExA, GetCurrentProcess, GetDriveTypeA, GetModuleFileNameA, GetVersionExA, GetVersion, CompareStringA, GetTimeZoneInformation, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, GetStringTypeW, GetStringTypeA, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetOEMCP, GetACP, FormatMessageA, LCMapStringW, LCMapStringA, IsBadWritePtr, HeapReAlloc, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetEnvironmentVariableA, GetCommandLineA, GetStartupInfoA, FileTimeToLocalFileTime, FileTimeToSystemTime, FindNextFileA, RemoveDirectoryA, MoveFileA, RtlUnwind, DeleteFileA, SetEnvironmentVariableA, CreateDirectoryA, HeapFree, HeapAlloc, HeapCompact, TerminateProcess, ExitProcess, CopyFileA, SetFileTime, OpenFile, GetFileAttributesA, SetFileAttributesA, SetErrorMode, GetPrivateProfileStringA, WritePrivateProfileStringA, LoadLibraryExA, FindResourceA, GetTickCount, GetFullPathNameA, MultiByteToWideChar, WideCharToMultiByte, GetLocalTime, GetTempPathA, GetShortPathNameA, GetExitCodeProcess, CompareStringW, GetCurrentDirectoryA, SetCurrentDirectoryA, CreateProcessA, Sleep, lstrcatA, lstrlenA, WinExec, LoadLibraryA, GetProcAddress, FreeLibrary, GetDiskFreeSpaceA, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, CloseHandle, SetFilePointer, WriteFile, ReadFile, CreateFileA, GetLastError, FindFirstFileA, FindClose, GetWindowsDirectoryA, GetCPInfo, GetSystemDirectoryA
USER32.dll	ExitWindowsEx, IsIconic, PostQuitMessage, DefWindowProcA, AdjustWindowRectEx, DialogBoxParamA, EndDialog, CheckDlgButton, SetTimer, KillTimer, SendDlgItemMessageA, GetFocus, BringWindowToTop, GetLastActivePopup, SendMessageA, GetWindow, FindWindowA, LoadCursorA, LoadIconA, PostMessageA, GetSysColor, ScreenToClient, GetWindowRect, GetDlgItem, EndPaint, BeginPaint, GetClientRect, FillRect, DrawTextA, GetSystemMetrics, GetDlgItemTextA, IsClipboardFormatAvailable, OpenClipboard, GetClipboardData, CloseClipboard, IsDlgButtonChecked, CheckRadioButton, SetFocus, GetParent, UpdateWindow, IsWindowVisible, InvalidateRect, CreateDialogParamA, RedrawWindow, PeekMessageA, GetMessageA, IsDialogMessageA, TranslateMessage, DispatchMessageA, SetDlgItemTextA, SetWindowTextA, SetWindowPos, ShowWindow, DestroyWindow, CreateWindowExA, GetWindowLongA, IsWindowEnabled, CallWindowProcA, ValidateRect, SetWindowLongA, GetClassNameA, MessageBoxA, EnableWindow, SendMessageTimeoutA, wsprintfA, RegisterClassA
GDI32.dll	CreatePalette, SetBkColor, ExtTextOutA, GetSystemPaletteEntries, AddFontResourceA, RemoveFontResourceA, GetStockObject, GetDeviceCaps, DeleteDC, DeleteObject, BitBlt, SelectObject, CreateCompatibleBitmap, CreateCompatibleDC, RealizePalette, SelectPalette, CreateHalftonePalette, CreateDIBPatternBrush, CreateSolidBrush, SetBrushOrgEx, SetStretchBltMode, StretchDIBits, CreateFontIndirectA, SetBkMode, SetTextColor
comdlg32.dll	GetOpenFileNameA
ADVAPI32.dll	RegCreateKeyExA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegCreateKeyA, RegEnumKeyExA, RegDeleteKeyA, RegCloseKey, RegDeleteValueA, RegOpenKeyA, RegSetValueExA, RegQueryValueA, RegOpenKeyExA, RegQueryValueExA
SHELL32.dll	DragQueryFileA, DragFinish, ShellExecuteA, SHBrowseForFolderA, SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, DragAcceptFiles
ole32.dll	CoGetMalloc, CoCreateInstance, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA, VerFindFileA
COMCTL32.dll

Target ID:	1
Start time:	21:38:04
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\aios3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aios3.exe"
Imagebase:	0x7ff714240000
File size:	295'670 bytes
MD5 hash:	A1AD4D0B5F70C0BF97E5EF59E814C03D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	21:38:57
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe"
Imagebase:	0x400000
File size:	57'487 bytes
MD5 hash:	9907BE0D71885E21F485856B1EC1489F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	21:38:58
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ztmp\t15594.bat" "C:\Users\user\AppData\Roaming\Adobe\Acrobat\CleanUpFilesAIOS3.exe" "
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	21:39:00
Start date:	25/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ZGGKNSUKOP.pdf"
Imagebase:	0x7ff7abb00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	15
Start time:	21:39:03
Start date:	25/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff62e1c0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	16
Start time:	21:39:04
Start date:	25/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1640 --field-trial-handle=1568,i,13351684638296647614,3962373673390658352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff62e1c0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre