Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im armsvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im AGSService.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im AGMService.exe
Modifies file system
Creates the following files
- %TEMP%\acrobat temp\acrotray.exe
- %TEMP%\acrobat temp\acrobat.dll
- %TEMP%\acrobat temp\acrodistdll.dll
Deletes the following files
- <SYSTEM32>\tasks\adobe acrobat update task
- %TEMP%\acrobat temp\acrobat.dll
- %TEMP%\acrobat temp\acrodistdll.dll
- %TEMP%\acrobat temp\acrotray.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c REN "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk" "Adobe Acrobat 64-bit.lnk"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c REN "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller.lnk" "Adobe Acrobat Distiller 64-bit.lnk"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "AdobeGCInvoker-1.0"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "Adobe Acrobat Update Task"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im armsvc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im AGSService.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im AGMService.exe' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config AdobeARMservice start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config AGSService start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config AGMService start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrodistdll.dll" "acrodistdll.dll.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrodistdll.dll" "%j\acrodistdll.dll")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrotray.exe" "acrotray.exe.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrotray.exe" "%j\acrotray.exe")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\Acrobat.dll" "Acrobat.dll.bak")' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\Acrobat.dll" "%j\Acrobat.dll")' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c REN "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk" "Adobe Acrobat 64-bit.lnk"
- '%WINDIR%\syswow64\cmd.exe' /c REN "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller.lnk" "Adobe Acrobat Distiller 64-bit.lnk"
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "AdobeGCInvoker-1.0"
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn "Adobe Acrobat Update Task"
- '%WINDIR%\syswow64\sc.exe' config AdobeARMservice start= disabled
- '%WINDIR%\syswow64\sc.exe' config AGSService start= disabled
- '%WINDIR%\syswow64\sc.exe' config AGMService start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrodistdll.dll" "acrodistdll.dll.bak")
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
- '%WINDIR%\syswow64\reg.exe' QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrodistdll.dll" "%j\acrodistdll.dll")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\acrotray.exe" "acrotray.exe.bak")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\acrotray.exe" "%j\acrotray.exe")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (REN "%j\Acrobat.dll" "Acrobat.dll.bak")
- '%WINDIR%\syswow64\cmd.exe' /c FOR /f "tokens=2*" %i IN ('REG QUERY "HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC" /v InstallPath') DO IF EXIST %j (COPY /y "%TEMP%\Acrobat Temp\Acrobat.dll" "%j\Acrobat.dll")
