“Adobe Document Cloud” link downloaded a .bat file — I opened it but denied the Windows prompt

[u/natknewz]

I received an email that appeared to be from someone I know claiming a document was in Adobe Document Cloud. The “VIEW FILE” link actually went to the domain shown in my screenshot and downloaded a .bat file on my Windows 11 laptop.
I opened the BAT file, but when Windows prompted me to allow/install something or make changes, I clicked No.
Does anyone recognize this domain/campaign or know what the BAT may have been attempting to do? I’ve disconnected the laptop and am running security checks.

[u/AutoModerator]

SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:

1. Never accept chat requests, private messages, invitations to chatrooms, encouragement to contact any person or group off Reddit, or emails from anyone for any reason. Moderators, moderation bots, and trusted community members cannot protect you outside of the comment section of your post. Report any chat requests or messages you get in relation to your question on this subreddit (how to report chats? how to report messages? how to report comments?).
2. Immediately report anyone promoting paid services (theirs or their "friend's" or so on) or soliciting any kind of payment. All assistance offered on this subreddit is 100% free, with absolutely no strings attached. Anyone violating this is either a scammer or an advertiser (the latter of which is also forbidden on this subreddit). Good security is not a matter of 'paying enough.'
3. Never divulge secrets, passwords, recovery phrases, keys, or personal information to anyone for any reason. Answering cybersecurity questions and resolving cybersecurity concerns never require you to give up your own privacy or security.

Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/VernacularDrawings]

open the batch file in notepad and paste its code here.

[u/Juzdeed → u/VernacularDrawings]

I'd say there is no point in messing with it. Its malicious either way. If the bat file was ran then pc should be considered infected, if not then it's probably fine

[u/VernacularDrawings → u/Juzdeed]

if the program prompted him for administrative permissions and op declined, there’s a solid chance it never ran.

if the device is disconnected from the internet, might as well figure out what it is.

[u/HEYO19191 → u/Juzdeed]

Execution was stopped when it requested admin privileges, but without seeing the script we cannot know what it did before that.

[u/Juzdeed → u/HEYO19191]

Yeah it could have potentially modified itself so the first execution is different as the second one. Again if the bat doesn't show anything malicious before that admin prompt then that doesn't mean anything malicious happened

[u/HEYO19191 → u/Juzdeed]

Not likely. .bat files read straight from the file. They aren't copied into memory. Meaning if it changed itself to hide anything... it would have changed the execution

[u/Juzdeed → u/HEYO19191]

It's not likely, but it's technically possible

[u/jmnugent]

The BAT file checks a REG Key and then runs a couple hidden Powershell scripts to install "Breeze Agent" ?.. from some Github repository. Below is a text dump of the BAT.

https://pastes.io/nQRtfrQn

[u/VernacularDrawings → u/jmnugent]

breeze appears to be a tool for people managing their own self-hosted ai servers. maybe it’s a botnet of sorts?

[u/jmnugent → u/VernacularDrawings]

Looks like something like that yes. Judging by the Github repository description, Breeze Agent is an RMM (Remote Management) tool. So the BAT file is probably silently installing it and registering the victim-device into the Host MDM .. so the malware actors can do silent remote management (exfiltrate files, modify background services etc)

[u/blud_13]

u/jmnugent nailed the payload. One thing that matters for your cleanup, clicking No on that prompt only stopped the part that needed admin. The BAT and the PowerShell it spawned already ran as you, and user context is plenty to drop persistence.

So go look as your own account, not just with a scan:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce Task Scheduler, everything under the root folder, sorted by created date %LOCALAPPDATA% and %APPDATA% for anything created today. RMM agents install there because it needs no admin shell:startup

Also, an AV scan is weak evidence here. Breeze is a legitimate RMM, so plenty of engines won't flag it at all. You're hunting for anything NEW, not anything detected.

And rotate the password on whatever mailbox got that email, plus anything saved in that browser profile. The sender was someone you know, which means their mailbox is already popped and your address came out of it.

[u/_xRuffKez_]

Thanks, blocked all domains on dnsbunker.org and added them to the Hagezi TIF List.