eb642a90bfe0b537c3d87a2449a6b2817401ef9c273f95d7617f886a3e003f90

Resubmissions

16-03-2021 18:01

210316-trddssyj5s 10

16-03-2021 17:35

210316-s74c3lhrtn 8

Analysis

max time kernel
91s
max time network
94s
platform
windows7_x64
resource
win7v20201028
submitted
16-03-2021 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe
Size

117.6MB
MD5

015fd4bc87666d454f1517b2970dc097
SHA1

88685aaaba4297deef30ac4fe9bd065baa7c0c0d
SHA256

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d
SHA512

ed3378510720b92fa77098c4d48763ea04e52c63bbbf074b711e16ef781281314dad6a7e0d3069bf0cd7598c1ea426b6effabd691ae0a945e79144afdd153637

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmpPDFescape_Desktop_Installer.exePDFescapeDesktopInstaller.exe

pid	process
2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
1576	PDFescape_Desktop_Installer.exe
1164	PDFescapeDesktopInstaller.exe

Loads dropped DLL 9 IoCs

Processes:

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exeaa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmpregsvr32.exePDFescape_Desktop_Installer.exeDllHost.exe

pid	process
1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe
2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
944	regsvr32.exe
1576	PDFescape_Desktop_Installer.exe
1576	PDFescape_Desktop_Installer.exe
1576	PDFescape_Desktop_Installer.exe
1816	DllHost.exe
1576	PDFescape_Desktop_Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

regsvr32.exePDFescapeDesktopInstaller.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{188419DA-30AB-4A88-BC26-66A045E23263}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67}\ = "IDownloadItemExternalApp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77A0A704-0000-4B96-B6F6-B635028FDFA4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF3B4C08-D200-47C9-A396-689B8704BC9A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F7470C-0000-4762-9613-155654B24238}\AppID = "{2BC47158-F746-4E22-B116-D481B09E9674}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8B6481C-0000-4643-989B-7D163445E1DD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C753468E-0000-46FA-B49D-C133BC303D3B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{322C09B5-0000-4267-8909-976D51F2FC41}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57F9206E-944A-444B-B993-9D356DAEF36C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF3B4C08-D200-47C9-A396-689B8704BC9A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29CF5B0B-0000-4C5E-AAE0-B91F4FD87378}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2F9E253B-E274-4714-AE58-E879196F7E37}	PDFescapeDesktopInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEAB94F-0000-43AF-8408-C9BA782BF5D4}\LocalServer32\ = "\"C:\\ProgramData\\PDFescape Desktop\\Installation\\PDFescapeDesktopInstaller.exe\""	PDFescapeDesktopInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F7470C-0000-4762-9613-155654B24238}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77A0A704-0000-4B96-B6F6-B635028FDFA4}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{40FA2F96-0000-4F05-84D8-C1256EAB70A0}\ = "IDownloadItemToolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7335C66-0000-4AC7-9E60-1E7BFE06708C}\1.0\0\win32	PDFescapeDesktopInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4BD66CEF-B189-4A0E-B5B4-497510EEA230}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}\1.0\ = "Statistics"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB858205-0000-4418-8924-5D16D15EFD6C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A92F07A1-0000-40B0-AF9F-CCEFA34AB08E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{817163EF-0000-42BE-9A69-39AAF2E71D80}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\ = "IStatist"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0179B7E8-0000-48EB-A99B-B1337DEB7F1E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77CDE36D-0000-4223-8E25-3FFD866B17E8}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\AppID = "{2BC47158-F746-4E22-B116-D481B09E9674}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9981C967-0000-4633-8737-F55C3CC344B0}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8B6481C-0000-4643-989B-7D163445E1DD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF3B4C08-D200-47C9-A396-689B8704BC9A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9242C198-0000-4F73-935D-1C7905796C67}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\ = "DownloadItemModule Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58D07BB6-0000-4544-8064-3DB60EEDCF7B}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{40FA2F96-0000-4F05-84D8-C1256EAB70A0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0179B7E8-0000-48EB-A99B-B1337DEB7F1E}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8B6481C-0000-4643-989B-7D163445E1DD}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C753468E-0000-46FA-B49D-C133BC303D3B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37DD0F6C-0000-46F2-8B21-3E4AB4750AFF}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{40FA2F96-0000-4F05-84D8-C1256EAB70A0}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2BC47158-F746-4E22-B116-D481B09E9674}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9242C198-0000-4F73-935D-1C7905796C67}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\ = "DownloadItemMonetization Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2F518D6-0000-4360-A019-3409E7ADC462}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09C4B9DD-0000-459D-934A-25EC1D0B234A}\Version	regsvr32.exe

Modifies system certificate store 2 TTPs 9 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

PDFescape_Desktop_Installer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	PDFescape_Desktop_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	PDFescape_Desktop_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	PDFescape_Desktop_Installer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

PDFescape_Desktop_Installer.exe

pid process

1576 PDFescape_Desktop_Installer.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

msiexec.exe

description pid process

Token: SeRestorePrivilege 1124 msiexec.exe
Token: SeTakeOwnershipPrivilege 1124 msiexec.exe
Token: SeSecurityPrivilege 1124 msiexec.exe

pid	process
1576	PDFescape_Desktop_Installer.exe

description	pid	process
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeSecurityPrivilege	1124	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exeaa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmpPDFescape_Desktop_Installer.exe

description	pid	process	target process
PID 1652 wrote to memory of 2044	1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1652 wrote to memory of 2044	1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1652 wrote to memory of 2044	1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1652 wrote to memory of 2044	1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1652 wrote to memory of 2044	1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1652 wrote to memory of 2044	1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1652 wrote to memory of 2044	1652	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 2044 wrote to memory of 1576	2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 2044 wrote to memory of 1576	2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 2044 wrote to memory of 1576	2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 2044 wrote to memory of 1576	2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 2044 wrote to memory of 1576	2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 2044 wrote to memory of 1576	2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 2044 wrote to memory of 1576	2044	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1576 wrote to memory of 944	1576	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1576 wrote to memory of 944	1576	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1576 wrote to memory of 944	1576	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1576 wrote to memory of 944	1576	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1576 wrote to memory of 944	1576	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1576 wrote to memory of 944	1576	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1576 wrote to memory of 944	1576	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1576 wrote to memory of 1164	1576	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1576 wrote to memory of 1164	1576	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1576 wrote to memory of 1164	1576	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1576 wrote to memory of 1164	1576	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1576 wrote to memory of 1164	1576	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1576 wrote to memory of 1164	1576	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1576 wrote to memory of 1164	1576	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe

C:\Users\Admin\AppData\Local\Temp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe
"C:\Users\Admin\AppData\Local\Temp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\is-E1OLC.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
"C:\Users\Admin\AppData\Local\Temp\is-E1OLC.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp" /SL5="$6015C,122284744,999424,C:\Users\Admin\AppData\Local\Temp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\is-PB05P.tmp\PDFescape_Desktop_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\is-PB05P.tmp\PDFescape_Desktop_Installer.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll"
4⤵
- Loads dropped DLL
- Modifies registry class
PID:944

C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
"C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe" /RegServer
4⤵
- Executes dropped EXE
- Modifies registry class
PID:1164

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{2BC47158-F746-4E22-B116-D481B09E9674}
1⤵
- Loads dropped DLL
PID:1816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
61a03d15cf62612f50b74867090dbe79

SHA1
15228f34067b4b107e917bebaf17cc7c3c1280a8

SHA256
f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d

SHA512
5fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
5cf73b4265dd3151f894960d425d6968

SHA1
1d11518c8136c9f0a69e4e93342d232548e30558

SHA256
59bd9dc48edd054106b892c900d115cfab04fa8cbbf649530419b1364a1213c8

SHA512
0bb4c351b985f6e678d34bf7062e94367893ad81d0bdb38e68fea4d7be0a0f64b24bdaa6485c8d49027e14733972056c3cac775565072286c6d2836074b5c74c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E1OLC.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
MD5
44409fb9ddb085ddb1b297f03f2bf7da

SHA1
6214c05499c5ce029680c02c5ee793bfe8879ffa

SHA256
87eea015c65b155888b9c66e16126e22898a72897e2a7dcfb4043bce15ed3015

SHA512
9be0a889ae901806bd38747a6634c4dfb7cb12ec99f8a9a2cbffc017cb50e345377273f80a46ee8157a3b8d9073b59fbba4e73a79c1d2b9c60d55651987e5d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PB05P.tmp\PDFescape_Desktop_Installer.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PB05P.tmp\PDFescape_Desktop_Installer.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\Users\Admin\AppData\Local\Temp\is-E1OLC.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
MD5
44409fb9ddb085ddb1b297f03f2bf7da

SHA1
6214c05499c5ce029680c02c5ee793bfe8879ffa

SHA256
87eea015c65b155888b9c66e16126e22898a72897e2a7dcfb4043bce15ed3015

SHA512
9be0a889ae901806bd38747a6634c4dfb7cb12ec99f8a9a2cbffc017cb50e345377273f80a46ee8157a3b8d9073b59fbba4e73a79c1d2b9c60d55651987e5d99

Download Submit
\Users\Admin\AppData\Local\Temp\is-PB05P.tmp\PDFescape_Desktop_Installer.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
\Users\Admin\AppData\Local\Temp\is-PB05P.tmp\_isetup\_isdecmp.dll
MD5
c6ae924ad02500284f7e4efa11fa7cfc

SHA1
2a7770b473b0a7dc9a331d017297ff5af400fed8

SHA256
31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26

SHA512
f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae

Download Submit
memory/268-14-0x000007FEF63C0000-0x000007FEF663A000-memory.dmp

Filesize
2.5MB

Download
memory/944-16-0x0000000000000000-mapping.dmp

Download
memory/1124-30-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1164-21-0x0000000000000000-mapping.dmp

Download
memory/1576-11-0x0000000000000000-mapping.dmp

Download
memory/1652-2-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1652-4-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2044-9-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2044-5-0x0000000000000000-mapping.dmp

Download