eb642a90bfe0b537c3d87a2449a6b2817401ef9c273f95d7617f886a3e003f90

Resubmissions

16-03-2021 18:01

210316-trddssyj5s 10

16-03-2021 17:35

210316-s74c3lhrtn 8

Analysis

max time kernel
18s
max time network
83s
platform
windows7_x64
resource
win7v20201028
submitted
16-03-2021 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmpPDFescape_Desktop_Installer.exePDFescapeDesktopInstaller.exe

pid	process
1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
1784	PDFescape_Desktop_Installer.exe
676	PDFescapeDesktopInstaller.exe

Loads dropped DLL 9 IoCs

Processes:

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exeaa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmpregsvr32.exePDFescape_Desktop_Installer.exeDllHost.exe

pid	process
1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe
1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
992	regsvr32.exe
1784	PDFescape_Desktop_Installer.exe
1784	PDFescape_Desktop_Installer.exe
1784	PDFescape_Desktop_Installer.exe
1860	DllHost.exe
1784	PDFescape_Desktop_Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

regsvr32.exePDFescapeDesktopInstaller.exePDFescape_Desktop_Installer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58996E59-0000-4D4E-8CEE-5B22F2107655}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7F592843-0000-4833-9F47-F7332F3CB3F8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09C4B9DD-0000-459D-934A-25EC1D0B234A}\InprocServer32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\Statistics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F7470C-0000-4762-9613-155654B24238}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D55E627-0000-4791-9C81-0222A629540B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7335C66-0000-4AC7-9E60-1E7BFE06708C}\1.0\0\win32	PDFescapeDesktopInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C0CF171-88CC-47E5-AB25-C93AFC0E7F9A}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEAB94F-0000-43AF-8408-C9BA782BF5D4}	PDFescapeDesktopInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56A7C619-0000-4540-A77A-0C6E518E7530}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37DD0F6C-0000-46F2-8B21-3E4AB4750AFF}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57F9206E-944A-444B-B993-9D356DAEF36C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF3B4C08-D200-47C9-A396-689B8704BC9A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0179B7E8-0000-48EB-A99B-B1337DEB7F1E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58996E59-0000-4D4E-8CEE-5B22F2107655}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD0188E8-0000-49D3-BF36-2B1DB153CEC3}\ = "IInstallItemsList"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{322C09B5-0000-4267-8909-976D51F2FC41}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67}\ = "IDownloadItemExternalApp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67}\ = "IDownloadItemExternalApp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B070A15F-0000-411C-BAA4-424264999487}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D55E627-0000-4791-9C81-0222A629540B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD0188E8-0000-49D3-BF36-2B1DB153CEC3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{322C09B5-0000-4267-8909-976D51F2FC41}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2F518D6-0000-4360-A019-3409E7ADC462}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7335C66-0000-4AC7-9E60-1E7BFE06708C}	PDFescapeDesktopInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09C4B9DD-0000-459D-934A-25EC1D0B234A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\InprocServer32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\Statistics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2F518D6-0000-4360-A019-3409E7ADC462}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A92F07A1-0000-40B0-AF9F-CCEFA34AB08E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C0CF171-88CC-47E5-AB25-C93AFC0E7F9A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEAB94F-0000-43AF-8408-C9BA782BF5D4}\TypeLib	PDFescapeDesktopInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\AppID = "{2BC47158-F746-4E22-B116-D481B09E9674}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C190A609-0000-4E00-B902-A894C0FA44E5}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{817163EF-0000-42BE-9A69-39AAF2E71D80}\InprocServer32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\Statistics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB858205-0000-4418-8924-5D16D15EFD6C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7335C66-0000-4AC7-9E60-1E7BFE06708C}\1.0\ = "GlamInstallerComLib"	PDFescapeDesktopInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7335C66-0000-4AC7-9E60-1E7BFE06708C}\1.0\HELPDIR	PDFescapeDesktopInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A1BB700-0000-4156-A8FA-3DD1DFBCD933}\ProxyStubClsid32	PDFescapeDesktopInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{668B5746-0000-48B2-9F2F-FD748595F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	PDFescapeDesktopInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56A7C619-0000-4540-A77A-0C6E518E7530}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}\1.0\HELPDIR\ = "C:\\ProgramData\\PDFescape Desktop\\Installation"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2F9E253B-E274-4714-AE58-E879196F7E37}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	PDFescape_Desktop_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77CDE36D-0000-4223-8E25-3FFD866B17E8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11A590C-0000-4C63-8E93-279E07FA7F96}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58996E59-0000-4D4E-8CEE-5B22F2107655}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4CB4452-0000-4D69-B194-10F00E72CF6B}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}\ = "IStartDataStruct"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB858205-0000-4418-8924-5D16D15EFD6C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40FA2F96-0000-4F05-84D8-C1256EAB70A0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77A0A704-0000-4B96-B6F6-B635028FDFA4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E81AD0B-0000-4107-9058-7CC9F66ACAA8}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C190A609-0000-4E00-B902-A894C0FA44E5}\InprocServer32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\Statistics.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\Version\ = "1.0"	regsvr32.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

PDFescape_Desktop_Installer.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	PDFescape_Desktop_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	PDFescape_Desktop_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	PDFescape_Desktop_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	PDFescape_Desktop_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	PDFescape_Desktop_Installer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

PDFescape_Desktop_Installer.exe

pid process

1784 PDFescape_Desktop_Installer.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

msiexec.exe

description pid process

Token: SeRestorePrivilege 1688 msiexec.exe
Token: SeTakeOwnershipPrivilege 1688 msiexec.exe
Token: SeSecurityPrivilege 1688 msiexec.exe

pid	process
1784	PDFescape_Desktop_Installer.exe

description	pid	process
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeSecurityPrivilege	1688	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exeaa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmpPDFescape_Desktop_Installer.exe

description	pid	process	target process
PID 1740 wrote to memory of 1204	1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1740 wrote to memory of 1204	1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1740 wrote to memory of 1204	1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1740 wrote to memory of 1204	1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1740 wrote to memory of 1204	1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1740 wrote to memory of 1204	1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1740 wrote to memory of 1204	1740	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
PID 1204 wrote to memory of 1784	1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1204 wrote to memory of 1784	1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1204 wrote to memory of 1784	1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1204 wrote to memory of 1784	1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1204 wrote to memory of 1784	1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1204 wrote to memory of 1784	1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1204 wrote to memory of 1784	1204	aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp	PDFescape_Desktop_Installer.exe
PID 1784 wrote to memory of 992	1784	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1784 wrote to memory of 992	1784	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1784 wrote to memory of 992	1784	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1784 wrote to memory of 992	1784	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1784 wrote to memory of 992	1784	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1784 wrote to memory of 992	1784	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1784 wrote to memory of 992	1784	PDFescape_Desktop_Installer.exe	regsvr32.exe
PID 1784 wrote to memory of 676	1784	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1784 wrote to memory of 676	1784	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1784 wrote to memory of 676	1784	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1784 wrote to memory of 676	1784	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1784 wrote to memory of 676	1784	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1784 wrote to memory of 676	1784	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe
PID 1784 wrote to memory of 676	1784	PDFescape_Desktop_Installer.exe	PDFescapeDesktopInstaller.exe

C:\Users\Admin\AppData\Local\Temp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe
"C:\Users\Admin\AppData\Local\Temp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\is-DIUU2.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DIUU2.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp" /SL5="$30104,122284744,999424,C:\Users\Admin\AppData\Local\Temp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\is-39CEB.tmp\PDFescape_Desktop_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\is-39CEB.tmp\PDFescape_Desktop_Installer.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll"
4⤵
- Loads dropped DLL
- Modifies registry class
PID:992

C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
"C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe" /RegServer
4⤵
- Executes dropped EXE
- Modifies registry class
PID:676

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{2BC47158-F746-4E22-B116-D481B09E9674}
1⤵
- Loads dropped DLL
PID:1860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-39CEB.tmp\PDFescape_Desktop_Installer.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-39CEB.tmp\PDFescape_Desktop_Installer.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DIUU2.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
MD5
44409fb9ddb085ddb1b297f03f2bf7da

SHA1
6214c05499c5ce029680c02c5ee793bfe8879ffa

SHA256
87eea015c65b155888b9c66e16126e22898a72897e2a7dcfb4043bce15ed3015

SHA512
9be0a889ae901806bd38747a6634c4dfb7cb12ec99f8a9a2cbffc017cb50e345377273f80a46ee8157a3b8d9073b59fbba4e73a79c1d2b9c60d55651987e5d99

Download Submit
\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\ProgramData\PDFescape Desktop\Installation\Statistics.dll
MD5
e5a591c125fdf21381cf543ed7706c66

SHA1
0baad9f119616ce5d0d39d4cdc9c884c1002a24e

SHA256
15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

SHA512
20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

Download Submit
\Users\Admin\AppData\Local\Temp\is-39CEB.tmp\PDFescape_Desktop_Installer.exe
MD5
87d28b3d2df1cab3711bf8d3b5b520c2

SHA1
1987a4bf2a37f6538c701461357a52b0bce1b980

SHA256
88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

SHA512
19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

Download Submit
\Users\Admin\AppData\Local\Temp\is-39CEB.tmp\_isetup\_isdecmp.dll
MD5
c6ae924ad02500284f7e4efa11fa7cfc

SHA1
2a7770b473b0a7dc9a331d017297ff5af400fed8

SHA256
31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26

SHA512
f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae

Download Submit
\Users\Admin\AppData\Local\Temp\is-DIUU2.tmp\aa5ba0f6ce6bb84632d0dda729c787961b751c237372aa47dc49dc8a8a9a749d.tmp
MD5
44409fb9ddb085ddb1b297f03f2bf7da

SHA1
6214c05499c5ce029680c02c5ee793bfe8879ffa

SHA256
87eea015c65b155888b9c66e16126e22898a72897e2a7dcfb4043bce15ed3015

SHA512
9be0a889ae901806bd38747a6634c4dfb7cb12ec99f8a9a2cbffc017cb50e345377273f80a46ee8157a3b8d9073b59fbba4e73a79c1d2b9c60d55651987e5d99

Download Submit
memory/396-14-0x000007FEF7730000-0x000007FEF79AA000-memory.dmp

Filesize
2.5MB

Download
memory/676-21-0x0000000000000000-mapping.dmp

Download
memory/992-16-0x0000000000000000-mapping.dmp

Download
memory/1204-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1204-4-0x0000000000000000-mapping.dmp

Download
memory/1688-30-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/1740-2-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1740-8-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1784-11-0x0000000000000000-mapping.dmp

Download