Analysis
-
max time kernel
131s -
max time network
167s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-05-2021 12:12
Static task
static1
Behavioral task
behavioral1
Sample
Choir-Director-Evaluation-Form.exe
Resource
win7v20210408
General
-
Target
Choir-Director-Evaluation-Form.exe
-
Size
107.7MB
-
MD5
e4b18058271e4c9bfc7e3759a6132437
-
SHA1
70248c40ca94932a7f098a26ee7858bda5903d73
-
SHA256
8a5414b7aac54f93ddaa9e57538378db7d68fd6e457770206eef46cd9371aeb1
-
SHA512
4bf709dc7e3e32d7a694732b60150ea97b834465a8074d6b3d4acab0633d3e6f2a96d211f04c58397032bf60e8b4e172c775c95b3afe8765f8e2f1b650c6a045
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Choir-Director-Evaluation-Form.tmpPDFescape_Desktop_Installer.exePDFescapeDesktopInstaller.exepid process 1560 Choir-Director-Evaluation-Form.tmp 788 PDFescape_Desktop_Installer.exe 752 PDFescapeDesktopInstaller.exe -
Loads dropped DLL 9 IoCs
Processes:
Choir-Director-Evaluation-Form.exeChoir-Director-Evaluation-Form.tmpregsvr32.exePDFescape_Desktop_Installer.exeDllHost.exepid process 1988 Choir-Director-Evaluation-Form.exe 1560 Choir-Director-Evaluation-Form.tmp 1560 Choir-Director-Evaluation-Form.tmp 1140 regsvr32.exe 788 PDFescape_Desktop_Installer.exe 788 PDFescape_Desktop_Installer.exe 788 PDFescape_Desktop_Installer.exe 288 DllHost.exe 788 PDFescape_Desktop_Installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
regsvr32.exePDFescapeDesktopInstaller.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39E42990-0000-4230-9F81-62B537B6B839}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4CB4452-0000-4D69-B194-10F00E72CF6B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{817163EF-0000-42BE-9A69-39AAF2E71D80}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C0CF171-88CC-47E5-AB25-C93AFC0E7F9A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEAB94F-0000-43AF-8408-C9BA782BF5D4}\Programmable PDFescapeDesktopInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9981C967-0000-4633-8737-F55C3CC344B0}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8B6481C-0000-4643-989B-7D163445E1DD}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52D88735-0000-4347-BF52-DC4A219E3A2B}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2F518D6-0000-4360-A019-3409E7ADC462}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEAB94F-0000-43AF-8408-C9BA782BF5D4}\LocalServer32\ = "\"C:\\ProgramData\\PDFescape Desktop\\Installation\\PDFescapeDesktopInstaller.exe\"" PDFescapeDesktopInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4A1BB700-0000-4156-A8FA-3DD1DFBCD933}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" PDFescapeDesktopInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB858205-0000-4418-8924-5D16D15EFD6C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E81AD0B-0000-4107-9058-7CC9F66ACAA8}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37DD0F6C-0000-46F2-8B21-3E4AB4750AFF}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77CDE36D-0000-4223-8E25-3FFD866B17E8}\ = "InstallItemToolbar Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57F9206E-944A-444B-B993-9D356DAEF36C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3BCC59F0-6C35-4FF0-86A9-0A2E267E65B0}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29CF5B0B-0000-4C5E-AAE0-B91F4FD87378}\InprocServer32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\Statistics.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C753468E-0000-46FA-B49D-C133BC303D3B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52D88735-0000-4347-BF52-DC4A219E3A2B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{322C09B5-0000-4267-8909-976D51F2FC41}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{40FA2F96-0000-4F05-84D8-C1256EAB70A0}\TypeLib regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2F9E253B-E274-4714-AE58-E879196F7E37}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 PDFescapeDesktopInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2BC47158-F746-4E22-B116-D481B09E9674} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F7470C-0000-4762-9613-155654B24238}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58D07BB6-0000-4544-8064-3DB60EEDCF7B}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D55E627-0000-4791-9C81-0222A629540B}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{322C09B5-0000-4267-8909-976D51F2FC41}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\ = "IOfferItemModule" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C190A609-0000-4E00-B902-A894C0FA44E5}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C753468E-0000-46FA-B49D-C133BC303D3B}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB858205-0000-4418-8924-5D16D15EFD6C}\ = "IInstallItemToolbar" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9981C967-0000-4633-8737-F55C3CC344B0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{188419DA-30AB-4A88-BC26-66A045E23263}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40FA2F96-0000-4F05-84D8-C1256EAB70A0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C0CF171-88CC-47E5-AB25-C93AFC0E7F9A}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{817163EF-0000-42BE-9A69-39AAF2E71D80} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9981C967-0000-4633-8737-F55C3CC344B0}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58D07BB6-0000-4544-8064-3DB60EEDCF7B}\ = "OfferItemModule Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7335C66-0000-4AC7-9E60-1E7BFE06708C}\1.0\0\win32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\PDFescapeDesktopInstaller.exe" PDFescapeDesktopInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D55E627-0000-4791-9C81-0222A629540B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD0188E8-0000-49D3-BF36-2B1DB153CEC3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57F9206E-944A-444B-B993-9D356DAEF36C}\ = "IInstallItemMonetization" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E81AD0B-0000-4107-9058-7CC9F66ACAA8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9242C198-0000-4F73-935D-1C7905796C67}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F7470C-0000-4762-9613-155654B24238}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{188419DA-30AB-4A88-BC26-66A045E23263}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEAB94F-0000-43AF-8408-C9BA782BF5D4}\Version PDFescapeDesktopInstaller.exe -
Processes:
PDFescape_Desktop_Installer.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 PDFescape_Desktop_Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 PDFescape_Desktop_Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 PDFescape_Desktop_Installer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
PDFescape_Desktop_Installer.exepid process 788 PDFescape_Desktop_Installer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
msiexec.exedescription pid process Token: SeRestorePrivilege 968 msiexec.exe Token: SeTakeOwnershipPrivilege 968 msiexec.exe Token: SeSecurityPrivilege 968 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Choir-Director-Evaluation-Form.exeChoir-Director-Evaluation-Form.tmpPDFescape_Desktop_Installer.exedescription pid process target process PID 1988 wrote to memory of 1560 1988 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1988 wrote to memory of 1560 1988 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1988 wrote to memory of 1560 1988 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1988 wrote to memory of 1560 1988 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1988 wrote to memory of 1560 1988 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1988 wrote to memory of 1560 1988 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1988 wrote to memory of 1560 1988 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1560 wrote to memory of 788 1560 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1560 wrote to memory of 788 1560 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1560 wrote to memory of 788 1560 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1560 wrote to memory of 788 1560 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1560 wrote to memory of 788 1560 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1560 wrote to memory of 788 1560 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1560 wrote to memory of 788 1560 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 788 wrote to memory of 1140 788 PDFescape_Desktop_Installer.exe regsvr32.exe PID 788 wrote to memory of 1140 788 PDFescape_Desktop_Installer.exe regsvr32.exe PID 788 wrote to memory of 1140 788 PDFescape_Desktop_Installer.exe regsvr32.exe PID 788 wrote to memory of 1140 788 PDFescape_Desktop_Installer.exe regsvr32.exe PID 788 wrote to memory of 1140 788 PDFescape_Desktop_Installer.exe regsvr32.exe PID 788 wrote to memory of 1140 788 PDFescape_Desktop_Installer.exe regsvr32.exe PID 788 wrote to memory of 1140 788 PDFescape_Desktop_Installer.exe regsvr32.exe PID 788 wrote to memory of 752 788 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 788 wrote to memory of 752 788 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 788 wrote to memory of 752 788 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 788 wrote to memory of 752 788 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 788 wrote to memory of 752 788 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 788 wrote to memory of 752 788 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 788 wrote to memory of 752 788 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmp"C:\Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmp" /SL5="$5015C,111934780,999424,C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exe"C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe"C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe" /RegServer4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{2BC47158-F746-4E22-B116-D481B09E9674}1⤵
- Loads dropped DLL
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmpMD5
0dc8e93706ff1b10cd6d60ab0ec15d88
SHA19e9c66127ba35ca4ee66fb3fa8820a683d4c943e
SHA2563b79aab07b9461a9d4f3c579555ee024888abcda4f5cc23eac5236a56bf740c7
SHA5120dbbd64f27055997279e36254ba2515b3672b41ef037777fd7490c0d0fa22f791934b483d281a33e542d9f5ee48bac73f2817e1dd93b0e3484c4c5653c8dbf66
-
\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\_isetup\_isdecmp.dllMD5
c6ae924ad02500284f7e4efa11fa7cfc
SHA12a7770b473b0a7dc9a331d017297ff5af400fed8
SHA25631d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
SHA512f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
-
\Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmpMD5
0dc8e93706ff1b10cd6d60ab0ec15d88
SHA19e9c66127ba35ca4ee66fb3fa8820a683d4c943e
SHA2563b79aab07b9461a9d4f3c579555ee024888abcda4f5cc23eac5236a56bf740c7
SHA5120dbbd64f27055997279e36254ba2515b3672b41ef037777fd7490c0d0fa22f791934b483d281a33e542d9f5ee48bac73f2817e1dd93b0e3484c4c5653c8dbf66
-
memory/752-78-0x0000000000000000-mapping.dmp
-
memory/788-69-0x0000000000000000-mapping.dmp
-
memory/968-87-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmpFilesize
8KB
-
memory/1140-73-0x0000000000000000-mapping.dmp
-
memory/1560-67-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1560-62-0x0000000000000000-mapping.dmp
-
memory/1988-59-0x0000000075511000-0x0000000075513000-memory.dmpFilesize
8KB
-
memory/1988-60-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB