Analysis

  • max time kernel
    131s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    27-05-2021 12:12

General

  • Target

    Choir-Director-Evaluation-Form.exe

  • Size

    107.7MB

  • MD5

    e4b18058271e4c9bfc7e3759a6132437

  • SHA1

    70248c40ca94932a7f098a26ee7858bda5903d73

  • SHA256

    8a5414b7aac54f93ddaa9e57538378db7d68fd6e457770206eef46cd9371aeb1

  • SHA512

    4bf709dc7e3e32d7a694732b60150ea97b834465a8074d6b3d4acab0633d3e6f2a96d211f04c58397032bf60e8b4e172c775c95b3afe8765f8e2f1b650c6a045

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe
    "C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmp" /SL5="$5015C,111934780,999424,C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:788
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1140
        • C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
          "C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe" /RegServer
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:752
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{2BC47158-F746-4E22-B116-D481B09E9674}
    1⤵
    • Loads dropped DLL
    PID:288
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:968

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
    MD5

    87d28b3d2df1cab3711bf8d3b5b520c2

    SHA1

    1987a4bf2a37f6538c701461357a52b0bce1b980

    SHA256

    88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

    SHA512

    19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

  • C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
    MD5

    87d28b3d2df1cab3711bf8d3b5b520c2

    SHA1

    1987a4bf2a37f6538c701461357a52b0bce1b980

    SHA256

    88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

    SHA512

    19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

  • C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll
    MD5

    e5a591c125fdf21381cf543ed7706c66

    SHA1

    0baad9f119616ce5d0d39d4cdc9c884c1002a24e

    SHA256

    15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

    SHA512

    20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

  • C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exe
    MD5

    87d28b3d2df1cab3711bf8d3b5b520c2

    SHA1

    1987a4bf2a37f6538c701461357a52b0bce1b980

    SHA256

    88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

    SHA512

    19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

  • C:\Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exe
    MD5

    87d28b3d2df1cab3711bf8d3b5b520c2

    SHA1

    1987a4bf2a37f6538c701461357a52b0bce1b980

    SHA256

    88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

    SHA512

    19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

  • C:\Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmp
    MD5

    0dc8e93706ff1b10cd6d60ab0ec15d88

    SHA1

    9e9c66127ba35ca4ee66fb3fa8820a683d4c943e

    SHA256

    3b79aab07b9461a9d4f3c579555ee024888abcda4f5cc23eac5236a56bf740c7

    SHA512

    0dbbd64f27055997279e36254ba2515b3672b41ef037777fd7490c0d0fa22f791934b483d281a33e542d9f5ee48bac73f2817e1dd93b0e3484c4c5653c8dbf66

  • \ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe
    MD5

    87d28b3d2df1cab3711bf8d3b5b520c2

    SHA1

    1987a4bf2a37f6538c701461357a52b0bce1b980

    SHA256

    88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

    SHA512

    19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

  • \ProgramData\PDFescape Desktop\Installation\Statistics.dll
    MD5

    e5a591c125fdf21381cf543ed7706c66

    SHA1

    0baad9f119616ce5d0d39d4cdc9c884c1002a24e

    SHA256

    15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

    SHA512

    20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

  • \ProgramData\PDFescape Desktop\Installation\Statistics.dll
    MD5

    e5a591c125fdf21381cf543ed7706c66

    SHA1

    0baad9f119616ce5d0d39d4cdc9c884c1002a24e

    SHA256

    15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

    SHA512

    20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

  • \ProgramData\PDFescape Desktop\Installation\Statistics.dll
    MD5

    e5a591c125fdf21381cf543ed7706c66

    SHA1

    0baad9f119616ce5d0d39d4cdc9c884c1002a24e

    SHA256

    15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

    SHA512

    20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

  • \ProgramData\PDFescape Desktop\Installation\Statistics.dll
    MD5

    e5a591c125fdf21381cf543ed7706c66

    SHA1

    0baad9f119616ce5d0d39d4cdc9c884c1002a24e

    SHA256

    15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

    SHA512

    20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

  • \ProgramData\PDFescape Desktop\Installation\Statistics.dll
    MD5

    e5a591c125fdf21381cf543ed7706c66

    SHA1

    0baad9f119616ce5d0d39d4cdc9c884c1002a24e

    SHA256

    15b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6

    SHA512

    20e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35

  • \Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\PDFescape_Desktop_Installer.exe
    MD5

    87d28b3d2df1cab3711bf8d3b5b520c2

    SHA1

    1987a4bf2a37f6538c701461357a52b0bce1b980

    SHA256

    88472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977

    SHA512

    19226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4

  • \Users\Admin\AppData\Local\Temp\is-ACKMB.tmp\_isetup\_isdecmp.dll
    MD5

    c6ae924ad02500284f7e4efa11fa7cfc

    SHA1

    2a7770b473b0a7dc9a331d017297ff5af400fed8

    SHA256

    31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26

    SHA512

    f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae

  • \Users\Admin\AppData\Local\Temp\is-QN1JJ.tmp\Choir-Director-Evaluation-Form.tmp
    MD5

    0dc8e93706ff1b10cd6d60ab0ec15d88

    SHA1

    9e9c66127ba35ca4ee66fb3fa8820a683d4c943e

    SHA256

    3b79aab07b9461a9d4f3c579555ee024888abcda4f5cc23eac5236a56bf740c7

    SHA512

    0dbbd64f27055997279e36254ba2515b3672b41ef037777fd7490c0d0fa22f791934b483d281a33e542d9f5ee48bac73f2817e1dd93b0e3484c4c5653c8dbf66

  • memory/752-78-0x0000000000000000-mapping.dmp
  • memory/788-69-0x0000000000000000-mapping.dmp
  • memory/968-87-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp
    Filesize

    8KB

  • memory/1140-73-0x0000000000000000-mapping.dmp
  • memory/1560-67-0x00000000001D0000-0x00000000001D1000-memory.dmp
    Filesize

    4KB

  • memory/1560-62-0x0000000000000000-mapping.dmp
  • memory/1988-59-0x0000000075511000-0x0000000075513000-memory.dmp
    Filesize

    8KB

  • memory/1988-60-0x0000000000400000-0x0000000000501000-memory.dmp
    Filesize

    1.0MB