Analysis
-
max time kernel
130s -
max time network
167s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-05-2021 06:20
Static task
static1
Behavioral task
behavioral1
Sample
Choir-Director-Evaluation-Form.exe
Resource
win7v20210408
General
-
Target
Choir-Director-Evaluation-Form.exe
-
Size
107.7MB
-
MD5
e4b18058271e4c9bfc7e3759a6132437
-
SHA1
70248c40ca94932a7f098a26ee7858bda5903d73
-
SHA256
8a5414b7aac54f93ddaa9e57538378db7d68fd6e457770206eef46cd9371aeb1
-
SHA512
4bf709dc7e3e32d7a694732b60150ea97b834465a8074d6b3d4acab0633d3e6f2a96d211f04c58397032bf60e8b4e172c775c95b3afe8765f8e2f1b650c6a045
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Choir-Director-Evaluation-Form.tmpPDFescape_Desktop_Installer.exePDFescapeDesktopInstaller.exepid process 1600 Choir-Director-Evaluation-Form.tmp 1580 PDFescape_Desktop_Installer.exe 1228 PDFescapeDesktopInstaller.exe -
Loads dropped DLL 9 IoCs
Processes:
Choir-Director-Evaluation-Form.exeChoir-Director-Evaluation-Form.tmpregsvr32.exePDFescape_Desktop_Installer.exeDllHost.exepid process 676 Choir-Director-Evaluation-Form.exe 1600 Choir-Director-Evaluation-Form.tmp 1600 Choir-Director-Evaluation-Form.tmp 1912 regsvr32.exe 1580 PDFescape_Desktop_Installer.exe 1580 PDFescape_Desktop_Installer.exe 1580 PDFescape_Desktop_Installer.exe 1292 DllHost.exe 1580 PDFescape_Desktop_Installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
regsvr32.exePDFescapeDesktopInstaller.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3BCC59F0-6C35-4FF0-86A9-0A2E267E65B0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{817163EF-0000-42BE-9A69-39AAF2E71D80}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D55E627-0000-4791-9C81-0222A629540B}\ = "ICancelDataStruct" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67}\ = "IDownloadItemExternalApp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4BD66CEF-B189-4A0E-B5B4-497510EEA230}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D73933D-0000-401D-9F25-5F1614CA7AC3}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57F9206E-944A-444B-B993-9D356DAEF36C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C190A609-0000-4E00-B902-A894C0FA44E5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77CDE36D-0000-4223-8E25-3FFD866B17E8}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\InprocServer32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\Statistics.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8B6481C-0000-4643-989B-7D163445E1DD}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57F9206E-944A-444B-B993-9D356DAEF36C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C0CF171-88CC-47E5-AB25-C93AFC0E7F9A}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39E42990-0000-4230-9F81-62B537B6B839}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4CB4452-0000-4D69-B194-10F00E72CF6B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{58D07BB6-0000-4544-8064-3DB60EEDCF7B}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\ = "IStatist" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB858205-0000-4418-8924-5D16D15EFD6C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09C4B9DD-0000-459D-934A-25EC1D0B234A}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2F518D6-0000-4360-A019-3409E7ADC462}\ = "IInstallItemModule3_1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEAB94F-0000-43AF-8408-C9BA782BF5D4}\TypeLib\ = "{C7335C66-0000-4AC7-9E60-1E7BFE06708C}" PDFescapeDesktopInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56A7C619-0000-4540-A77A-0C6E518E7530} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7AF0E415-0000-4760-8FD7-540C0D4C0A99}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}\1.0\ = "Statistics" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A92F07A1-0000-40B0-AF9F-CCEFA34AB08E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0003DEA4-0000-40CB-B0FB-D1492CA1149F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{151CD23A-0000-4238-A15C-69CA34E0BE67}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40FA2F96-0000-4F05-84D8-C1256EAB70A0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39E42990-0000-4230-9F81-62B537B6B839}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39E42990-0000-4230-9F81-62B537B6B839}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{188419DA-30AB-4A88-BC26-66A045E23263}\InprocServer32\ = "C:\\ProgramData\\PDFescape Desktop\\Installation\\Statistics.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C0CF171-88CC-47E5-AB25-C93AFC0E7F9A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77CDE36D-0000-4223-8E25-3FFD866B17E8}\AppID = "{2BC47158-F746-4E22-B116-D481B09E9674}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F592843-0000-4833-9F47-F7332F3CB3F8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB858205-0000-4418-8924-5D16D15EFD6C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2BC47158-F746-4E22-B116-D481B09E9674}\DllSurrogate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D55E627-0000-4791-9C81-0222A629540B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4A1BB700-0000-4156-A8FA-3DD1DFBCD933}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" PDFescapeDesktopInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5F28CBA-CAF7-482E-88FD-437887EB08EF}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2F518D6-0000-4360-A019-3409E7ADC462}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77A0A704-0000-4B96-B6F6-B635028FDFA4}\ = "IDownloadItemModule" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C0CF171-88CC-47E5-AB25-C93AFC0E7F9A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0179B7E8-0000-48EB-A99B-B1337DEB7F1E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0179B7E8-0000-48EB-A99B-B1337DEB7F1E}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4A11886-0000-484A-BB3C-5874E6828AA1}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F7470C-0000-4762-9613-155654B24238}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB86DDD7-CFE1-4D8B-AA2F-A732C3E66A7D}\AppID = "{2BC47158-F746-4E22-B116-D481B09E9674}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9981C967-0000-4633-8737-F55C3CC344B0}\TypeLib\ = "{46D9BB0E-F2F3-4987-AAC2-4E97C53437B7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{52D88735-0000-4347-BF52-DC4A219E3A2B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{869F03A3-0000-4B45-9FB1-DF6B1387AB03}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF3B4C08-D200-47C9-A396-689B8704BC9A}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A1BB700-0000-4156-A8FA-3DD1DFBCD933}\ProxyStubClsid32 PDFescapeDesktopInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29CF5B0B-0000-4C5E-AAE0-B91F4FD87378}\ = "GeoIP Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29CF5B0B-0000-4C5E-AAE0-B91F4FD87378}\AppID = "{2BC47158-F746-4E22-B116-D481B09E9674}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{188419DA-30AB-4A88-BC26-66A045E23263}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8B6481C-0000-4643-989B-7D163445E1DD}\AppID = "{2BC47158-F746-4E22-B116-D481B09E9674}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE8F3CCD-0000-4EDF-B08E-C25DCADD9BB4}\ = "IOfferItemModule" regsvr32.exe -
Processes:
PDFescape_Desktop_Installer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 PDFescape_Desktop_Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 PDFescape_Desktop_Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 PDFescape_Desktop_Installer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
PDFescape_Desktop_Installer.exepid process 1580 PDFescape_Desktop_Installer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
msiexec.exedescription pid process Token: SeRestorePrivilege 2016 msiexec.exe Token: SeTakeOwnershipPrivilege 2016 msiexec.exe Token: SeSecurityPrivilege 2016 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Choir-Director-Evaluation-Form.exeChoir-Director-Evaluation-Form.tmpPDFescape_Desktop_Installer.exedescription pid process target process PID 676 wrote to memory of 1600 676 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 676 wrote to memory of 1600 676 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 676 wrote to memory of 1600 676 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 676 wrote to memory of 1600 676 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 676 wrote to memory of 1600 676 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 676 wrote to memory of 1600 676 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 676 wrote to memory of 1600 676 Choir-Director-Evaluation-Form.exe Choir-Director-Evaluation-Form.tmp PID 1600 wrote to memory of 1580 1600 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1600 wrote to memory of 1580 1600 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1600 wrote to memory of 1580 1600 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1600 wrote to memory of 1580 1600 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1600 wrote to memory of 1580 1600 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1600 wrote to memory of 1580 1600 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1600 wrote to memory of 1580 1600 Choir-Director-Evaluation-Form.tmp PDFescape_Desktop_Installer.exe PID 1580 wrote to memory of 1912 1580 PDFescape_Desktop_Installer.exe regsvr32.exe PID 1580 wrote to memory of 1912 1580 PDFescape_Desktop_Installer.exe regsvr32.exe PID 1580 wrote to memory of 1912 1580 PDFescape_Desktop_Installer.exe regsvr32.exe PID 1580 wrote to memory of 1912 1580 PDFescape_Desktop_Installer.exe regsvr32.exe PID 1580 wrote to memory of 1912 1580 PDFescape_Desktop_Installer.exe regsvr32.exe PID 1580 wrote to memory of 1912 1580 PDFescape_Desktop_Installer.exe regsvr32.exe PID 1580 wrote to memory of 1912 1580 PDFescape_Desktop_Installer.exe regsvr32.exe PID 1580 wrote to memory of 1228 1580 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 1580 wrote to memory of 1228 1580 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 1580 wrote to memory of 1228 1580 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 1580 wrote to memory of 1228 1580 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 1580 wrote to memory of 1228 1580 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 1580 wrote to memory of 1228 1580 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe PID 1580 wrote to memory of 1228 1580 PDFescape_Desktop_Installer.exe PDFescapeDesktopInstaller.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DRN6S.tmp\Choir-Director-Evaluation-Form.tmp"C:\Users\Admin\AppData\Local\Temp\is-DRN6S.tmp\Choir-Director-Evaluation-Form.tmp" /SL5="$7015E,111934780,999424,C:\Users\Admin\AppData\Local\Temp\Choir-Director-Evaluation-Form.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8JGOA.tmp\PDFescape_Desktop_Installer.exe"C:\Users\Admin\AppData\Local\Temp\is-8JGOA.tmp\PDFescape_Desktop_Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\ProgramData\PDFescape Desktop\Installation\Statistics.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe"C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exe" /RegServer4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{2BC47158-F746-4E22-B116-D481B09E9674}1⤵
- Loads dropped DLL
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
C:\Users\Admin\AppData\Local\Temp\is-8JGOA.tmp\PDFescape_Desktop_Installer.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\Users\Admin\AppData\Local\Temp\is-8JGOA.tmp\PDFescape_Desktop_Installer.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
C:\Users\Admin\AppData\Local\Temp\is-DRN6S.tmp\Choir-Director-Evaluation-Form.tmpMD5
0dc8e93706ff1b10cd6d60ab0ec15d88
SHA19e9c66127ba35ca4ee66fb3fa8820a683d4c943e
SHA2563b79aab07b9461a9d4f3c579555ee024888abcda4f5cc23eac5236a56bf740c7
SHA5120dbbd64f27055997279e36254ba2515b3672b41ef037777fd7490c0d0fa22f791934b483d281a33e542d9f5ee48bac73f2817e1dd93b0e3484c4c5653c8dbf66
-
\ProgramData\PDFescape Desktop\Installation\PDFescapeDesktopInstaller.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\ProgramData\PDFescape Desktop\Installation\Statistics.dllMD5
e5a591c125fdf21381cf543ed7706c66
SHA10baad9f119616ce5d0d39d4cdc9c884c1002a24e
SHA25615b8775a3bae497325056103db0b14842fa8ae5592dcaacd9cce593099f5dee6
SHA51220e3e0e45db7cff82b665ef28621a1a4071aadc97ec7167a7e47cf5dc7669c709932f3a3f1c7d2cd6b0a75dd7d0b42c4fac2ceabe5b074d7a338da1f9e061c35
-
\Users\Admin\AppData\Local\Temp\is-8JGOA.tmp\PDFescape_Desktop_Installer.exeMD5
87d28b3d2df1cab3711bf8d3b5b520c2
SHA11987a4bf2a37f6538c701461357a52b0bce1b980
SHA25688472e266efd1a24182cf902e34e9d6b08a7b5e301be837343ffd34fe5560977
SHA51219226f61925328a990f6a8d7416d1047f395fcb9f2bbd3bc5d7af4b1d0e40b54cecd501f92ba885976ec790c1b397f21814116b8a6d6073d01a58d8d6f1a9de4
-
\Users\Admin\AppData\Local\Temp\is-8JGOA.tmp\_isetup\_isdecmp.dllMD5
c6ae924ad02500284f7e4efa11fa7cfc
SHA12a7770b473b0a7dc9a331d017297ff5af400fed8
SHA25631d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
SHA512f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
-
\Users\Admin\AppData\Local\Temp\is-DRN6S.tmp\Choir-Director-Evaluation-Form.tmpMD5
0dc8e93706ff1b10cd6d60ab0ec15d88
SHA19e9c66127ba35ca4ee66fb3fa8820a683d4c943e
SHA2563b79aab07b9461a9d4f3c579555ee024888abcda4f5cc23eac5236a56bf740c7
SHA5120dbbd64f27055997279e36254ba2515b3672b41ef037777fd7490c0d0fa22f791934b483d281a33e542d9f5ee48bac73f2817e1dd93b0e3484c4c5653c8dbf66
-
memory/676-59-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/676-60-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/1228-78-0x0000000000000000-mapping.dmp
-
memory/1580-69-0x0000000000000000-mapping.dmp
-
memory/1600-67-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1600-62-0x0000000000000000-mapping.dmp
-
memory/1912-73-0x0000000000000000-mapping.dmp
-
memory/2016-87-0x000007FEFB531000-0x000007FEFB533000-memory.dmpFilesize
8KB