f54022e9e160de2321599b85378b7d27f10ec9efa9c66ee09276da5dc04eea0a

General

Target

Beauticon Valley Holding Wiring Instructions.pdf
Size

100KB
MD5

1f980998deb3bbb4c47755db73deb4bd
SHA1

6fd55b55ce8a1cde403907e5857b20697256d3cb
SHA256

d61b1af13a1ac06149bdd147d85715e40b9fcdd1d45c0fadb6400ecdbaac5676
SHA512

be8bee2edbbec74ad684b36fda630f610a4267c6a9e9f301ca2ee995f76726e70480fd186f51b3ee41691655ad73c9fe15fb891606ce4b3609207f7c29ed5479
SSDEEP

3072:4z2Ko8H23HM+BRRYxvM28j8BjNapHYrFEFzFU:4z2aWdHsE34Lq4rFEFzFU

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2672 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2672 AcroRd32.exe
2672 AcroRd32.exe
2672 AcroRd32.exe
2672 AcroRd32.exe

pid	process
2672	AcroRd32.exe

pid	process
2672	AcroRd32.exe
2672	AcroRd32.exe
2672	AcroRd32.exe
2672	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2672 wrote to memory of 4564	2672	AcroRd32.exe	RdrCEF.exe
PID 2672 wrote to memory of 4564	2672	AcroRd32.exe	RdrCEF.exe
PID 2672 wrote to memory of 4564	2672	AcroRd32.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 2976	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe
PID 4564 wrote to memory of 3564	4564	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Beauticon Valley Holding Wiring Instructions.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4564

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5CB09035A7CE884FF20880320D097832 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2976

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A9C6FB3A4A37190A2ADD88022E0AF0A3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A9C6FB3A4A37190A2ADD88022E0AF0A3 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3564

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1E27BADC71F4629123CD9562A208FF9A --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2452

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1F9E392BE2272FE2F2BB775D5CA9700B --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3628

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FB54A493B35D60FCBD3FB0369120826A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FB54A493B35D60FCBD3FB0369120826A --renderer-client-id=6 --mojo-platform-channel-handle=2520 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2404

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=10C66F1B10648AD2E33F37AD2B299D54 --mojo-platform-channel-handle=2740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
7a1b473868f376ff8878fc109450aaca

SHA1
fb2d3b595a7a9ab97d86d36f3d255f53e3978e30

SHA256
3d2b951bf351e0a6bee1c665081417ae8b0c39805168a0aa561cc7348860a8f3

SHA512
58eab8075db122c33731ae09204b462667544c120a83d500206f0aec970f5d738f2dfcc3b8fb8d0593d77ceb0f66e823e3bd5ef4b50fc1bd9beb3e79a1c33e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a74e8d96e6f14e821a2785e586dd6b1a

SHA1
4934c976a6951c2562676e592734473dff68cd62

SHA256
f7fbee9f8fa1570b4da4f21204d2eb5665f23e3576f90a2cc6eb1a5cdacaa41c

SHA512
c4ab90ef4d730467c71397139d770b4e554f3ba888b0e43dcf5ebac03755131fb9640e3e5f3c7b256d99ea72baed1bfdadbf39cf3fc732c54998894f7a03d6ed

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads