Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 10:40
Static task
static1
Behavioral task
behavioral1
Sample
80460-Contract Ref 2023.exe
Resource
win7-20230220-en
General
-
Target
80460-Contract Ref 2023.exe
-
Size
814KB
-
MD5
030de17769357418013f18e0ad1b61bb
-
SHA1
3bfd9fd82f846a73f319eb2a29f246dbf143e721
-
SHA256
34c2526748f1214c70cbefa7e45e067e86e78c79759cafa9fdf1082795ed92bb
-
SHA512
84f378d657e3bf30028fe4aeafea91d3da68dfe77531a10d0919dc439285633bf97914b8ec9a9f9e998c6ef3239697f43dd0e1979623017875e4906246445826
-
SSDEEP
12288:qA53B0OKIZt8JDol8JSfyjaGClHNfUFL1FCgUoygyKIwp6DoFxVf6lzZGJhZ:qA5x8IE9olWK7G6t4jFBJIw4cMhZgD
Malware Config
Extracted
formbook
4.1
bpnw
subsc-music.com
spiffyd01.buzz
link2it.xyz
coenst.site
carltonautomatic.com
argbeauty.co.uk
tenantdfgg.click
mammothbechtelar.com
bekkarblogger.com
rheamoments.com
themagicofbedtime.com
berksbeaconnews.com
1stpagerealestate.com
ammarshoes.com
lv-newlife.com
travelnewsbuzz.com
promo-tv.fun
getfreedownload.online
al-istitmar.info
strataclleanenergy.com
furnishedcottage.com
bklcbd.com
oayara.com
rttranslate.com
hmmm.services
economycutslawnservice.com
coreinternationalbusiness.com
outpv.online
drinja-tirkiz.com
martline.website
osanala.com
tridentacquisition.info
thecoachhq.com
fawjianyu.com
innoinfinitesolutions.net
tamilnadumetal.com
spig.nu
cyberjam.live
southern-sniper.com
goldquick.club
foxhound-armory.com
ethype.xyz
itfckingmatters.info
drlaskovets.space
nhadat413.com
sjlh267.com
soulrichcollections.com
uiemvh.xyz
deafazagency.com
zenstel.com
thriftytrack.com
tuirctrapped.buzz
skestar.top
prilagatelnoe.makeup
discordserver.net
ypm8.top
wristlancer.com
davidleeproperty.co.uk
ryconascimentotelasfake.website
eldritchventures.net
china-opq.com
allayrival.net
ns9x.xyz
memorymakersottawa.com
casinospinwin.net
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3576-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3576-158-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4712-184-0x0000000000BB0000-0x0000000000BDF000-memory.dmp formbook behavioral2/memory/4712-192-0x0000000000BB0000-0x0000000000BDF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
80460-Contract Ref 2023.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 80460-Contract Ref 2023.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
80460-Contract Ref 2023.exe80460-Contract Ref 2023.execmd.exedescription pid process target process PID 4156 set thread context of 3576 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 3576 set thread context of 3184 3576 80460-Contract Ref 2023.exe Explorer.EXE PID 4712 set thread context of 3184 4712 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
80460-Contract Ref 2023.exe80460-Contract Ref 2023.exepowershell.execmd.exepid process 4156 80460-Contract Ref 2023.exe 4156 80460-Contract Ref 2023.exe 3576 80460-Contract Ref 2023.exe 3576 80460-Contract Ref 2023.exe 1072 powershell.exe 3576 80460-Contract Ref 2023.exe 3576 80460-Contract Ref 2023.exe 1072 powershell.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe 4712 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3184 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
80460-Contract Ref 2023.execmd.exepid process 3576 80460-Contract Ref 2023.exe 3576 80460-Contract Ref 2023.exe 3576 80460-Contract Ref 2023.exe 4712 cmd.exe 4712 cmd.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
80460-Contract Ref 2023.exepowershell.exe80460-Contract Ref 2023.execmd.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4156 80460-Contract Ref 2023.exe Token: SeDebugPrivilege 1072 powershell.exe Token: SeDebugPrivilege 3576 80460-Contract Ref 2023.exe Token: SeDebugPrivilege 4712 cmd.exe Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
80460-Contract Ref 2023.exeExplorer.EXEcmd.exedescription pid process target process PID 4156 wrote to memory of 1072 4156 80460-Contract Ref 2023.exe powershell.exe PID 4156 wrote to memory of 1072 4156 80460-Contract Ref 2023.exe powershell.exe PID 4156 wrote to memory of 1072 4156 80460-Contract Ref 2023.exe powershell.exe PID 4156 wrote to memory of 1208 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 1208 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 1208 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 3576 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 3576 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 3576 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 3576 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 3576 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 4156 wrote to memory of 3576 4156 80460-Contract Ref 2023.exe 80460-Contract Ref 2023.exe PID 3184 wrote to memory of 4712 3184 Explorer.EXE cmd.exe PID 3184 wrote to memory of 4712 3184 Explorer.EXE cmd.exe PID 3184 wrote to memory of 4712 3184 Explorer.EXE cmd.exe PID 4712 wrote to memory of 3880 4712 cmd.exe cmd.exe PID 4712 wrote to memory of 3880 4712 cmd.exe cmd.exe PID 4712 wrote to memory of 3880 4712 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\80460-Contract Ref 2023.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5tpshn2s.mz3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1072-144-0x0000000004C00000-0x0000000004C22000-memory.dmpFilesize
136KB
-
memory/1072-167-0x0000000070FF0000-0x000000007103C000-memory.dmpFilesize
304KB
-
memory/1072-187-0x0000000007100000-0x000000000710E000-memory.dmpFilesize
56KB
-
memory/1072-185-0x0000000007150000-0x00000000071E6000-memory.dmpFilesize
600KB
-
memory/1072-183-0x0000000006F40000-0x0000000006F4A000-memory.dmpFilesize
40KB
-
memory/1072-179-0x0000000006ED0000-0x0000000006EEA000-memory.dmpFilesize
104KB
-
memory/1072-178-0x0000000007510000-0x0000000007B8A000-memory.dmpFilesize
6.5MB
-
memory/1072-189-0x00000000071F0000-0x00000000071F8000-memory.dmpFilesize
32KB
-
memory/1072-163-0x0000000005BC0000-0x0000000005BDE000-memory.dmpFilesize
120KB
-
memory/1072-188-0x0000000007210000-0x000000000722A000-memory.dmpFilesize
104KB
-
memory/1072-142-0x00000000022E0000-0x0000000002316000-memory.dmpFilesize
216KB
-
memory/1072-145-0x0000000004CA0000-0x0000000004D06000-memory.dmpFilesize
408KB
-
memory/1072-152-0x00000000055C0000-0x0000000005626000-memory.dmpFilesize
408KB
-
memory/1072-157-0x0000000002290000-0x00000000022A0000-memory.dmpFilesize
64KB
-
memory/1072-177-0x0000000006180000-0x000000000619E000-memory.dmpFilesize
120KB
-
memory/1072-159-0x0000000002290000-0x00000000022A0000-memory.dmpFilesize
64KB
-
memory/1072-166-0x000000007F6E0000-0x000000007F6F0000-memory.dmpFilesize
64KB
-
memory/1072-164-0x0000000006D80000-0x0000000006DB2000-memory.dmpFilesize
200KB
-
memory/1072-165-0x0000000002290000-0x00000000022A0000-memory.dmpFilesize
64KB
-
memory/1072-143-0x0000000004E20000-0x0000000005448000-memory.dmpFilesize
6.2MB
-
memory/3184-215-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-226-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-240-0x0000000007080000-0x0000000007082000-memory.dmpFilesize
8KB
-
memory/3184-239-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-238-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-237-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-236-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-235-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-234-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-233-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-232-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-231-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-230-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-229-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-228-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-227-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-162-0x0000000006F90000-0x000000000707F000-memory.dmpFilesize
956KB
-
memory/3184-225-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-195-0x0000000008810000-0x0000000008993000-memory.dmpFilesize
1.5MB
-
memory/3184-196-0x0000000008810000-0x0000000008993000-memory.dmpFilesize
1.5MB
-
memory/3184-198-0x0000000008810000-0x0000000008993000-memory.dmpFilesize
1.5MB
-
memory/3184-200-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-201-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-202-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-203-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-204-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-205-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-206-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-207-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-208-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-209-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-210-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-211-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-212-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-213-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-214-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-224-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3184-216-0x0000000007080000-0x0000000007082000-memory.dmpFilesize
8KB
-
memory/3576-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3576-161-0x0000000001280000-0x0000000001294000-memory.dmpFilesize
80KB
-
memory/3576-160-0x0000000001470000-0x00000000017BA000-memory.dmpFilesize
3.3MB
-
memory/3576-158-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4156-139-0x00000000065F0000-0x000000000668C000-memory.dmpFilesize
624KB
-
memory/4156-136-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4156-137-0x0000000004E80000-0x0000000004E8A000-memory.dmpFilesize
40KB
-
memory/4156-138-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4156-133-0x00000000003C0000-0x0000000000490000-memory.dmpFilesize
832KB
-
memory/4156-135-0x0000000004CC0000-0x0000000004D52000-memory.dmpFilesize
584KB
-
memory/4156-134-0x0000000005340000-0x00000000058E4000-memory.dmpFilesize
5.6MB
-
memory/4712-186-0x0000000001550000-0x000000000189A000-memory.dmpFilesize
3.3MB
-
memory/4712-184-0x0000000000BB0000-0x0000000000BDF000-memory.dmpFilesize
188KB
-
memory/4712-182-0x00000000001A0000-0x00000000001FA000-memory.dmpFilesize
360KB
-
memory/4712-180-0x00000000001A0000-0x00000000001FA000-memory.dmpFilesize
360KB
-
memory/4712-192-0x0000000000BB0000-0x0000000000BDF000-memory.dmpFilesize
188KB
-
memory/4712-194-0x0000000001370000-0x0000000001403000-memory.dmpFilesize
588KB