69811fd3a031d56a72428c7f3f74573b551c2dc9b5fb827fe6740a03eae55f31

Analysis

max time kernel
43s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 15:32

Target

Trojan;MSIL.FormBook.AFO!MTB.exe
Size

329KB
MD5

0b0d247aa1f24c2f5867b3bf29f69450
SHA1

48de9f34226fd7f637e2379365be035af5c0df1a
SHA256

a6e7292e734c3a15cfa654bba8dea72a2f55f1c24cf6bbdc2fd7e63887e9315a
SHA512

56ee21ee4ab9ece7542c7f3068889b0b98aa7d73274b71682ab39be5cce42efda99830b12910908f06ccb99a83024ac3096108d132fd44cddf4e83191c145706
SSDEEP

3072:Gn2Af+SLiJO+Y7mR9USl6yOiGB3PSQQivLXdn+mvo+vuChrZtwkYZBwOepe4PUeK:jE+yclwQKjdn+WPtYVJIoBfRT+tkH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2960	Trojan;MSIL.FormBook.AFO!MTB.exe
2960	Trojan;MSIL.FormBook.AFO!MTB.exe

C:\Users\Admin\AppData\Local\Temp\Trojan;MSIL.FormBook.AFO!MTB.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan;MSIL.FormBook.AFO!MTB.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:1528