Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system - submitted
09/10/2025, 13:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Draft on Document.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target Draft on Document.exe
- Size 1.2MB
- Sample251009-p87e1aylv2
- SHA256 43b26c2424d02b6e41349628ab60570bfa754e85a4fdb7be13ab2f93ff33c40d
- MD5 a9ff8c5150f9a66c5e8bb098cabe3173
- SHA1 d55a639669f3a09b1e2702fe22b9cd90b830cd9a
- SHA512 9347b567e71d269f5eb1c829d4bc7c3ac63c23879c575d965f68d3373848c8dbf2a0d3b1b33675c77644245afd6ddb7852c88b0a1d9aadab8036cdc1f5e50632
- SSDEEP 24576:15EmXFtKaL4/oFe5T9yyXYfP1ijXdaY/RVNpGFr+pLRp:1PVt/LZeJbInQRaY8r+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Formbook family
- Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/3840-18-0x0000000000400000-0x0000000000442000-memory.dmp family_formbook behavioral2/memory/3840-24-0x0000000000400000-0x0000000000442000-memory.dmp family_formbook behavioral2/memory/5472-27-0x0000000000400000-0x000000000043F000-memory.dmp family_formbook behavioral2/memory/5472-30-0x0000000000400000-0x000000000043F000-memory.dmp family_formbook - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5232-14-0x0000000000EE0000-0x00000000012E0000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 5232 set thread context of 3840 5232 Draft on Document.exe 78 PID 3840 set thread context of 3248 3840 svchost.exe 52 PID 3840 set thread context of 5472 3840 svchost.exe 82 PID 5472 set thread context of 3248 5472 netbtugc.exe 52 PID 5472 set thread context of 4892 5472 netbtugc.exe 83 - Program crash 1 IoCs
pid pid_target Process procid_target 392 5232 WerFault.exe 77 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Draft on Document.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netbtugc.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2238466657-712128251-1221219315-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netbtugc.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3248 Explorer.EXE - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 5232 Draft on Document.exe 3840 svchost.exe 3248 Explorer.EXE 3248 Explorer.EXE 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe 5472 netbtugc.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5232 Draft on Document.exe 5232 Draft on Document.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5232 Draft on Document.exe 5232 Draft on Document.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5232 wrote to memory of 3840 5232 Draft on Document.exe 78 PID 5232 wrote to memory of 3840 5232 Draft on Document.exe 78 PID 5232 wrote to memory of 3840 5232 Draft on Document.exe 78 PID 5232 wrote to memory of 3840 5232 Draft on Document.exe 78 PID 3248 wrote to memory of 5472 3248 Explorer.EXE 82 PID 3248 wrote to memory of 5472 3248 Explorer.EXE 82 PID 3248 wrote to memory of 5472 3248 Explorer.EXE 82 PID 5472 wrote to memory of 4892 5472 netbtugc.exe 83 PID 5472 wrote to memory of 4892 5472 netbtugc.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\Draft on Document.exe"C:\Users\Admin\AppData\Local\Temp\Draft on Document.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Draft on Document.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 7643⤵
- Program crash
PID:392
-
-
-
C:\Windows\SysWOW64\netbtugc.exe"C:\Windows\SysWOW64\netbtugc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5232 -ip 52321⤵PID:540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\aut6A44.tmp
- Size 264KB
- SHA256 8e76b56150add65fcda7f68a461bd1148135e66ac9c6041cff65e722631a096f
- MD5 6df441a9d1b39693dd1f729f6195e627
- SHA1 7691353eef2d297ea28c35d06dd651082d4fd683
- SHA512 a0f0bb7673650659af5a23374b1481c42a76add505c433fd841e92eba7e7f3f8dd8d853e6883c8512bc4f2b39f36216233702563153a44d52d6c8b28c60d3faf
- SSDEEP 6144:uEZZBvy8x9THHktr1dPeZ1DV2IjicZZjXf7mxSCkLXP:uEnxlqhdPg2YZjXfFT
- MD5 SHA1 SHA512 SSDEEP