General
- Target 1.rar
- Size 2.0MB
- Sample260626-sqf2wacv6w
- SHA256 cd2f7a4b0f85f54bd8570368ad9a3deb89af300f77ac756f510f3e4404068a15
Malware Config
Targets
-
- Target PO-C1J24023-0624-01-0_pdf.exe
- Size 3.9MB
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
Score10/10Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
Formbook payload
Accesses Microsoft Outlook profiles
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Suspicious use of SetThreadContext
-
- Target Secur32.dll
- Size 1.8MB
- SHA256 1bfc8230e6e1ae0e4f3eb00d46d1f2ff3806e66cce2400978a08e484ac20c220
Score10/10Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
Formbook payload
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1