Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 06:52
General
- Target PROFORMA_PDF_REVISED97475.bat
- Size 186KB
- Sample260629-hm8ydahs2q
- SHA256 9df8e2bc11d551969955a0f2a146aff099851b46acc942e7dec0608bf8a39b65
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 5 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PROFORMA_PDF_REVISED97475.bat"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo iex([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:z1haux6VCT))) "3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -W H -Nop -nonI -ep bYPAsS3⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\SysWOW64\dxdiag.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/460-21-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-9-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-4-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-5-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-6-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-7-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-8-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-22-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-10-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-11-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-12-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-13-0x00007FFF58ED0000-0x00007FFF59874000-memory.dmp
memory/460-14-0x0000019668010000-0x000001966806A000-memory.dmp
memory/460-15-0x000001964FE10000-0x000001964FE20000-memory.dmp
memory/460-3-0x000001964FE20000-0x000001964FE42000-memory.dmp
memory/460-0-0x00007FFF5905F000-0x00007FFF59060000-memory.dmp
memory/3008-25-0x0000000000BC0000-0x0000000000C07000-memory.dmp
memory/3008-31-0x0000000000BC0000-0x0000000000C07000-memory.dmp
memory/3008-23-0x0000000000BC0000-0x0000000000C07000-memory.dmp
memory/3008-24-0x0000000001020000-0x0000000001394000-memory.dmp
memory/3008-26-0x0000000000BC0000-0x0000000000C07000-memory.dmp
memory/3008-27-0x0000000000F60000-0x0000000000F81000-memory.dmp
memory/3008-17-0x00000000003C0000-0x00000000003C1000-memory.dmp
memory/3008-16-0x0000000000360000-0x00000000003A7000-memory.dmp
memory/3316-30-0x0000000000560000-0x000000000281C000-memory.dmp
memory/3316-28-0x0000000000560000-0x000000000281C000-memory.dmp
memory/3472-33-0x00000000067A0000-0x0000000006887000-memory.dmp
memory/4312-37-0x00000176019C0000-0x0000017601A64000-memory.dmp
memory/4844-29-0x0000000000540000-0x0000000000584000-memory.dmp
memory/4844-32-0x0000000000540000-0x0000000000584000-memory.dmp