General
- Target 29062026_1626_29062026_MV_VAN_KNIGHT_VESSEL_PARTICULARSpdf.Gz
- Size 2.2MB
- Sample260629-txr86abt2n
- SHA256 1fbd9f9aa1359e8b4e1e33d61b8b61c4aa676f8614f09334c8774b0af512fd77
Malware Config
Targets
-
- Target MV_VAN_KNIGHT_VESSEL_PARTICULARSpdf.exe
- Size 3.9MB
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Accesses Microsoft Outlook profiles
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of SetThreadContext
-
- Target Secur32.dll
- Size 2.1MB
- SHA256 f8a7fd3580f7a79db3be7feb8f1519e38058977a7b50cae698260a487e815475
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1