Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 12:10
General
- Target Factura electric correspondiente al pedido GA103209 PDF.exe
- Size 981KB
- Sample260702-pceecaf18k
- SHA256 0b3236531c608af3cdb33b3f09ab0d5bbd61f67cc341faa92c1c2cb2258bd409
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Factura electric correspondiente al pedido GA103209 PDF.exe"C:\Users\Admin\AppData\Local\Temp\Factura electric correspondiente al pedido GA103209 PDF.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura electric correspondiente al pedido GA103209 PDF.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ezsxw3z20ai.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\jjdyBNjcwez.exe"C:\Users\Admin\AppData\Roaming\jjdyBNjcwez.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jjdyBNjcwez.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\poqexec.exe"C:\Windows\SysWOW64\poqexec.exe"1⤵
-
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\SysWOW64\TapiUnattend.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ze0pznbl.eca.ps1
ezsxw3z20ai.ps1
jjdyBNjcwez.exe
memory/8-73-0x0000000000B80000-0x0000000000BC6000-memory.dmp
memory/8-20-0x0000000001220000-0x000000000156A000-memory.dmp
memory/8-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/8-42-0x0000000000B80000-0x0000000000BC6000-memory.dmp
memory/8-15-0x0000000000B80000-0x0000000000BC6000-memory.dmp
memory/988-74-0x0000000000600000-0x0000000000643000-memory.dmp
memory/988-72-0x0000000000600000-0x0000000000643000-memory.dmp
memory/2964-63-0x000001A125DD0000-0x000001A125FEC000-memory.dmp
memory/2964-41-0x000001A10BBA0000-0x000001A10BBC2000-memory.dmp
memory/3040-1-0x0000000005D50000-0x00000000062F4000-memory.dmp
memory/3040-2-0x0000000005880000-0x0000000005912000-memory.dmp
memory/3040-3-0x0000000005870000-0x0000000005880000-memory.dmp
memory/3040-6-0x00000000076D0000-0x00000000076E0000-memory.dmp
memory/3040-4-0x0000000005A30000-0x0000000005A3A000-memory.dmp
memory/3040-0-0x0000000000DA0000-0x0000000000E9C000-memory.dmp
memory/3040-7-0x0000000005870000-0x0000000005880000-memory.dmp
memory/3040-5-0x0000000005B20000-0x0000000005BBC000-memory.dmp
memory/3040-8-0x0000000007790000-0x0000000007870000-memory.dmp
memory/3232-75-0x0000000008A90000-0x0000000008BAE000-memory.dmp
memory/3416-104-0x000001F74F1A0000-0x000001F74F259000-memory.dmp
memory/3856-99-0x0000000007590000-0x00000000075A4000-memory.dmp
memory/3856-86-0x0000000005A50000-0x0000000005DA4000-memory.dmp
memory/3856-88-0x0000000006570000-0x00000000065BC000-memory.dmp
memory/3856-89-0x0000000070170000-0x00000000701BC000-memory.dmp
memory/3856-97-0x0000000007260000-0x0000000007303000-memory.dmp
memory/3856-98-0x0000000007540000-0x0000000007551000-memory.dmp
memory/4472-108-0x000002DBF5750000-0x000002DBF5819000-memory.dmp
memory/4624-43-0x0000000006F40000-0x0000000006F72000-memory.dmp
memory/4624-53-0x0000000007180000-0x0000000007223000-memory.dmp
memory/4624-64-0x00000000074B0000-0x00000000074C1000-memory.dmp
memory/4624-19-0x0000000005190000-0x00000000057B8000-memory.dmp
memory/4624-65-0x00000000074E0000-0x00000000074EE000-memory.dmp
memory/4624-66-0x00000000074F0000-0x0000000007504000-memory.dmp
memory/4624-67-0x00000000075F0000-0x000000000760A000-memory.dmp
memory/4624-68-0x00000000075D0000-0x00000000075D8000-memory.dmp
memory/4624-57-0x0000000007320000-0x000000000732A000-memory.dmp
memory/4624-17-0x0000000004B50000-0x0000000004B60000-memory.dmp
memory/4624-56-0x00000000072B0000-0x00000000072CA000-memory.dmp
memory/4624-60-0x0000000007530000-0x00000000075C6000-memory.dmp
memory/4624-52-0x0000000006530000-0x000000000654E000-memory.dmp
memory/4624-26-0x0000000005810000-0x0000000005832000-memory.dmp
memory/4624-44-0x0000000071020000-0x000000007106C000-memory.dmp
memory/4624-55-0x00000000078F0000-0x0000000007F6A000-memory.dmp
memory/4624-16-0x0000000004B50000-0x0000000004B60000-memory.dmp
memory/4624-14-0x00000000049D0000-0x0000000004A06000-memory.dmp
memory/4624-33-0x00000000064D0000-0x000000000651C000-memory.dmp
memory/4624-32-0x0000000005F70000-0x0000000005F8E000-memory.dmp
memory/4624-31-0x0000000005B50000-0x0000000005EA4000-memory.dmp
memory/4624-29-0x00000000059B0000-0x0000000005A16000-memory.dmp
memory/4624-30-0x0000000005A90000-0x0000000005AF6000-memory.dmp