Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 12:19
General
- Target PAGO-29-07-26.pdf.js
- Size 48KB
- Sample260730-phex3axclc
- SHA256 5074b37a866644a70785e11a49187fe99017d17377539fbd2f5cd2b7db01feaa
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PAGO-29-07-26.pdf.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Invoke-Expression $env:corroi"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2964-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2964-22-0x0000000000DC0000-0x0000000000E06000-memory.dmp
memory/2964-21-0x0000000000DC0000-0x0000000000E06000-memory.dmp
memory/2964-20-0x00000000013F0000-0x0000000001764000-memory.dmp
memory/2964-17-0x0000000000DC0000-0x0000000000E06000-memory.dmp
memory/4276-7-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-14-0x0000021EFB8D0000-0x0000021EFB962000-memory.dmp
memory/4276-9-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-10-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-11-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-12-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-13-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-8-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-15-0x0000021EFBAC0000-0x0000021EFBACA000-memory.dmp
memory/4276-0-0x00007FFC7D55F000-0x00007FFC7D560000-memory.dmp
memory/4276-6-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-19-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-5-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp
memory/4276-4-0x0000021EFB870000-0x0000021EFB892000-memory.dmp
memory/4276-3-0x00007FFC7D3D0000-0x00007FFC7DD74000-memory.dmp