Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 12:57
General
- Target NAROČILO_8321.js
- Size 947KB
- Sample260804-p679hs1dkf
- SHA256 e4ea1a522ec3fc617994b77f1d527567c0a21e7a9c92a73366ed2c09382f0a9e
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 9 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\NAROČILO_8321.js2⤵
- Checks computer location settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\nveceos4\net_70332_4072.vbs"3⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\nveceos4\tmp_94216_4005.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ltfyhoij\ltfyhoij.cmdline"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES823B.tmp" "c:\Users\Admin\AppData\Local\Temp\ltfyhoij\CSC773A127CD40641FABEB43059DC0437C.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
-
C:\Windows\SysWOW64\findstr.exe"C:\Windows\SysWOW64\findstr.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES823B.tmp
__PSScriptPolicyTest_1k3l1ae4.jr5.ps1
ltfyhoij.dll
cfg_45839_4005
log_38168_4005
net_70332_4072.vbs
tmp_94216_4005.ps1
CSC773A127CD40641FABEB43059DC0437C.TMP
ltfyhoij.0.cs
ltfyhoij.cmdline
memory/920-42-0x0000000000400000-0x0000000000446000-memory.dmp
memory/920-43-0x0000000001200000-0x0000000001246000-memory.dmp
memory/2428-91-0x000001A618800000-0x000001A6188A3000-memory.dmp
memory/2704-26-0x0000000006450000-0x000000000646A000-memory.dmp
memory/2704-8-0x0000000004F00000-0x0000000005528000-memory.dmp
memory/2704-25-0x0000000007870000-0x0000000007EEA000-memory.dmp
memory/2704-20-0x0000000005EA0000-0x0000000005EBE000-memory.dmp
memory/2704-27-0x0000000007090000-0x00000000070AA000-memory.dmp
memory/2704-19-0x00000000057D0000-0x0000000005B24000-memory.dmp
memory/2704-11-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/2704-10-0x0000000005630000-0x0000000005696000-memory.dmp
memory/2704-9-0x0000000005590000-0x00000000055B2000-memory.dmp
memory/2704-21-0x0000000005F30000-0x0000000005F7C000-memory.dmp
memory/2704-40-0x00000000070B0000-0x00000000070B8000-memory.dmp
memory/2704-41-0x0000000004B30000-0x0000000004B38000-memory.dmp
memory/2704-7-0x0000000000B60000-0x0000000000B70000-memory.dmp
memory/2704-5-0x0000000002870000-0x00000000028A6000-memory.dmp
memory/2704-44-0x0000000007290000-0x0000000007326000-memory.dmp
memory/2704-45-0x0000000007170000-0x0000000007192000-memory.dmp
memory/2704-46-0x00000000084A0000-0x0000000008A44000-memory.dmp
memory/2704-6-0x0000000000B60000-0x0000000000B70000-memory.dmp
memory/3272-71-0x000001F6A4240000-0x000001F6A434C000-memory.dmp
memory/3296-59-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-80-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-53-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-54-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-55-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-57-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-56-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-58-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-51-0x00000000085B0000-0x000000000867A000-memory.dmp
memory/3296-61-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-63-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-62-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-60-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-66-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-65-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-64-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-67-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-107-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-72-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-73-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-74-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-77-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-75-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-76-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-78-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-52-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-83-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-82-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-79-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-81-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-84-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-85-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-86-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-87-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-106-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-92-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-93-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-94-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-95-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-96-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-97-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-98-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-99-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-103-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-102-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-100-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-101-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-104-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3296-105-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/3912-49-0x0000000000C00000-0x0000000000C43000-memory.dmp
memory/3912-50-0x0000000000C00000-0x0000000000C43000-memory.dmp