Analysis
- max time kernel
299s - max time network
300s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 02:58
General
- Target SHIPMENT-PL & CI & BL draft for HF26XF0116A.js
- Size 4.6MB
- Sample261024-dgbcps11hv
- SHA256 616a435efaa23abf2b388bd9f3d18a07e9b0a9788d23cf9d957809e16e5a947e
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 2 IoCs
- NTFS ADS 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 61 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 5 IoCs
- Suspicious use of AdjustPrivilegeToken 58 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SHIPMENT-PL & CI & BL draft for HF26XF0116A.js"2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\SHIPMENT-PL & CI & BL draft for HF26XF0116A.js:Zone.Identifier"3⤵
- Executes a command shell one-liner
- NTFS ADS
-
-
C:\Users\Admin\Documents\JOYBKFUZQUKSUSJR.exe"C:\Users\Admin\Documents\JOYBKFUZQUKSUSJR.exe" C:\Users\Admin\Documents\RJSUSKUQZUFKBYOJ3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "JOYBKFUZQUKSUSJR" 2>nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /query /tn "JOYBKFUZQUKSUSJR"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 10 /tn "JOYBKFUZQUKSUSJR" /tr "wscript.exe \"C:\Users\Admin\Documents\RJSUSKUQZUFKBYOJ.vbs\"" /ru "Admin" /f /it4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 10 /tn "JOYBKFUZQUKSUSJR" /tr "wscript.exe \"C:\Users\Admin\Documents\RJSUSKUQZUFKBYOJ.vbs\"" /ru "Admin" /f /it5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\SysWOW64\PING.EXE"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies Internet Explorer settings
- Runs ping.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
JOYBKFUZQUKSUSJR.exe
JOYBKFUZQUKSUSJR.mui
RJSUSKUQZUFKBYOJ
memory/4624-51-0x000001F4EC5E0000-0x000001F4EC6A5000-memory.dmp
memory/4700-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-37-0x00000000028F0000-0x0000000002936000-memory.dmp
memory/4700-38-0x0000000002A40000-0x0000000002A86000-memory.dmp
memory/4700-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4700-40-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4700-42-0x0000000000400000-0x0000000000482000-memory.dmp
memory/5080-44-0x0000000005610000-0x000000000572F000-memory.dmp
memory/5972-43-0x0000000000110000-0x0000000000154000-memory.dmp
memory/5972-39-0x0000000000110000-0x0000000000154000-memory.dmp