Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 09:34
General
- Target bc2f1f0177f756e3b26c32bbe240fae919283cc7eb690cb0eb2b38a3739073af.exe
- Size 850KB
- Sample261102-ljtwtsstft
- SHA256 bc2f1f0177f756e3b26c32bbe240fae919283cc7eb690cb0eb2b38a3739073af
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc2f1f0177f756e3b26c32bbe240fae919283cc7eb690cb0eb2b38a3739073af.exe"C:\Users\Admin\AppData\Local\Temp\bc2f1f0177f756e3b26c32bbe240fae919283cc7eb690cb0eb2b38a3739073af.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bc2f1f0177f756e3b26c32bbe240fae919283cc7eb690cb0eb2b38a3739073af.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\bc2f1f0177f756e3b26c32bbe240fae919283cc7eb690cb0eb2b38a3739073af.exe"C:\Users\Admin\AppData\Local\Temp\bc2f1f0177f756e3b26c32bbe240fae919283cc7eb690cb0eb2b38a3739073af.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 1843⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1644 -ip 16441⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xpndvlcv.agv.ps1
memory/1644-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1644-32-0x00000000011E0000-0x0000000001226000-memory.dmp
memory/1644-14-0x00000000017C0000-0x0000000001B0A000-memory.dmp
memory/1644-12-0x00000000011E0000-0x0000000001226000-memory.dmp
memory/3504-44-0x0000000004BA0000-0x0000000004BB0000-memory.dmp
memory/3504-31-0x0000000006150000-0x000000000619C000-memory.dmp
memory/3504-55-0x0000000007770000-0x0000000007778000-memory.dmp
memory/3504-54-0x0000000007790000-0x00000000077AA000-memory.dmp
memory/3504-53-0x0000000007690000-0x00000000076A4000-memory.dmp
memory/3504-52-0x0000000007680000-0x000000000768E000-memory.dmp
memory/3504-51-0x0000000007650000-0x0000000007661000-memory.dmp
memory/3504-50-0x00000000076D0000-0x0000000007766000-memory.dmp
memory/3504-49-0x00000000074C0000-0x00000000074CA000-memory.dmp
memory/3504-15-0x0000000004B50000-0x0000000004B86000-memory.dmp
memory/3504-18-0x00000000051E0000-0x0000000005808000-memory.dmp
memory/3504-17-0x0000000004BA0000-0x0000000004BB0000-memory.dmp
memory/3504-16-0x0000000004BA0000-0x0000000004BB0000-memory.dmp
memory/3504-19-0x0000000005150000-0x0000000005172000-memory.dmp
memory/3504-21-0x00000000059E0000-0x0000000005A46000-memory.dmp
memory/3504-20-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/3504-48-0x0000000007450000-0x000000000746A000-memory.dmp
memory/3504-29-0x0000000005B50000-0x0000000005EA4000-memory.dmp
memory/3504-30-0x0000000006120000-0x000000000613E000-memory.dmp
memory/3504-47-0x0000000007AA0000-0x000000000811A000-memory.dmp
memory/3504-43-0x0000000004BA0000-0x0000000004BB0000-memory.dmp
memory/3504-33-0x000000007FDF0000-0x000000007FE00000-memory.dmp
memory/3504-35-0x0000000070B10000-0x0000000070B5C000-memory.dmp
memory/3504-34-0x00000000066F0000-0x0000000006722000-memory.dmp
memory/3504-45-0x0000000006750000-0x000000000676E000-memory.dmp
memory/3504-46-0x0000000007120000-0x00000000071C3000-memory.dmp
memory/3512-0-0x0000000000B80000-0x0000000000C5A000-memory.dmp
memory/3512-1-0x0000000005CC0000-0x0000000006264000-memory.dmp
memory/3512-6-0x0000000008980000-0x000000000899C000-memory.dmp
memory/3512-2-0x0000000005630000-0x00000000056C2000-memory.dmp
memory/3512-3-0x0000000005820000-0x0000000005830000-memory.dmp
memory/3512-4-0x00000000056F0000-0x00000000056FA000-memory.dmp
memory/3512-5-0x00000000058D0000-0x000000000596C000-memory.dmp
memory/3512-10-0x0000000009870000-0x0000000009D3C000-memory.dmp
memory/3512-9-0x0000000009340000-0x000000000986C000-memory.dmp
memory/3512-8-0x0000000008D80000-0x0000000008E0A000-memory.dmp
memory/3512-7-0x0000000005820000-0x0000000005830000-memory.dmp