formbook | 5c5fd3501c142aee580270869bdfa10af7e94fa89086fe8b12666c0580428d57

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Keller.ps1
Size 1.4MB
Sample260428-lfg3vsfx4w
SHA256 5c5fd3501c142aee580270869bdfa10af7e94fa89086fe8b12666c0580428d57
MD5 d84d2dc106ae1818d3e0799e62560fa0
SHA1 47b38547946097fe15a5fd0de33e7be7e3c7e275
SHA512 7f4e6d8044aa6d1d4f74134bd0d404b7dc15ef02a068428d4871f5a0efa7e061e44fdc2d3622c0f6f53bf70c8d04dc9b501a236a3fa8c6e24851769e03fdf74e
SSDEEP 24576:c2WAuMmSDujxAcrlIkOsfKOiPCTRESV7TdF4tZONXx0M1P7osX29tlCVKF:c9N9Ac2ktKOrEYNSr
TLSH
T13B6533008E4A78FE435D8827B9BF7F6812D20717C2D6355799EF12DA0F32B0B4E29956
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/3076-17-0x0000000001000000-0x0000000001046000-memory.dmp	family_formbook
behavioral2/memory/3076-19-0x0000000001000000-0x0000000001046000-memory.dmp	family_formbook
behavioral2/memory/3076-28-0x0000000001000000-0x0000000001046000-memory.dmp	family_formbook
behavioral2/memory/2888-31-0x0000000000A20000-0x0000000000A63000-memory.dmp	family_formbook
behavioral2/memory/3664-33-0x0000000000AC0000-0x0000000000B06000-memory.dmp	family_formbook
behavioral2/memory/3664-35-0x0000000000AC0000-0x0000000000B06000-memory.dmp	family_formbook
behavioral2/memory/2888-36-0x0000000000A20000-0x0000000000A63000-memory.dmp	family_formbook

Badlisted process makes network request 25 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4560	PowerShell.exe
3	4560	PowerShell.exe
4	4560	PowerShell.exe
5	4560	PowerShell.exe
6	4560	PowerShell.exe
7	4560	PowerShell.exe
8	4560	PowerShell.exe
9	4560	PowerShell.exe
10	4560	PowerShell.exe
12	4560	PowerShell.exe
13	4560	PowerShell.exe
14	4560	PowerShell.exe
15	4560	PowerShell.exe
16	4560	PowerShell.exe
17	4560	PowerShell.exe
18	4560	PowerShell.exe
19	4560	PowerShell.exe
20	4560	PowerShell.exe
21	4560	PowerShell.exe
22	4560	PowerShell.exe
23	4560	PowerShell.exe
24	4560	PowerShell.exe
25	4560	PowerShell.exe
26	4560	PowerShell.exe
27	4560	PowerShell.exe

Suspicious use of SetThreadContext 33 IoCs

description	pid	Process	procid_target
PID 4560 set thread context of 3076	4560	PowerShell.exe	86
PID 3076 set thread context of 4560	3076	aspnet_compiler.exe	79
PID 3076 set thread context of 2888	3076	aspnet_compiler.exe	87
PID 4560 set thread context of 3664	4560	PowerShell.exe	88
PID 2888 set thread context of 4560	2888	TCPSVCS.EXE	79
PID 4560 set thread context of 784	4560	PowerShell.exe	89
PID 4560 set thread context of 2868	4560	PowerShell.exe	90
PID 4560 set thread context of 2404	4560	PowerShell.exe	92
PID 2888 set thread context of 3400	2888	TCPSVCS.EXE	91
PID 4560 set thread context of 324	4560	PowerShell.exe	95
PID 4560 set thread context of 2028	4560	PowerShell.exe	99
PID 4560 set thread context of 3660	4560	PowerShell.exe	101
PID 2888 set thread context of 2428	2888	TCPSVCS.EXE	100
PID 4560 set thread context of 980	4560	PowerShell.exe	104
PID 4560 set thread context of 1720	4560	PowerShell.exe	105
PID 4560 set thread context of 1084	4560	PowerShell.exe	106
PID 4560 set thread context of 2940	4560	PowerShell.exe	107
PID 4560 set thread context of 380	4560	PowerShell.exe	108
PID 4560 set thread context of 240	4560	PowerShell.exe	110
PID 4560 set thread context of 628	4560	PowerShell.exe	111
PID 4560 set thread context of 2876	4560	PowerShell.exe	115
PID 4560 set thread context of 3104	4560	PowerShell.exe	116
PID 4560 set thread context of 2324	4560	PowerShell.exe	117
PID 4560 set thread context of 1604	4560	PowerShell.exe	118
PID 4560 set thread context of 1516	4560	PowerShell.exe	119
PID 4560 set thread context of 4948	4560	PowerShell.exe	121
PID 4560 set thread context of 4068	4560	PowerShell.exe	122
PID 4560 set thread context of 3788	4560	PowerShell.exe	124
PID 4560 set thread context of 3520	4560	PowerShell.exe	125
PID 4560 set thread context of 3940	4560	PowerShell.exe	126
PID 4560 set thread context of 3260	4560	PowerShell.exe	128
PID 4560 set thread context of 3900	4560	PowerShell.exe	129
PID 4560 set thread context of 2908	4560	PowerShell.exe	130

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4560	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TCPSVCS.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3847269522-1618051987-1942096715-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	TCPSVCS.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
3076	aspnet_compiler.exe
3076	aspnet_compiler.exe
3076	aspnet_compiler.exe
3076	aspnet_compiler.exe
4560	PowerShell.exe
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE
4560	PowerShell.exe
3664	aspnet_compiler.exe
4560	PowerShell.exe
784	aspnet_compiler.exe
4560	PowerShell.exe
2868	aspnet_compiler.exe
4560	PowerShell.exe
2404	aspnet_compiler.exe
4560	PowerShell.exe
324	aspnet_compiler.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
2028	aspnet_compiler.exe
4560	PowerShell.exe
3660	aspnet_compiler.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
980	aspnet_compiler.exe
4560	PowerShell.exe
1720	aspnet_compiler.exe
4560	PowerShell.exe
1084	aspnet_compiler.exe
4560	PowerShell.exe
2940	aspnet_compiler.exe
4560	PowerShell.exe
380	aspnet_compiler.exe
4560	PowerShell.exe
4560	PowerShell.exe
4560	PowerShell.exe
240	aspnet_compiler.exe
4560	PowerShell.exe
628	aspnet_compiler.exe
4560	PowerShell.exe

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
3076	aspnet_compiler.exe
4560	PowerShell.exe
4560	PowerShell.exe
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE
2888	TCPSVCS.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	PowerShell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3164	4560	PowerShell.exe	81
PID 4560 wrote to memory of 3536	4560	PowerShell.exe	82
PID 4560 wrote to memory of 2948	4560	PowerShell.exe	83
PID 4560 wrote to memory of 2996	4560	PowerShell.exe	84
PID 4560 wrote to memory of 3000	4560	PowerShell.exe	85
PID 4560 wrote to memory of 3076	4560	PowerShell.exe	86
PID 4560 wrote to memory of 3076	4560	PowerShell.exe	86
PID 4560 wrote to memory of 3076	4560	PowerShell.exe	86
PID 4560 wrote to memory of 2888	4560	PowerShell.exe	87
PID 4560 wrote to memory of 3664	4560	PowerShell.exe	88
PID 4560 wrote to memory of 3664	4560	PowerShell.exe	88
PID 4560 wrote to memory of 3664	4560	PowerShell.exe	88
PID 4560 wrote to memory of 784	4560	PowerShell.exe	89
PID 4560 wrote to memory of 784	4560	PowerShell.exe	89
PID 4560 wrote to memory of 784	4560	PowerShell.exe	89
PID 4560 wrote to memory of 2868	4560	PowerShell.exe	90
PID 4560 wrote to memory of 2868	4560	PowerShell.exe	90
PID 4560 wrote to memory of 2868	4560	PowerShell.exe	90
PID 2888 wrote to memory of 3400	2888	TCPSVCS.EXE	91
PID 4560 wrote to memory of 2404	4560	PowerShell.exe	92
PID 4560 wrote to memory of 2404	4560	PowerShell.exe	92
PID 4560 wrote to memory of 2404	4560	PowerShell.exe	92
PID 4560 wrote to memory of 324	4560	PowerShell.exe	95
PID 4560 wrote to memory of 324	4560	PowerShell.exe	95
PID 4560 wrote to memory of 324	4560	PowerShell.exe	95
PID 4560 wrote to memory of 1532	4560	PowerShell.exe	96
PID 4560 wrote to memory of 1640	4560	PowerShell.exe	97
PID 4560 wrote to memory of 2956	4560	PowerShell.exe	98
PID 4560 wrote to memory of 2028	4560	PowerShell.exe	99
PID 4560 wrote to memory of 2028	4560	PowerShell.exe	99
PID 4560 wrote to memory of 2028	4560	PowerShell.exe	99
PID 2888 wrote to memory of 2428	2888	TCPSVCS.EXE	100
PID 4560 wrote to memory of 3660	4560	PowerShell.exe	101
PID 4560 wrote to memory of 3660	4560	PowerShell.exe	101
PID 4560 wrote to memory of 3660	4560	PowerShell.exe	101
PID 4560 wrote to memory of 4932	4560	PowerShell.exe	102
PID 4560 wrote to memory of 3816	4560	PowerShell.exe	103
PID 4560 wrote to memory of 980	4560	PowerShell.exe	104
PID 4560 wrote to memory of 980	4560	PowerShell.exe	104
PID 4560 wrote to memory of 980	4560	PowerShell.exe	104
PID 4560 wrote to memory of 1720	4560	PowerShell.exe	105
PID 4560 wrote to memory of 1720	4560	PowerShell.exe	105
PID 4560 wrote to memory of 1720	4560	PowerShell.exe	105
PID 4560 wrote to memory of 1084	4560	PowerShell.exe	106
PID 4560 wrote to memory of 1084	4560	PowerShell.exe	106
PID 4560 wrote to memory of 1084	4560	PowerShell.exe	106
PID 4560 wrote to memory of 2940	4560	PowerShell.exe	107
PID 4560 wrote to memory of 2940	4560	PowerShell.exe	107
PID 4560 wrote to memory of 2940	4560	PowerShell.exe	107
PID 4560 wrote to memory of 380	4560	PowerShell.exe	108
PID 4560 wrote to memory of 380	4560	PowerShell.exe	108
PID 4560 wrote to memory of 380	4560	PowerShell.exe	108
PID 4560 wrote to memory of 232	4560	PowerShell.exe	109
PID 4560 wrote to memory of 240	4560	PowerShell.exe	110
PID 4560 wrote to memory of 240	4560	PowerShell.exe	110
PID 4560 wrote to memory of 240	4560	PowerShell.exe	110
PID 4560 wrote to memory of 628	4560	PowerShell.exe	111
PID 4560 wrote to memory of 628	4560	PowerShell.exe	111
PID 4560 wrote to memory of 628	4560	PowerShell.exe	111
PID 4560 wrote to memory of 1132	4560	PowerShell.exe	112
PID 4560 wrote to memory of 4716	4560	PowerShell.exe	113
PID 4560 wrote to memory of 2452	4560	PowerShell.exe	114
PID 4560 wrote to memory of 2876	4560	PowerShell.exe	115
PID 4560 wrote to memory of 2876	4560	PowerShell.exe	115

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Keller.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3076
- C:\Windows\SysWOW64\TCPSVCS.EXE
  "C:\Windows\SysWOW64\TCPSVCS.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3400
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_h2pyqaio.tij.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2pyqaio.tij.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/784-45-0x00000000018C0000-0x0000000001C16000-memory.dmp

Download

memory/2428-71-0x000002AECE1D0000-0x000002AECE2A6000-memory.dmp

Download

memory/2868-49-0x00000000011C0000-0x0000000001516000-memory.dmp

Download

memory/2888-37-0x0000000001150000-0x00000000011F4000-memory.dmp

Download

memory/2888-25-0x0000000000A20000-0x0000000000A63000-memory.dmp

Download

memory/2888-60-0x0000000005AC0000-0x0000000005BBE000-memory.dmp

Download

memory/2888-31-0x0000000000A20000-0x0000000000A63000-memory.dmp

Download

memory/2888-26-0x0000000000A20000-0x0000000000A63000-memory.dmp

Download

memory/2888-46-0x0000000001150000-0x00000000011F4000-memory.dmp

Download

memory/2888-36-0x0000000000A20000-0x0000000000A63000-memory.dmp

Download

memory/2888-30-0x0000000001250000-0x00000000015A6000-memory.dmp

Download

memory/3076-17-0x0000000001000000-0x0000000001046000-memory.dmp

Download

memory/3076-16-0x0000000001600000-0x0000000001956000-memory.dmp

Download

memory/3076-19-0x0000000001000000-0x0000000001046000-memory.dmp

Download

memory/3076-20-0x0000000001590000-0x00000000015B5000-memory.dmp

Download

memory/3076-29-0x0000000001590000-0x00000000015B5000-memory.dmp

Download

memory/3076-12-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3076-15-0x0000000001000000-0x0000000001046000-memory.dmp

Download

memory/3076-28-0x0000000001000000-0x0000000001046000-memory.dmp

Download

memory/3400-58-0x000001D903000000-0x000001D9030FB000-memory.dmp

Download

memory/3664-35-0x0000000000AC0000-0x0000000000B06000-memory.dmp

Download

memory/3664-34-0x0000000000FA0000-0x00000000012F6000-memory.dmp

Download

memory/3664-33-0x0000000000AC0000-0x0000000000B06000-memory.dmp

Download

memory/4560-18-0x00000269FBD00000-0x00000269FBD10000-memory.dmp

Download

memory/4560-39-0x00000269FDFC0000-0x00000269FE095000-memory.dmp

Download

memory/4560-10-0x00000269FDCF0000-0x00000269FDCFC000-memory.dmp

Download

memory/4560-23-0x00000269FDB70000-0x00000269FDC5A000-memory.dmp

Download

memory/4560-24-0x00000269FD5E0000-0x00000269FD5F2000-memory.dmp

Download

memory/4560-22-0x00000269FBD50000-0x00000269FBD58000-memory.dmp

Download

memory/4560-1-0x00000269FBD00000-0x00000269FBD10000-memory.dmp

Download

memory/4560-38-0x00000269FDFC0000-0x00000269FE095000-memory.dmp

Download

memory/4560-21-0x00000269FBCF0000-0x00000269FBCFC000-memory.dmp

Download

memory/4560-9-0x00000269FBD00000-0x00000269FBD10000-memory.dmp

Download

memory/4560-13-0x00000269FBD00000-0x00000269FBD10000-memory.dmp

Download

memory/4560-48-0x00000269FDFC0000-0x00000269FE095000-memory.dmp

Download

memory/4560-2-0x00000269FDD00000-0x00000269FDD22000-memory.dmp

Download

memory/4560-14-0x00000269FBD00000-0x00000269FBD10000-memory.dmp

Download

memory/4560-11-0x00000269FDF90000-0x00000269FDF98000-memory.dmp

Download

memory/4560-0-0x00000269FBD00000-0x00000269FBD10000-memory.dmp

Download