formbook | a13b343a426a77ca6777f53691d9e17d6843f0171c9d2869b708c320340a9bf0

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps_3JvSUZsKwGmt_1777540134843.ps1
Size 1.5MB
Sample260430-phbweaes5w
SHA256 a13b343a426a77ca6777f53691d9e17d6843f0171c9d2869b708c320340a9bf0
MD5 8c713bb58892e0054cc6bdc53601e4f9
SHA1 480eb1249f05bfeb7b89fab32eac05bb61f7630f
SHA512 4217e5bd6157f305ccd577899fe81c46293f0e1205885b2cd511ec561d12f82c687a30f59c60dd835d514edbf695cd9d1f149018f90771085d6cff952819e4bf
SSDEEP 24576:L9oxBAJy+5KCeqH5nCmErm28hRuJZ9hsRrMNn4yIdx:R8AIc4WGWMe
TLSH
T10B6533205CF0BD6A97E8025868FBFEB55BC00FC3409EE1270B5124960A9F715D97FA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution formbook persistence privilege_escalation rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/6056-12-0x0000000000740000-0x0000000000786000-memory.dmp	family_formbook
behavioral2/memory/6056-16-0x0000000000740000-0x0000000000786000-memory.dmp	family_formbook
behavioral2/memory/6056-27-0x0000000000740000-0x0000000000786000-memory.dmp	family_formbook
behavioral2/memory/5676-29-0x00000000009B0000-0x00000000009F3000-memory.dmp	family_formbook
behavioral2/memory/5676-36-0x00000000009B0000-0x00000000009F3000-memory.dmp	family_formbook

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1388	PowerShell.exe
3	1388	PowerShell.exe
4	1388	PowerShell.exe
6	1388	PowerShell.exe
7	1388	PowerShell.exe
8	1388	PowerShell.exe
9	1388	PowerShell.exe

Suspicious use of SetThreadContext 34 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 6056	1388	PowerShell.exe	85
PID 6056 set thread context of 1388	6056	aspnet_compiler.exe	78
PID 6056 set thread context of 5676	6056	aspnet_compiler.exe	86
PID 1388 set thread context of 4300	1388	PowerShell.exe	87
PID 5676 set thread context of 1388	5676	sethc.exe	78
PID 1388 set thread context of 1880	1388	PowerShell.exe	88
PID 1388 set thread context of 644	1388	PowerShell.exe	89
PID 1388 set thread context of 3392	1388	PowerShell.exe	90
PID 1388 set thread context of 6020	1388	PowerShell.exe	91
PID 1388 set thread context of 3824	1388	PowerShell.exe	92
PID 1388 set thread context of 3088	1388	PowerShell.exe	93
PID 1388 set thread context of 2976	1388	PowerShell.exe	95
PID 1388 set thread context of 4144	1388	PowerShell.exe	96
PID 1388 set thread context of 5292	1388	PowerShell.exe	97
PID 1388 set thread context of 2588	1388	PowerShell.exe	98
PID 1388 set thread context of 1340	1388	PowerShell.exe	99
PID 1388 set thread context of 5616	1388	PowerShell.exe	100
PID 1388 set thread context of 5628	1388	PowerShell.exe	103
PID 1388 set thread context of 4752	1388	PowerShell.exe	106
PID 1388 set thread context of 5868	1388	PowerShell.exe	109
PID 1388 set thread context of 6064	1388	PowerShell.exe	110
PID 1388 set thread context of 2772	1388	PowerShell.exe	112
PID 1388 set thread context of 1324	1388	PowerShell.exe	115
PID 5676 set thread context of 1292	5676	sethc.exe	113
PID 1388 set thread context of 1556	1388	PowerShell.exe	118
PID 1388 set thread context of 4924	1388	PowerShell.exe	121
PID 1388 set thread context of 1412	1388	PowerShell.exe	124
PID 5676 set thread context of 5200	5676	sethc.exe	122
PID 1388 set thread context of 4164	1388	PowerShell.exe	126
PID 1388 set thread context of 1784	1388	PowerShell.exe	127
PID 1388 set thread context of 2324	1388	PowerShell.exe	129
PID 5676 set thread context of 2972	5676	sethc.exe	128
PID 1388 set thread context of 3136	1388	PowerShell.exe	130
PID 1388 set thread context of 5000	1388	PowerShell.exe	131

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1388	PowerShell.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sethc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2397528088-2630719772-1129911217-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	sethc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
6056	aspnet_compiler.exe
6056	aspnet_compiler.exe
6056	aspnet_compiler.exe
6056	aspnet_compiler.exe
1388	PowerShell.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe
1388	PowerShell.exe
4300	aspnet_compiler.exe
1388	PowerShell.exe
1880	aspnet_compiler.exe
1388	PowerShell.exe
644	aspnet_compiler.exe
1388	PowerShell.exe
3392	aspnet_compiler.exe
1388	PowerShell.exe
6020	aspnet_compiler.exe
1388	PowerShell.exe
3824	aspnet_compiler.exe
1388	PowerShell.exe
3088	aspnet_compiler.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
2976	aspnet_compiler.exe
1388	PowerShell.exe
4144	aspnet_compiler.exe
1388	PowerShell.exe
5292	aspnet_compiler.exe
1388	PowerShell.exe
2588	aspnet_compiler.exe
1388	PowerShell.exe
1340	aspnet_compiler.exe
1388	PowerShell.exe
5616	aspnet_compiler.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
5628	aspnet_compiler.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
1388	PowerShell.exe
4752	aspnet_compiler.exe
1388	PowerShell.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
6056	aspnet_compiler.exe
1388	PowerShell.exe
1388	PowerShell.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe
5676	sethc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	PowerShell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 5668	1388	PowerShell.exe	80
PID 1388 wrote to memory of 5060	1388	PowerShell.exe	81
PID 1388 wrote to memory of 5660	1388	PowerShell.exe	82
PID 1388 wrote to memory of 4780	1388	PowerShell.exe	83
PID 1388 wrote to memory of 5752	1388	PowerShell.exe	84
PID 1388 wrote to memory of 6056	1388	PowerShell.exe	85
PID 1388 wrote to memory of 6056	1388	PowerShell.exe	85
PID 1388 wrote to memory of 6056	1388	PowerShell.exe	85
PID 1388 wrote to memory of 5676	1388	PowerShell.exe	86
PID 1388 wrote to memory of 4300	1388	PowerShell.exe	87
PID 1388 wrote to memory of 4300	1388	PowerShell.exe	87
PID 1388 wrote to memory of 4300	1388	PowerShell.exe	87
PID 1388 wrote to memory of 1880	1388	PowerShell.exe	88
PID 1388 wrote to memory of 1880	1388	PowerShell.exe	88
PID 1388 wrote to memory of 1880	1388	PowerShell.exe	88
PID 1388 wrote to memory of 644	1388	PowerShell.exe	89
PID 1388 wrote to memory of 644	1388	PowerShell.exe	89
PID 1388 wrote to memory of 644	1388	PowerShell.exe	89
PID 1388 wrote to memory of 3392	1388	PowerShell.exe	90
PID 1388 wrote to memory of 3392	1388	PowerShell.exe	90
PID 1388 wrote to memory of 3392	1388	PowerShell.exe	90
PID 1388 wrote to memory of 6020	1388	PowerShell.exe	91
PID 1388 wrote to memory of 6020	1388	PowerShell.exe	91
PID 1388 wrote to memory of 6020	1388	PowerShell.exe	91
PID 1388 wrote to memory of 3824	1388	PowerShell.exe	92
PID 1388 wrote to memory of 3824	1388	PowerShell.exe	92
PID 1388 wrote to memory of 3824	1388	PowerShell.exe	92
PID 1388 wrote to memory of 3088	1388	PowerShell.exe	93
PID 1388 wrote to memory of 3088	1388	PowerShell.exe	93
PID 1388 wrote to memory of 3088	1388	PowerShell.exe	93
PID 1388 wrote to memory of 5932	1388	PowerShell.exe	94
PID 1388 wrote to memory of 2976	1388	PowerShell.exe	95
PID 1388 wrote to memory of 2976	1388	PowerShell.exe	95
PID 1388 wrote to memory of 2976	1388	PowerShell.exe	95
PID 1388 wrote to memory of 4144	1388	PowerShell.exe	96
PID 1388 wrote to memory of 4144	1388	PowerShell.exe	96
PID 1388 wrote to memory of 4144	1388	PowerShell.exe	96
PID 1388 wrote to memory of 5292	1388	PowerShell.exe	97
PID 1388 wrote to memory of 5292	1388	PowerShell.exe	97
PID 1388 wrote to memory of 5292	1388	PowerShell.exe	97
PID 1388 wrote to memory of 2588	1388	PowerShell.exe	98
PID 1388 wrote to memory of 2588	1388	PowerShell.exe	98
PID 1388 wrote to memory of 2588	1388	PowerShell.exe	98
PID 1388 wrote to memory of 1340	1388	PowerShell.exe	99
PID 1388 wrote to memory of 1340	1388	PowerShell.exe	99
PID 1388 wrote to memory of 1340	1388	PowerShell.exe	99
PID 1388 wrote to memory of 5616	1388	PowerShell.exe	100
PID 1388 wrote to memory of 5616	1388	PowerShell.exe	100
PID 1388 wrote to memory of 5616	1388	PowerShell.exe	100
PID 1388 wrote to memory of 3240	1388	PowerShell.exe	101
PID 1388 wrote to memory of 1488	1388	PowerShell.exe	102
PID 1388 wrote to memory of 5628	1388	PowerShell.exe	103
PID 1388 wrote to memory of 5628	1388	PowerShell.exe	103
PID 1388 wrote to memory of 5628	1388	PowerShell.exe	103
PID 1388 wrote to memory of 1244	1388	PowerShell.exe	104
PID 1388 wrote to memory of 5632	1388	PowerShell.exe	105
PID 1388 wrote to memory of 4752	1388	PowerShell.exe	106
PID 1388 wrote to memory of 4752	1388	PowerShell.exe	106
PID 1388 wrote to memory of 4752	1388	PowerShell.exe	106
PID 1388 wrote to memory of 5672	1388	PowerShell.exe	107
PID 1388 wrote to memory of 872	1388	PowerShell.exe	108
PID 1388 wrote to memory of 5868	1388	PowerShell.exe	109
PID 1388 wrote to memory of 5868	1388	PowerShell.exe	109
PID 1388 wrote to memory of 5868	1388	PowerShell.exe	109

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps_3JvSUZsKwGmt_1777540134843.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:6056
- C:\Windows\SysWOW64\sethc.exe
  "C:\Windows\SysWOW64\sethc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5200
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:6064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_eokjbkgx.igf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eokjbkgx.igf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1292-74-0x0000024598680000-0x0000024598745000-memory.dmp

Download

memory/1388-17-0x0000019E641A0000-0x0000019E641B0000-memory.dmp

Download

memory/1388-0-0x0000019E641A0000-0x0000019E641B0000-memory.dmp

Download

memory/1388-9-0x0000019E641A0000-0x0000019E641B0000-memory.dmp

Download

memory/1388-10-0x0000019E64490000-0x0000019E644A8000-memory.dmp

Download

memory/1388-22-0x0000019E643A0000-0x0000019E643B2000-memory.dmp

Download

memory/1388-14-0x0000019E641A0000-0x0000019E641B0000-memory.dmp

Download

memory/1388-13-0x0000019E641A0000-0x0000019E641B0000-memory.dmp

Download

memory/1388-31-0x00000000000D0000-0x0000000002460000-memory.dmp

Download

memory/1388-21-0x0000019E64180000-0x0000019E6418C000-memory.dmp

Download

memory/1388-32-0x0000019E644F0000-0x0000019E645D3000-memory.dmp

Download

memory/1388-2-0x0000019E64400000-0x0000019E64422000-memory.dmp

Download

memory/1388-20-0x00000000000D0000-0x0000000002460000-memory.dmp

Download

memory/1388-1-0x0000019E641A0000-0x0000019E641B0000-memory.dmp

Download

memory/2972-94-0x000001E3EC2C0000-0x000001E3EC37E000-memory.dmp

Download

memory/5200-85-0x0000026F566D0000-0x0000026F567D5000-memory.dmp

Download

memory/5676-36-0x00000000009B0000-0x00000000009F3000-memory.dmp

Download

memory/5676-73-0x0000000001040000-0x00000000010A4000-memory.dmp

Download

memory/5676-29-0x00000000009B0000-0x00000000009F3000-memory.dmp

Download

memory/5676-23-0x00000000009B0000-0x00000000009F3000-memory.dmp

Download

memory/5676-24-0x00000000009B0000-0x00000000009F3000-memory.dmp

Download

memory/6056-15-0x0000000000B00000-0x0000000000E56000-memory.dmp

Download

memory/6056-27-0x0000000000740000-0x0000000000786000-memory.dmp

Download

memory/6056-25-0x0000000000740000-0x0000000000786000-memory.dmp

Download

memory/6056-28-0x00000000032F0000-0x0000000003314000-memory.dmp

Download

memory/6056-19-0x00000000032F0000-0x0000000003314000-memory.dmp

Download

memory/6056-18-0x0000000000740000-0x0000000000786000-memory.dmp

Download

memory/6056-16-0x0000000000740000-0x0000000000786000-memory.dmp

Download

memory/6056-12-0x0000000000740000-0x0000000000786000-memory.dmp

Download

memory/6056-11-0x0000000000400000-0x0000000000446000-memory.dmp

Download