formbook | 8aa910ce2a90b5fcbba9fab0d1adced17d8043c1cba09621cac2c3b6f7347472

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28052026_0504_stub.ps1
Size 2.2MB
Sample260528-fta9ksht2w
SHA256 8aa910ce2a90b5fcbba9fab0d1adced17d8043c1cba09621cac2c3b6f7347472
MD5 3cd039bc96101a9da92e904ac55a487c
SHA1 823ea124f93adaf09b9766ece49e2f8b5a38a1d0
SHA512 b259933ec9852de1a56d029522651ef1a5ef91ae57d0c873a7c662c1ec9ef7e3fbc4fca47a393e4eb524eb41fc0990d29d56174fa4f4edf3bdc3a21ba0c64ee5
SSDEEP 24576:oeM6JoIZV24QxHAJIp6BSTSNx1Wr7dByJLI6D44Q2MRhaJQIvJs:2
TLSH
T1F9B5BFCAD16E44D29C053FC9A8142BC78B2546728A7400183A7F7D898F7B5FEC15EEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1796-18-0x0000000000980000-0x00000000009C6000-memory.dmp	family_formbook
behavioral1/memory/1796-21-0x0000000000980000-0x00000000009C6000-memory.dmp	family_formbook
behavioral1/memory/1796-30-0x0000000000980000-0x00000000009C6000-memory.dmp	family_formbook
behavioral1/memory/3028-33-0x0000000000890000-0x00000000008D4000-memory.dmp	family_formbook
behavioral1/memory/3028-38-0x0000000000890000-0x00000000008D4000-memory.dmp	family_formbook

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
43	848	powershell.exe
59	848	powershell.exe
73	848	powershell.exe
80	848	powershell.exe
81	848	powershell.exe
82	848	powershell.exe
83	848	powershell.exe
84	848	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	winrs.exe

ConfuserEx .NET packer 4 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/848-11-0x000001AEB9300000-0x000001AEB9314000-memory.dmp	ConfuserEx
behavioral1/memory/848-15-0x000001AEB97F0000-0x000001AEB9804000-memory.dmp	ConfuserEx
behavioral1/memory/848-41-0x000001AE9EBF0000-0x000001AE9EC04000-memory.dmp	ConfuserEx
behavioral1/memory/848-68-0x000001AEB9550000-0x000001AEB9564000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 32 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 1796	848	powershell.exe	97
PID 1796 set thread context of 848	1796	aspnet_compiler.exe	86
PID 1796 set thread context of 3028	1796	aspnet_compiler.exe	98
PID 848 set thread context of 712	848	powershell.exe	106
PID 3028 set thread context of 848	3028	winrs.exe	86
PID 848 set thread context of 4464	848	powershell.exe	111
PID 848 set thread context of 4404	848	powershell.exe	112
PID 848 set thread context of 2528	848	powershell.exe	117
PID 848 set thread context of 2064	848	powershell.exe	119
PID 848 set thread context of 700	848	powershell.exe	120
PID 848 set thread context of 4432	848	powershell.exe	121
PID 848 set thread context of 4408	848	powershell.exe	123
PID 848 set thread context of 4676	848	powershell.exe	126
PID 848 set thread context of 1624	848	powershell.exe	127
PID 848 set thread context of 1748	848	powershell.exe	128
PID 848 set thread context of 2264	848	powershell.exe	129
PID 848 set thread context of 408	848	powershell.exe	131
PID 848 set thread context of 1700	848	powershell.exe	133
PID 3028 set thread context of 1380	3028	winrs.exe	132
PID 848 set thread context of 3840	848	powershell.exe	138
PID 848 set thread context of 4172	848	powershell.exe	142
PID 848 set thread context of 2540	848	powershell.exe	144
PID 3028 set thread context of 1692	3028	winrs.exe	143
PID 848 set thread context of 3016	848	powershell.exe	146
PID 848 set thread context of 2300	848	powershell.exe	147
PID 848 set thread context of 5028	848	powershell.exe	148
PID 848 set thread context of 4088	848	powershell.exe	149
PID 848 set thread context of 1912	848	powershell.exe	153
PID 848 set thread context of 3288	848	powershell.exe	154
PID 848 set thread context of 4956	848	powershell.exe	155
PID 848 set thread context of 1956	848	powershell.exe	158
PID 848 set thread context of 4076	848	powershell.exe	159

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
848	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrs.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	winrs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
1796	aspnet_compiler.exe
1796	aspnet_compiler.exe
1796	aspnet_compiler.exe
1796	aspnet_compiler.exe
848	powershell.exe
3028	winrs.exe
3028	winrs.exe
3028	winrs.exe
3028	winrs.exe
848	powershell.exe
848	powershell.exe
712	aspnet_compiler.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
4464	aspnet_compiler.exe
848	powershell.exe
4404	aspnet_compiler.exe
848	powershell.exe
2528	aspnet_compiler.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
2064	aspnet_compiler.exe
848	powershell.exe
700	aspnet_compiler.exe
848	powershell.exe
4432	aspnet_compiler.exe
848	powershell.exe
4408	aspnet_compiler.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
4676	aspnet_compiler.exe
848	powershell.exe
1624	aspnet_compiler.exe
848	powershell.exe
1748	aspnet_compiler.exe
848	powershell.exe
2264	aspnet_compiler.exe
848	powershell.exe
408	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
1796	aspnet_compiler.exe
848	powershell.exe
848	powershell.exe
3028	winrs.exe
3028	winrs.exe
3028	winrs.exe
3028	winrs.exe
3028	winrs.exe
3028	winrs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 204	848	powershell.exe	90
PID 848 wrote to memory of 4308	848	powershell.exe	91
PID 848 wrote to memory of 4964	848	powershell.exe	92
PID 848 wrote to memory of 3064	848	powershell.exe	93
PID 848 wrote to memory of 2676	848	powershell.exe	94
PID 848 wrote to memory of 1120	848	powershell.exe	95
PID 848 wrote to memory of 2324	848	powershell.exe	96
PID 848 wrote to memory of 1796	848	powershell.exe	97
PID 848 wrote to memory of 1796	848	powershell.exe	97
PID 848 wrote to memory of 1796	848	powershell.exe	97
PID 848 wrote to memory of 3028	848	powershell.exe	98
PID 848 wrote to memory of 712	848	powershell.exe	106
PID 848 wrote to memory of 712	848	powershell.exe	106
PID 848 wrote to memory of 712	848	powershell.exe	106
PID 848 wrote to memory of 644	848	powershell.exe	109
PID 848 wrote to memory of 4412	848	powershell.exe	110
PID 848 wrote to memory of 4464	848	powershell.exe	111
PID 848 wrote to memory of 4464	848	powershell.exe	111
PID 848 wrote to memory of 4464	848	powershell.exe	111
PID 848 wrote to memory of 4404	848	powershell.exe	112
PID 848 wrote to memory of 4404	848	powershell.exe	112
PID 848 wrote to memory of 4404	848	powershell.exe	112
PID 848 wrote to memory of 2528	848	powershell.exe	117
PID 848 wrote to memory of 2528	848	powershell.exe	117
PID 848 wrote to memory of 2528	848	powershell.exe	117
PID 848 wrote to memory of 4224	848	powershell.exe	118
PID 848 wrote to memory of 2064	848	powershell.exe	119
PID 848 wrote to memory of 2064	848	powershell.exe	119
PID 848 wrote to memory of 2064	848	powershell.exe	119
PID 848 wrote to memory of 700	848	powershell.exe	120
PID 848 wrote to memory of 700	848	powershell.exe	120
PID 848 wrote to memory of 700	848	powershell.exe	120
PID 848 wrote to memory of 4432	848	powershell.exe	121
PID 848 wrote to memory of 4432	848	powershell.exe	121
PID 848 wrote to memory of 4432	848	powershell.exe	121
PID 848 wrote to memory of 4408	848	powershell.exe	123
PID 848 wrote to memory of 4408	848	powershell.exe	123
PID 848 wrote to memory of 4408	848	powershell.exe	123
PID 848 wrote to memory of 4568	848	powershell.exe	124
PID 848 wrote to memory of 3996	848	powershell.exe	125
PID 848 wrote to memory of 4676	848	powershell.exe	126
PID 848 wrote to memory of 4676	848	powershell.exe	126
PID 848 wrote to memory of 4676	848	powershell.exe	126
PID 848 wrote to memory of 1624	848	powershell.exe	127
PID 848 wrote to memory of 1624	848	powershell.exe	127
PID 848 wrote to memory of 1624	848	powershell.exe	127
PID 848 wrote to memory of 1748	848	powershell.exe	128
PID 848 wrote to memory of 1748	848	powershell.exe	128
PID 848 wrote to memory of 1748	848	powershell.exe	128
PID 848 wrote to memory of 2264	848	powershell.exe	129
PID 848 wrote to memory of 2264	848	powershell.exe	129
PID 848 wrote to memory of 2264	848	powershell.exe	129
PID 848 wrote to memory of 408	848	powershell.exe	131
PID 848 wrote to memory of 408	848	powershell.exe	131
PID 848 wrote to memory of 408	848	powershell.exe	131
PID 3028 wrote to memory of 1380	3028	winrs.exe	132
PID 848 wrote to memory of 1700	848	powershell.exe	133
PID 848 wrote to memory of 1700	848	powershell.exe	133
PID 848 wrote to memory of 1700	848	powershell.exe	133
PID 848 wrote to memory of 3868	848	powershell.exe	136
PID 848 wrote to memory of 5072	848	powershell.exe	137
PID 848 wrote to memory of 3840	848	powershell.exe	138
PID 848 wrote to memory of 3840	848	powershell.exe	138
PID 848 wrote to memory of 3840	848	powershell.exe	138

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	winrs.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\28052026_0504_stub.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1796
- C:\Windows\SysWOW64\winrs.exe
  "C:\Windows\SysWOW64\winrs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:3028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1380
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_1jgc05d1.t31.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1jgc05d1.t31.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/848-24-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-68-0x000001AEB9550000-0x000001AEB9564000-memory.dmp

Download

memory/848-7-0x000001AEB9310000-0x000001AEB9332000-memory.dmp

Download

memory/848-10-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-11-0x000001AEB9300000-0x000001AEB9314000-memory.dmp

Download

memory/848-12-0x000001AEB97E0000-0x000001AEB97E6000-memory.dmp

Download

memory/848-13-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-14-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-15-0x000001AEB97F0000-0x000001AEB9804000-memory.dmp

Download

memory/848-35-0x0000000000010000-0x000000000247E000-memory.dmp

Download

memory/848-25-0x0000000000010000-0x000000000247E000-memory.dmp

Download

memory/848-17-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-19-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-26-0x000001AEB9340000-0x000001AEB955C000-memory.dmp

Download

memory/848-37-0x000001AEB9AF0000-0x000001AEB9BFA000-memory.dmp

Download

memory/848-0-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-1-0x000001AEB71F0000-0x000001AEB7200000-memory.dmp

Download

memory/848-41-0x000001AE9EBF0000-0x000001AE9EC04000-memory.dmp

Download

memory/1380-56-0x0000024551BC0000-0x0000024551CA6000-memory.dmp

Download

memory/1692-63-0x00000197737F0000-0x00000197738C6000-memory.dmp

Download

memory/1796-22-0x0000000000980000-0x00000000009C6000-memory.dmp

Download

memory/1796-23-0x0000000001320000-0x0000000001344000-memory.dmp

Download

memory/1796-29-0x0000000000980000-0x00000000009C6000-memory.dmp

Download

memory/1796-30-0x0000000000980000-0x00000000009C6000-memory.dmp

Download

memory/1796-31-0x0000000001320000-0x0000000001344000-memory.dmp

Download

memory/1796-16-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1796-20-0x0000000001480000-0x00000000017CA000-memory.dmp

Download

memory/1796-21-0x0000000000980000-0x00000000009C6000-memory.dmp

Download

memory/1796-18-0x0000000000980000-0x00000000009C6000-memory.dmp

Download

memory/3028-38-0x0000000000890000-0x00000000008D4000-memory.dmp

Download

memory/3028-28-0x0000000000890000-0x00000000008D4000-memory.dmp

Download

memory/3028-27-0x0000000000890000-0x00000000008D4000-memory.dmp

Download

memory/3028-33-0x0000000000890000-0x00000000008D4000-memory.dmp

Download

memory/3028-32-0x00000000010B0000-0x00000000013FA000-memory.dmp

Download