formbook | 42255ff1914882e20ddb9116b521287dccd2bee944e056bc8f1bd1c2970299a6

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER & SPECIFICATION.xlsm
Size 2.1MB
Sample260713-vx83caew9w
SHA256 42255ff1914882e20ddb9116b521287dccd2bee944e056bc8f1bd1c2970299a6
MD5 e87eb0b055f81acd5167b817b6c4bd96
SHA1 19b550354b493af8be565a3c30b927bb6588b6ea
SHA512 254942220e689417fb2a7c40524e91ce658bf8bd932b523489b318cb1ed1b87f50769655544bc5478f1f26aad4c4b544c415fdc31c3d52b537efd929e4ae4633
SSDEEP 49152:xPyqcb1KIss6Ri1CB2Cw8oYRq75Npv8SNlbDPLP7mPFFaoz9GW3r45:xaqcb1KIT6nB2Cw8675XkSNdzfmjdRGN
TLSH
T134A533607C760FD5C12D00FB82417269696A05FAF72097FF897B93E89CD50A76EC06E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3324-77-0x00000000012D0000-0x0000000001316000-memory.dmp	family_formbook
behavioral2/memory/5240-89-0x0000000000B70000-0x0000000000BB3000-memory.dmp	family_formbook

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2376	1136	wscript.exe	86
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5240	1136	PATHPING.EXE	86

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3384	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	PATHPING.EXE

Suspicious use of SetThreadContext 22 IoCs

description	pid	Process	procid_target
PID 3384 set thread context of 3324	3384	powershell.exe	99
PID 3324 set thread context of 1136	3324	aspnet_compiler.exe	86
PID 3324 set thread context of 5240	3324	aspnet_compiler.exe	100
PID 3384 set thread context of 4360	3384	powershell.exe	102
PID 5240 set thread context of 1136	5240	PATHPING.EXE	86
PID 3384 set thread context of 2440	3384	powershell.exe	104
PID 3384 set thread context of 3136	3384	powershell.exe	105
PID 3384 set thread context of 2344	3384	powershell.exe	106
PID 3384 set thread context of 2924	3384	powershell.exe	107
PID 3384 set thread context of 4996	3384	powershell.exe	108
PID 3384 set thread context of 5648	3384	powershell.exe	110
PID 3384 set thread context of 4664	3384	powershell.exe	114
PID 3384 set thread context of 2828	3384	powershell.exe	117
PID 5240 set thread context of 2052	5240	PATHPING.EXE	115
PID 3384 set thread context of 5156	3384	powershell.exe	118
PID 3384 set thread context of 4268	3384	powershell.exe	119
PID 3384 set thread context of 3684	3384	powershell.exe	120
PID 3384 set thread context of 4552	3384	powershell.exe	121
PID 3384 set thread context of 5376	3384	powershell.exe	122
PID 3384 set thread context of 4972	3384	powershell.exe	123
PID 3384 set thread context of 2184	3384	powershell.exe	126
PID 3384 set thread context of 2256	3384	powershell.exe	127

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PATHPING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5240	PATHPING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1936	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-552508041-2681165170-3229858294-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	PATHPING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1136	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3324	aspnet_compiler.exe
3324	aspnet_compiler.exe
3324	aspnet_compiler.exe
3324	aspnet_compiler.exe
3384	powershell.exe
5240	PATHPING.EXE
5240	PATHPING.EXE
5240	PATHPING.EXE
5240	PATHPING.EXE
3384	powershell.exe
4360	aspnet_compiler.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
2440	aspnet_compiler.exe
3384	powershell.exe
3136	aspnet_compiler.exe
3384	powershell.exe
2344	aspnet_compiler.exe
3384	powershell.exe
2924	aspnet_compiler.exe
3384	powershell.exe
4996	aspnet_compiler.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
5648	aspnet_compiler.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
4664	aspnet_compiler.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
2828	aspnet_compiler.exe
3384	powershell.exe
5156	aspnet_compiler.exe
3384	powershell.exe
4268	aspnet_compiler.exe
3384	powershell.exe
3684	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3324	aspnet_compiler.exe
1136	EXCEL.EXE
1136	EXCEL.EXE
5240	PATHPING.EXE
5240	PATHPING.EXE
5240	PATHPING.EXE
5240	PATHPING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	1936	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1136	EXCEL.EXE
1136	EXCEL.EXE

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE
1136	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2376	1136	EXCEL.EXE	89
PID 2376 wrote to memory of 3384	2376	wscript.exe	90
PID 3384 wrote to memory of 4072	3384	powershell.exe	92
PID 3384 wrote to memory of 1208	3384	powershell.exe	93
PID 3384 wrote to memory of 2580	3384	powershell.exe	94
PID 3384 wrote to memory of 4244	3384	powershell.exe	95
PID 3384 wrote to memory of 984	3384	powershell.exe	96
PID 3384 wrote to memory of 2540	3384	powershell.exe	97
PID 3384 wrote to memory of 2852	3384	powershell.exe	98
PID 3384 wrote to memory of 3324	3384	powershell.exe	99
PID 3384 wrote to memory of 3324	3384	powershell.exe	99
PID 3384 wrote to memory of 3324	3384	powershell.exe	99
PID 1136 wrote to memory of 5240	1136	EXCEL.EXE	100
PID 3384 wrote to memory of 4360	3384	powershell.exe	102
PID 3384 wrote to memory of 4360	3384	powershell.exe	102
PID 3384 wrote to memory of 4360	3384	powershell.exe	102
PID 3384 wrote to memory of 2292	3384	powershell.exe	103
PID 3384 wrote to memory of 2440	3384	powershell.exe	104
PID 3384 wrote to memory of 2440	3384	powershell.exe	104
PID 3384 wrote to memory of 2440	3384	powershell.exe	104
PID 3384 wrote to memory of 3136	3384	powershell.exe	105
PID 3384 wrote to memory of 3136	3384	powershell.exe	105
PID 3384 wrote to memory of 3136	3384	powershell.exe	105
PID 3384 wrote to memory of 2344	3384	powershell.exe	106
PID 3384 wrote to memory of 2344	3384	powershell.exe	106
PID 3384 wrote to memory of 2344	3384	powershell.exe	106
PID 3384 wrote to memory of 2924	3384	powershell.exe	107
PID 3384 wrote to memory of 2924	3384	powershell.exe	107
PID 3384 wrote to memory of 2924	3384	powershell.exe	107
PID 3384 wrote to memory of 4996	3384	powershell.exe	108
PID 3384 wrote to memory of 4996	3384	powershell.exe	108
PID 3384 wrote to memory of 4996	3384	powershell.exe	108
PID 3384 wrote to memory of 5732	3384	powershell.exe	109
PID 3384 wrote to memory of 5648	3384	powershell.exe	110
PID 3384 wrote to memory of 5648	3384	powershell.exe	110
PID 3384 wrote to memory of 5648	3384	powershell.exe	110
PID 3384 wrote to memory of 796	3384	powershell.exe	111
PID 3384 wrote to memory of 1952	3384	powershell.exe	112
PID 3384 wrote to memory of 3604	3384	powershell.exe	113
PID 3384 wrote to memory of 4664	3384	powershell.exe	114
PID 3384 wrote to memory of 4664	3384	powershell.exe	114
PID 3384 wrote to memory of 4664	3384	powershell.exe	114
PID 5240 wrote to memory of 2052	5240	PATHPING.EXE	115
PID 3384 wrote to memory of 1720	3384	powershell.exe	116
PID 3384 wrote to memory of 2828	3384	powershell.exe	117
PID 3384 wrote to memory of 2828	3384	powershell.exe	117
PID 3384 wrote to memory of 2828	3384	powershell.exe	117
PID 3384 wrote to memory of 5156	3384	powershell.exe	118
PID 3384 wrote to memory of 5156	3384	powershell.exe	118
PID 3384 wrote to memory of 5156	3384	powershell.exe	118
PID 3384 wrote to memory of 4268	3384	powershell.exe	119
PID 3384 wrote to memory of 4268	3384	powershell.exe	119
PID 3384 wrote to memory of 4268	3384	powershell.exe	119
PID 3384 wrote to memory of 3684	3384	powershell.exe	120
PID 3384 wrote to memory of 3684	3384	powershell.exe	120
PID 3384 wrote to memory of 3684	3384	powershell.exe	120
PID 3384 wrote to memory of 4552	3384	powershell.exe	121
PID 3384 wrote to memory of 4552	3384	powershell.exe	121
PID 3384 wrote to memory of 4552	3384	powershell.exe	121
PID 3384 wrote to memory of 5376	3384	powershell.exe	122
PID 3384 wrote to memory of 5376	3384	powershell.exe	122
PID 3384 wrote to memory of 5376	3384	powershell.exe	122
PID 3384 wrote to memory of 4972	3384	powershell.exe	123
PID 3384 wrote to memory of 4972	3384	powershell.exe	123

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	PATHPING.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\NEW ORDER & SPECIFICATION.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\uyPR_AEVtw.js"
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_rnqIqys6TIVO_1783963417442.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:4072
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:1208
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2580
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:4244
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:984
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2540
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2852
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3324
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4360
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2292
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2440
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3136
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2344
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2924
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:5732
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5648
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:796
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:1952
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:3604
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4664
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:1720
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2828
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5156
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4268
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3684
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:4552
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:5376
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:4972
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2080
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:3092
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2184
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2256
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\Windows\SysWOW64\PATHPING.EXE
  "C:\Windows\SysWOW64\PATHPING.EXE"
  2⤵
  - Process spawned unexpected child process
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:5240
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_rnqIqys6TIVO_1783963417442.ps1

Path C:\Temp\ps_rnqIqys6TIVO_1783963417442.ps1
Size 1.5MB
SHA256 1dc876ac9bd4197bc10b386b89f797ac2634d5148f09b08cb4f4ac8e51437acb
MD5 2b86f2bd011c1f93cd94f27e0c9b1791
SHA1 66a8ef1bdcd63836245c7f58688cc400de034504
SHA512 8dcbe0bd66587075d64329d6a552c353e45466d20be50234e3f36916727986e2a84572ca4fcaac28cdccab94ff78c92732a10deb124b58ff0d27189c299cbfeb
SSDEEP 24576:mZCb1fLzgTQw7mQRY2cKxh6b0dKUKcSHj9cE/9eQ6ktRdTKPhNfiL4:ltztQpcmhKcSB/8PXa4
TLSH
T16175232949992BDE4E11E2F97E70B494F0DC138348CB2607835E8BB573AD874DEA7D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 3KB
SHA256 df954c6808805630033342a3a8582fb30f25b0ee6702636f2c9a14b92c080e7e
MD5 4c83b585b4569cc987dc83ae7d8698ed
SHA1 f3f09b3af3481fbd2af9e59f848a9e6244df420f
SHA512 c6dcc5445f5a4b9d4d7dd8c4f7583981fc34d891b23290d76dea3e35feed6ac4a233dc7cf57e57f67b7fcfc95f7eda1c91ed8e83dc95a3c854191dce86d672ad
TLSH
T1CA51F101568B8F6AC45502B12F2F4B1AFF307D12AB2067EFA5C5510F3DB2C508A6DA5B
MD5 SHA1 SHA512 TLSH

Submit Download

uyPR_AEVtw.js

Path C:\Users\Admin\AppData\Roaming\uyPR_AEVtw.js
Size 2.0MB
SHA256 fd7d97f8dbbf065ee546a992a0e45e2f896435a60f38626a5665a9df8950b17c
MD5 36b15ad2dfaacaa43417a2246a21b4f2
SHA1 360e99e167dde0e380e8c098b4eb4bdcba6cac5a
SHA512 905eb4e2a3ec65358ae90ee23125bb897593740c3278bdc6f47ef3a8635dec8be71142e0b8f8c46b85f742e94b090898e30db056ce34fe11ab084840139b81eb
SSDEEP 24576:5kLxka5AvQXz3IWK7bHT5vNvWb7TEA+sjUjSq4H4y+kA1AJaZF8Yfx2rYaaPkpVp:k1D3E10bdwjSRHoSJw7tm
TLSH
T10CA5F2105B886F6F8BAC1A18D07E155FF3E10B8614677CCAEF637D4A6FE660091231B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-39-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-38-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-5-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-6-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-7-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-9-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-8-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-10-0x00007FFC4E460000-0x00007FFC4E470000-memory.dmp

Download

memory/1136-11-0x00007FFC4E460000-0x00007FFC4E470000-memory.dmp

Download

memory/1136-32-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-31-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-35-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-34-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-33-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-55-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-37-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-36-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-0-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-4-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-46-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-75-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-3-0x00007FFC908BF000-0x00007FFC908C0000-memory.dmp

Download

memory/1136-131-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-1-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-127-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-67-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-128-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-130-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-78-0x00007FFC90760000-0x00007FFC909C3000-memory.dmp

Download

memory/1136-2-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-129-0x00007FFC508A0000-0x00007FFC508B0000-memory.dmp

Download

memory/1136-125-0x00000197B77F0000-0x00000197B78FD000-memory.dmp

Download

memory/1136-91-0x00000197B77F0000-0x00000197B78FD000-memory.dmp

Download

memory/2052-110-0x000001990E940000-0x000001990EA52000-memory.dmp

Download

memory/3324-77-0x00000000012D0000-0x0000000001316000-memory.dmp

Download

memory/3324-76-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3384-74-0x0000022F6DE10000-0x0000022F6DE28000-memory.dmp

Download

memory/3384-72-0x0000022F6DD70000-0x0000022F6DD92000-memory.dmp

Download

memory/5240-89-0x0000000000B70000-0x0000000000BB3000-memory.dmp

Download

memory/5240-87-0x0000000000B70000-0x0000000000BB3000-memory.dmp

Download