formbook | ba4bd1e18af0cc4a13645abe2b46d5355229ea0a619abb9baddb942d93224107

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/10/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO4501895496.js
Size 30KB
Sample261008-hsw6rssvgx
SHA256 ba4bd1e18af0cc4a13645abe2b46d5355229ea0a619abb9baddb942d93224107
MD5 47c924127b9ae20d72441457dc5c7c16
SHA1 1c83bdae19019b5d12bb811c8f5ce054bd7ef652
SHA512 46c9af6debac95742d4eef260b2c430657a2593fd976d76f74f94ab1aee9ce92b5ac7c6323f27855aa8e8081f5262caa4a549a6ac7cfe315e67b795ba9a839c1
SSDEEP 768:RdfDEzPH7uHZds9NobzsSBeEZ6VYoeNVvtzMCY+P46qGJTov0oKT:Rmz6HwazFx/
TLSH
T134E20D80498275845373673AAA2AA8E5FB770BB701814947B9BC7494DFF1908DEF0DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution formbook privilege_escalation rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1880-36-0x0000000000F30000-0x0000000000F76000-memory.dmp	family_formbook
behavioral2/memory/1880-38-0x0000000000F30000-0x0000000000F76000-memory.dmp	family_formbook
behavioral2/memory/1880-41-0x0000000000F30000-0x0000000000F76000-memory.dmp	family_formbook
behavioral2/memory/1896-42-0x0000000000840000-0x0000000000883000-memory.dmp	family_formbook

Badlisted process makes network request 28 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4612	wscript.exe
6	4612	wscript.exe
8	4612	wscript.exe
9	4612	wscript.exe
10	4612	wscript.exe
14	4612	wscript.exe
18	4612	wscript.exe
19	4612	wscript.exe
20	4612	wscript.exe
21	4612	wscript.exe
22	4612	wscript.exe
23	4612	wscript.exe
24	4612	wscript.exe
25	4612	wscript.exe
26	4612	wscript.exe
27	4612	wscript.exe
28	4612	wscript.exe
29	4612	wscript.exe
30	4612	wscript.exe
31	4612	wscript.exe
32	4612	wscript.exe
33	4612	wscript.exe
34	4612	wscript.exe
35	4612	wscript.exe
36	4612	wscript.exe
37	4612	wscript.exe
38	4612	wscript.exe
39	4612	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	w32tm.exe

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 1880	2416	powershell.exe	96
PID 1880 set thread context of 4612	1880	aspnet_compiler.exe	87
PID 1880 set thread context of 1896	1880	aspnet_compiler.exe	97
PID 2416 set thread context of 2636	2416	powershell.exe	99
PID 1896 set thread context of 4612	1896	w32tm.exe	87
PID 2416 set thread context of 5980	2416	powershell.exe	100
PID 2416 set thread context of 4588	2416	powershell.exe	101
PID 2416 set thread context of 1640	2416	powershell.exe	102
PID 2416 set thread context of 2540	2416	powershell.exe	104
PID 1896 set thread context of 5572	1896	w32tm.exe	103
PID 2416 set thread context of 2628	2416	powershell.exe	107
PID 2416 set thread context of 5584	2416	powershell.exe	108
PID 2416 set thread context of 592	2416	powershell.exe	110
PID 1896 set thread context of 3296	1896	w32tm.exe	109
PID 2416 set thread context of 4748	2416	powershell.exe	111
PID 2416 set thread context of 4768	2416	powershell.exe	112
PID 2416 set thread context of 2068	2416	powershell.exe	113
PID 2416 set thread context of 568	2416	powershell.exe	116
PID 2416 set thread context of 4904	2416	powershell.exe	117
PID 2416 set thread context of 1696	2416	powershell.exe	119
PID 2416 set thread context of 3732	2416	powershell.exe	120
PID 2416 set thread context of 4704	2416	powershell.exe	121
PID 2416 set thread context of 2796	2416	powershell.exe	122
PID 2416 set thread context of 1792	2416	powershell.exe	123
PID 2416 set thread context of 1304	2416	powershell.exe	124
PID 2416 set thread context of 5444	2416	powershell.exe	127
PID 2416 set thread context of 5424	2416	powershell.exe	128
PID 2416 set thread context of 2360	2416	powershell.exe	130
PID 2416 set thread context of 5820	2416	powershell.exe	131
PID 2416 set thread context of 4432	2416	powershell.exe	132

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-53044966-3830981193-2402648431-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	w32tm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
1880	aspnet_compiler.exe
1880	aspnet_compiler.exe
1880	aspnet_compiler.exe
1880	aspnet_compiler.exe
2416	powershell.exe
2416	powershell.exe
1896	w32tm.exe
1896	w32tm.exe
1896	w32tm.exe
1896	w32tm.exe
2416	powershell.exe
2636	aspnet_compiler.exe
2416	powershell.exe
5980	aspnet_compiler.exe
2416	powershell.exe
4588	aspnet_compiler.exe
2416	powershell.exe
1640	aspnet_compiler.exe
2416	powershell.exe
2540	aspnet_compiler.exe
2416	powershell.exe
2628	aspnet_compiler.exe
2416	powershell.exe
5584	aspnet_compiler.exe
2416	powershell.exe
592	aspnet_compiler.exe
2416	powershell.exe
4748	aspnet_compiler.exe
2416	powershell.exe
4768	aspnet_compiler.exe
2416	powershell.exe
2068	aspnet_compiler.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
568	aspnet_compiler.exe
2416	powershell.exe
4904	aspnet_compiler.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
1696	aspnet_compiler.exe
2416	powershell.exe
3732	aspnet_compiler.exe
2416	powershell.exe
4704	aspnet_compiler.exe
2416	powershell.exe
2796	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 1 TTPs 9 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1880	aspnet_compiler.exe
4612	wscript.exe
4612	wscript.exe
1896	w32tm.exe
1896	w32tm.exe
1896	w32tm.exe
1896	w32tm.exe
1896	w32tm.exe
1896	w32tm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2416	4612	wscript.exe	89
PID 2416 wrote to memory of 248	2416	powershell.exe	91
PID 2416 wrote to memory of 260	2416	powershell.exe	92
PID 2416 wrote to memory of 688	2416	powershell.exe	93
PID 2416 wrote to memory of 3372	2416	powershell.exe	94
PID 2416 wrote to memory of 4852	2416	powershell.exe	95
PID 2416 wrote to memory of 1880	2416	powershell.exe	96
PID 2416 wrote to memory of 1880	2416	powershell.exe	96
PID 2416 wrote to memory of 1880	2416	powershell.exe	96
PID 4612 wrote to memory of 1896	4612	wscript.exe	97
PID 2416 wrote to memory of 2636	2416	powershell.exe	99
PID 2416 wrote to memory of 2636	2416	powershell.exe	99
PID 2416 wrote to memory of 2636	2416	powershell.exe	99
PID 2416 wrote to memory of 5980	2416	powershell.exe	100
PID 2416 wrote to memory of 5980	2416	powershell.exe	100
PID 2416 wrote to memory of 5980	2416	powershell.exe	100
PID 2416 wrote to memory of 4588	2416	powershell.exe	101
PID 2416 wrote to memory of 4588	2416	powershell.exe	101
PID 2416 wrote to memory of 4588	2416	powershell.exe	101
PID 2416 wrote to memory of 1640	2416	powershell.exe	102
PID 2416 wrote to memory of 1640	2416	powershell.exe	102
PID 2416 wrote to memory of 1640	2416	powershell.exe	102
PID 1896 wrote to memory of 5572	1896	w32tm.exe	103
PID 2416 wrote to memory of 2540	2416	powershell.exe	104
PID 2416 wrote to memory of 2540	2416	powershell.exe	104
PID 2416 wrote to memory of 2540	2416	powershell.exe	104
PID 2416 wrote to memory of 2628	2416	powershell.exe	107
PID 2416 wrote to memory of 2628	2416	powershell.exe	107
PID 2416 wrote to memory of 2628	2416	powershell.exe	107
PID 2416 wrote to memory of 5584	2416	powershell.exe	108
PID 2416 wrote to memory of 5584	2416	powershell.exe	108
PID 2416 wrote to memory of 5584	2416	powershell.exe	108
PID 1896 wrote to memory of 3296	1896	w32tm.exe	109
PID 2416 wrote to memory of 592	2416	powershell.exe	110
PID 2416 wrote to memory of 592	2416	powershell.exe	110
PID 2416 wrote to memory of 592	2416	powershell.exe	110
PID 2416 wrote to memory of 4748	2416	powershell.exe	111
PID 2416 wrote to memory of 4748	2416	powershell.exe	111
PID 2416 wrote to memory of 4748	2416	powershell.exe	111
PID 2416 wrote to memory of 4768	2416	powershell.exe	112
PID 2416 wrote to memory of 4768	2416	powershell.exe	112
PID 2416 wrote to memory of 4768	2416	powershell.exe	112
PID 2416 wrote to memory of 2068	2416	powershell.exe	113
PID 2416 wrote to memory of 2068	2416	powershell.exe	113
PID 2416 wrote to memory of 2068	2416	powershell.exe	113
PID 2416 wrote to memory of 6048	2416	powershell.exe	114
PID 2416 wrote to memory of 2376	2416	powershell.exe	115
PID 2416 wrote to memory of 568	2416	powershell.exe	116
PID 2416 wrote to memory of 568	2416	powershell.exe	116
PID 2416 wrote to memory of 568	2416	powershell.exe	116
PID 2416 wrote to memory of 4904	2416	powershell.exe	117
PID 2416 wrote to memory of 4904	2416	powershell.exe	117
PID 2416 wrote to memory of 4904	2416	powershell.exe	117
PID 2416 wrote to memory of 1536	2416	powershell.exe	118
PID 2416 wrote to memory of 1696	2416	powershell.exe	119
PID 2416 wrote to memory of 1696	2416	powershell.exe	119
PID 2416 wrote to memory of 1696	2416	powershell.exe	119
PID 2416 wrote to memory of 3732	2416	powershell.exe	120
PID 2416 wrote to memory of 3732	2416	powershell.exe	120
PID 2416 wrote to memory of 3732	2416	powershell.exe	120
PID 2416 wrote to memory of 4704	2416	powershell.exe	121
PID 2416 wrote to memory of 4704	2416	powershell.exe	121
PID 2416 wrote to memory of 4704	2416	powershell.exe	121
PID 2416 wrote to memory of 2796	2416	powershell.exe	122

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	w32tm.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO4501895496.js
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\GGOMQ3XR.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1880
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4748
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2068
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:6048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4904
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2796
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5424
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5820
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4432
- C:\Windows\SysWOW64\w32tm.exe
  "C:\Windows\SysWOW64\w32tm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:1896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5572
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GGOMQ3XR.ps1

Path C:\Temp\GGOMQ3XR.ps1
Size 1.5MB
SHA256 6c196428e65a6fe1939db93080871823d3004842fadd033149fede736e8b376c
MD5 a38c5ff1fd698314fbc42fe330b6e935
SHA1 a4c52bcdf197d773e724e0c85fec82ddb29c6917
SHA512 a708e975cab179ff03384eede150b56e17b5455a1e9e0891d42c333960cdef3d30beb818cbebaacccc88a771a6832be67d95ad09f8e60da7fb78770a35196c8b
SSDEEP 24576:/MTjkr9BhuTShxI1beikmYyNlQEJ5J/LDEy2ys3FfJ67fvdkm8lj3K:kTFjJMyclE3dM6
TLSH
T1D16523795D1A15FF4C11BAFAB061B89534E963CB090307B762AC87E13371C6A87ABC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1880-35-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1880-41-0x0000000000F30000-0x0000000000F76000-memory.dmp

Download

memory/1880-38-0x0000000000F30000-0x0000000000F76000-memory.dmp

Download

memory/1880-37-0x00000000014F0000-0x0000000001864000-memory.dmp

Download

memory/1880-36-0x0000000000F30000-0x0000000000F76000-memory.dmp

Download

memory/1896-42-0x0000000000840000-0x0000000000883000-memory.dmp

Download

memory/1896-39-0x0000000000840000-0x0000000000883000-memory.dmp

Download

memory/2416-23-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-34-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-25-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-26-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-27-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-28-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-29-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-30-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-31-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-32-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-33-0x000001F0541C0000-0x000001F0541D8000-memory.dmp

Download

memory/2416-24-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-22-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-13-0x00007FFFBC4FF000-0x00007FFFBC500000-memory.dmp

Download

memory/2416-21-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-19-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-18-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/2416-17-0x000001F054810000-0x000001F054832000-memory.dmp

Download

memory/2416-14-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/3296-59-0x00000250A2BA0000-0x00000250A2C76000-memory.dmp

Download

memory/4612-44-0x0000012145810000-0x0000012145907000-memory.dmp

Download

memory/5572-52-0x000001D212190000-0x000001D21223D000-memory.dmp

Download