formbook | f4fc837294cd35d055086334ac3f13af32928d6b5830eab2b2c5249e4784233c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/10/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PPL-RFQ-PI-035 And Spare Parts.js
Size 30KB
Sample261008-ll9p3aev8k
SHA256 f4fc837294cd35d055086334ac3f13af32928d6b5830eab2b2c5249e4784233c
MD5 c26bab8eaafe2243942948dab69ad786
SHA1 ae0bb63a29b902a58889247de4e9044f21cf778a
SHA512 bf47b5b2dc3f2686e42710c1c14da46a74d7a2e00acdcf7bc366a6fcac0ad49789e0c68a7bb395fde8372f0e630b048bd85a0d203a6d61403d46f3e43bdb2da3
SSDEEP 768:RdfDEzPH7uHZds/N+bzsSBeEZkVYoeTVvtzMCY+P46qGJTov0osl:Rmz6HuUzVxb
TLSH
T15CE20E80498274845373673AAA2AA8E5FB770BB701814947B9BC7495DFF1908DEF0DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution formbook privilege_escalation rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3360-35-0x00000000011B0000-0x00000000011F6000-memory.dmp	family_formbook
behavioral2/memory/3360-37-0x00000000011B0000-0x00000000011F6000-memory.dmp	family_formbook
behavioral2/memory/3360-40-0x00000000011B0000-0x00000000011F6000-memory.dmp	family_formbook
behavioral2/memory/1308-41-0x0000000000950000-0x0000000000993000-memory.dmp	family_formbook

Badlisted process makes network request 27 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5468	wscript.exe
7	5468	wscript.exe
8	5468	wscript.exe
10	5468	wscript.exe
13	5468	wscript.exe
17	5468	wscript.exe
18	5468	wscript.exe
19	5468	wscript.exe
20	5468	wscript.exe
21	5468	wscript.exe
22	5468	wscript.exe
23	5468	wscript.exe
24	5468	wscript.exe
25	5468	wscript.exe
26	5468	wscript.exe
27	5468	wscript.exe
28	5468	wscript.exe
29	5468	wscript.exe
30	5468	wscript.exe
31	5468	wscript.exe
32	5468	wscript.exe
33	5468	wscript.exe
34	5468	wscript.exe
35	5468	wscript.exe
36	5468	wscript.exe
37	5468	wscript.exe
38	5468	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cmdkey.exe

Suspicious use of SetThreadContext 29 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 3360	2824	powershell.exe	96
PID 3360 set thread context of 5468	3360	aspnet_compiler.exe	88
PID 3360 set thread context of 1308	3360	aspnet_compiler.exe	97
PID 2824 set thread context of 3768	2824	powershell.exe	100
PID 1308 set thread context of 5468	1308	cmdkey.exe	88
PID 2824 set thread context of 2640	2824	powershell.exe	101
PID 2824 set thread context of 2856	2824	powershell.exe	102
PID 2824 set thread context of 1748	2824	powershell.exe	106
PID 1308 set thread context of 2200	1308	cmdkey.exe	103
PID 2824 set thread context of 1312	2824	powershell.exe	109
PID 2824 set thread context of 4264	2824	powershell.exe	110
PID 2824 set thread context of 1812	2824	powershell.exe	112
PID 1308 set thread context of 5100	1308	cmdkey.exe	111
PID 2824 set thread context of 2004	2824	powershell.exe	113
PID 2824 set thread context of 5804	2824	powershell.exe	114
PID 2824 set thread context of 6028	2824	powershell.exe	117
PID 2824 set thread context of 2136	2824	powershell.exe	118
PID 2824 set thread context of 4720	2824	powershell.exe	119
PID 2824 set thread context of 4076	2824	powershell.exe	121
PID 2824 set thread context of 4360	2824	powershell.exe	122
PID 2824 set thread context of 5128	2824	powershell.exe	123
PID 2824 set thread context of 5524	2824	powershell.exe	125
PID 2824 set thread context of 1500	2824	powershell.exe	126
PID 2824 set thread context of 2376	2824	powershell.exe	127
PID 2824 set thread context of 5980	2824	powershell.exe	130
PID 2824 set thread context of 6020	2824	powershell.exe	131
PID 2824 set thread context of 4692	2824	powershell.exe	133
PID 2824 set thread context of 1332	2824	powershell.exe	134
PID 2824 set thread context of 5048	2824	powershell.exe	135

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2824	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmdkey.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4280978039-528710165-233981602-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmdkey.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
3360	aspnet_compiler.exe
3360	aspnet_compiler.exe
3360	aspnet_compiler.exe
3360	aspnet_compiler.exe
2824	powershell.exe
1308	cmdkey.exe
1308	cmdkey.exe
1308	cmdkey.exe
1308	cmdkey.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
3768	aspnet_compiler.exe
2824	powershell.exe
2640	aspnet_compiler.exe
2824	powershell.exe
2856	aspnet_compiler.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
1748	aspnet_compiler.exe
2824	powershell.exe
1312	aspnet_compiler.exe
2824	powershell.exe
4264	aspnet_compiler.exe
2824	powershell.exe
1812	aspnet_compiler.exe
2824	powershell.exe
2004	aspnet_compiler.exe
2824	powershell.exe
5804	aspnet_compiler.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
6028	aspnet_compiler.exe
2824	powershell.exe
2136	aspnet_compiler.exe
2824	powershell.exe
4720	aspnet_compiler.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
4076	aspnet_compiler.exe
2824	powershell.exe
4360	aspnet_compiler.exe
2824	powershell.exe

Suspicious behavior: MapViewOfSection 1 TTPs 9 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3360	aspnet_compiler.exe
5468	wscript.exe
5468	wscript.exe
1308	cmdkey.exe
1308	cmdkey.exe
1308	cmdkey.exe
1308	cmdkey.exe
1308	cmdkey.exe
1308	cmdkey.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5468 wrote to memory of 2824	5468	wscript.exe	89
PID 2824 wrote to memory of 3040	2824	powershell.exe	91
PID 2824 wrote to memory of 2600	2824	powershell.exe	92
PID 2824 wrote to memory of 728	2824	powershell.exe	93
PID 2824 wrote to memory of 5116	2824	powershell.exe	94
PID 2824 wrote to memory of 5628	2824	powershell.exe	95
PID 2824 wrote to memory of 3360	2824	powershell.exe	96
PID 2824 wrote to memory of 3360	2824	powershell.exe	96
PID 2824 wrote to memory of 3360	2824	powershell.exe	96
PID 5468 wrote to memory of 1308	5468	wscript.exe	97
PID 2824 wrote to memory of 2772	2824	powershell.exe	99
PID 2824 wrote to memory of 3768	2824	powershell.exe	100
PID 2824 wrote to memory of 3768	2824	powershell.exe	100
PID 2824 wrote to memory of 3768	2824	powershell.exe	100
PID 2824 wrote to memory of 2640	2824	powershell.exe	101
PID 2824 wrote to memory of 2640	2824	powershell.exe	101
PID 2824 wrote to memory of 2640	2824	powershell.exe	101
PID 2824 wrote to memory of 2856	2824	powershell.exe	102
PID 2824 wrote to memory of 2856	2824	powershell.exe	102
PID 2824 wrote to memory of 2856	2824	powershell.exe	102
PID 1308 wrote to memory of 2200	1308	cmdkey.exe	103
PID 2824 wrote to memory of 5636	2824	powershell.exe	104
PID 2824 wrote to memory of 4564	2824	powershell.exe	105
PID 2824 wrote to memory of 1748	2824	powershell.exe	106
PID 2824 wrote to memory of 1748	2824	powershell.exe	106
PID 2824 wrote to memory of 1748	2824	powershell.exe	106
PID 2824 wrote to memory of 1312	2824	powershell.exe	109
PID 2824 wrote to memory of 1312	2824	powershell.exe	109
PID 2824 wrote to memory of 1312	2824	powershell.exe	109
PID 2824 wrote to memory of 4264	2824	powershell.exe	110
PID 2824 wrote to memory of 4264	2824	powershell.exe	110
PID 2824 wrote to memory of 4264	2824	powershell.exe	110
PID 1308 wrote to memory of 5100	1308	cmdkey.exe	111
PID 2824 wrote to memory of 1812	2824	powershell.exe	112
PID 2824 wrote to memory of 1812	2824	powershell.exe	112
PID 2824 wrote to memory of 1812	2824	powershell.exe	112
PID 2824 wrote to memory of 2004	2824	powershell.exe	113
PID 2824 wrote to memory of 2004	2824	powershell.exe	113
PID 2824 wrote to memory of 2004	2824	powershell.exe	113
PID 2824 wrote to memory of 5804	2824	powershell.exe	114
PID 2824 wrote to memory of 5804	2824	powershell.exe	114
PID 2824 wrote to memory of 5804	2824	powershell.exe	114
PID 2824 wrote to memory of 4136	2824	powershell.exe	115
PID 2824 wrote to memory of 5060	2824	powershell.exe	116
PID 2824 wrote to memory of 6028	2824	powershell.exe	117
PID 2824 wrote to memory of 6028	2824	powershell.exe	117
PID 2824 wrote to memory of 6028	2824	powershell.exe	117
PID 2824 wrote to memory of 2136	2824	powershell.exe	118
PID 2824 wrote to memory of 2136	2824	powershell.exe	118
PID 2824 wrote to memory of 2136	2824	powershell.exe	118
PID 2824 wrote to memory of 4720	2824	powershell.exe	119
PID 2824 wrote to memory of 4720	2824	powershell.exe	119
PID 2824 wrote to memory of 4720	2824	powershell.exe	119
PID 2824 wrote to memory of 5408	2824	powershell.exe	120
PID 2824 wrote to memory of 4076	2824	powershell.exe	121
PID 2824 wrote to memory of 4076	2824	powershell.exe	121
PID 2824 wrote to memory of 4076	2824	powershell.exe	121
PID 2824 wrote to memory of 4360	2824	powershell.exe	122
PID 2824 wrote to memory of 4360	2824	powershell.exe	122
PID 2824 wrote to memory of 4360	2824	powershell.exe	122
PID 2824 wrote to memory of 5128	2824	powershell.exe	123
PID 2824 wrote to memory of 5128	2824	powershell.exe	123
PID 2824 wrote to memory of 5128	2824	powershell.exe	123
PID 2824 wrote to memory of 992	2824	powershell.exe	124

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cmdkey.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PPL-RFQ-PI-035 And Spare Parts.js"
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\3682ABWY.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2600
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:728
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2772
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5636
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1748
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4264
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6028
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5128
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:6020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1332
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5048
- C:\Windows\SysWOW64\cmdkey.exe
  "C:\Windows\SysWOW64\cmdkey.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:1308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2200
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:5100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3682ABWY.ps1

Path C:\Temp\3682ABWY.ps1
Size 1.5MB
SHA256 d6d2c160520d2a833e0c7be0339dfdac3fa49dcf265be1ffb953cc2ea2125044
MD5 665df163fd814c2e6c6bbff3e50a088b
SHA1 768fd20e89e4d2fbac8f75ba5a99f7398c0b6b7c
SHA512 bdb46040d1175e4af2a234e4dca3b7c9380e0ccef4b072aa9843c14ddec7a22b7f64ebdbd790289c61394193c311380e4ee7f5f3a60a909f4f793e8be79a778c
SSDEEP 24576:ErLjZR1vpeYWGBYedbWqxZIWe29BTDOWdm4p5nuPkejtPPcD:sL1bQDWziWDBOXPcD
TLSH
T13375236C79A601DF040371FFB287BC4862DC72CB1D09431B13EEC6A136BA1A5989BDB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-41-0x0000000000950000-0x0000000000993000-memory.dmp

Download

memory/1308-38-0x0000000000950000-0x0000000000993000-memory.dmp

Download

memory/2200-50-0x0000020587E80000-0x0000020587F73000-memory.dmp

Download

memory/2824-27-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-30-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-19-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-17-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-21-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-22-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-23-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-24-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-25-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-26-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-11-0x00007FFB0102F000-0x00007FFB01030000-memory.dmp

Download

memory/2824-28-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-29-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-18-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-31-0x0000019101CF0000-0x0000019101D08000-memory.dmp

Download

memory/2824-32-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-33-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-12-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/2824-13-0x000001911A400000-0x000001911A422000-memory.dmp

Download

memory/2824-16-0x00007FFB00EA0000-0x00007FFB01844000-memory.dmp

Download

memory/3360-37-0x00000000011B0000-0x00000000011F6000-memory.dmp

Download

memory/3360-36-0x0000000001760000-0x0000000001AD4000-memory.dmp

Download

memory/3360-40-0x00000000011B0000-0x00000000011F6000-memory.dmp

Download

memory/3360-35-0x00000000011B0000-0x00000000011F6000-memory.dmp

Download

memory/3360-34-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5100-57-0x00000255566A0000-0x0000025556775000-memory.dmp

Download

memory/5468-43-0x00000264874E0000-0x00000264875FE000-memory.dmp

Download