powershell_ise.exe

  • File Path: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
  • Description: Windows PowerShell ISE

Screenshot

powershell_ise.exe

Hashes

Type Hash
MD5 83B61B8AE3AE5CA669E1CBB191B4852D
SHA1 1350ABFA1319526847102A08714D8159DC79FB64
SHA256 CD65AE1EBB2B8EE7DEA364729A14D3CF4221C0EA9156B55A84EAD138F5C146E3
SHA384 C9496564E48385EB4893442774D71DB39FDA2791FA59AF6A9920623900B982B099EEE4B0C8BDD67AFBD1D41A37698355
SHA512 2BA7211B7586D5C14602209B858F7ECBA42A901B1287C0B773118D62799E75CCF0618535EB600F959FBF81226060CCB6F83E89B08AF80795731FAECB440B0278
SSDEEP 3072:bwUkVjGPsw40vLkVjqP4w6U+ToIuWNXmmZTWl/jC7gDooMLa6:bfk+uZToIuUXmmZbgDooMz
IMP F34D5F2D4577ED6D9CEEC516C1F5A744
PESHA1 B317AFABDD3B6D278D89E5552797B053483571CD
PE256 7028F281E80D26C6451B7BB256EBF3D21E105C813B4C2B14A68487AFBD627183

Runtime Data

Window Title:

Windows PowerShell ISE

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\imageres.dll.mui File
(R-D) C:\Windows\System32\en-US\winnlsres.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_261b62a767ca4e6d File
...\Cor_SxSPublic_IPCBlock Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\Cor_Private_IPCBlock_v4_4108 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme2131664586 Section
\Windows\Theme966197582 Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: powershell_ise.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link: https://www.virustotal.com/gui/file/cd65ae1ebb2b8ee7dea364729a14d3cf4221c0ea9156b55a84ead138f5c146e3/detection/

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe 90
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe 90
C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe 86
C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe 96
C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe 90
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 90
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 90
C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 90
C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 90

Possible Misuse

The following table contains possible examples of powershell_ise.exe being misused. While powershell_ise.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_in_memory_powershell.yml - '\powershell_ise.exe' DRL 1.0
sigma pipe_created_alternate_powershell_hosts_pipe.yml - '\powershell_ise.exe' DRL 1.0
sigma proc_creation_win_renamed_binary.yml - 'powershell_ise.exe' DRL 1.0
sigma proc_creation_win_renamed_binary.yml - '\powershell_ise.exe' DRL 1.0
sigma proc_creation_win_renamed_binary_highly_relevant.yml - 'powershell_ise.exe' DRL 1.0
sigma proc_creation_win_renamed_binary_highly_relevant.yml - '\powershell_ise.exe' DRL 1.0
sigma proc_creation_win_renamed_powershell.yml - '\powershell_ise.exe' DRL 1.0
sigma proc_creation_win_susp_bitstransfer.yml - '\powershell_ise.exe' DRL 1.0
atomic-red-team T1059.001.md 1. Open Powershell_ise as a Privileged Account MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

PowerShell_ise

Windows PowerShell Integrated Scripting Environment (ISE) is a graphical host application that enables you to read, write, run, debug, and test scripts and modules in a graphic-assisted environment. Key features such as IntelliSense, Show-Command, snippets, tab completion, syntax-coloring, visual debugging, and context-sensitive Help provide a rich scripting experience.

Using PowerShell.exe

The PowerShell_ISE.exe tool starts a Windows PowerShell ISE session. When you use PowerShell_ISE.exe, you can use its optional parameters to open files in Windows PowerShell ISE or to start a Windows PowerShell ISE session with no profile or with a multithreaded apartment.

  • To start a Windows PowerShell ISE session in a Command Prompt window, in Windows PowerShell, or at the Start menu, type:

    PowerShell_Ise.exe

  • To open a script (.ps1), script module (.psm1), module manifest (.psd1), XML file, or any other supported file in Windows PowerShell ISE, type:

    PowerShell_Ise.exe <filepath>

    In Windows PowerShell 3.0, you can use the optional File parameter as follows:

    PowerShell_Ise.exe -file <filepath>

  • To start a Windows PowerShell ISE session without your Windows PowerShell profiles, use the NoProfile parameter. (The NoProfile parameter is introduced in Windows PowerShell 3.0.), type:

    PowerShell_Ise.exe -NoProfile

  • To see the PowerShell_ISE.exe help file, type:

      PowerShell_Ise.exe -help
  PowerShell_Ise.exe -?
  PowerShell_Ise.exe /?

Remarks

  • For a complete list of the PowerShell_ISE.exe command-line parameters, see about_PowerShell_Ise.Exe.

  • For information about other ways to start Windows PowerShell, see Starting Windows PowerShell.

  • Windows PowerShell runs on the Server Core installation option of Windows Server operating systems. However, because Windows PowerShell ISE requires a graphic user interface, it does not run on Server Core installations.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.