3682f9d56a3be170fe972643bea5c99bfe4df8c54a66484b0a0d20837399d16b

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gf-browser-dom-xss-probe.ps1
Size 837B
Sample260606-ykhamsct2x
SHA256 3682f9d56a3be170fe972643bea5c99bfe4df8c54a66484b0a0d20837399d16b
MD5 eb01193498b07c8faebf82bdfe8a1850
SHA1 a99ad5fa7a9918211f89513bfccb45df4c17e757
SHA512 01be201e8f1af5bdd2c022d97a5971e546d447af52db6fd77561057a673c678547a580904cab50fee907c08d471c8e6508af47aca816fefef2671a931864d73c
TLSH
T1C5011E3C4D30D3E2E8AAEF5B84F0E7324D1D641C401B498902BC80546D26BC4ED6FA8D
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4664	PowerShell.exe
4312	powershell.exe
3968	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4664	PowerShell.exe
4664	PowerShell.exe
4312	powershell.exe
4312	powershell.exe
3968	powershell.exe
3968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	PowerShell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4312	4664	PowerShell.exe	81
PID 4664 wrote to memory of 3968	4664	PowerShell.exe	83

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\gf-browser-dom-xss-probe.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\gf-browser-dom-child.ps1 GFDOMHTML:<img src=x onerror="document.body.setAttribute('data-gfox-html-xss','gfox-dom-html-20260606-165031-ka6qbd')">
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\gf-browser-dom-child.ps1 GFDOMJS:</script><script>document.body.setAttribute('data-gfox-js-xss','gfox-dom-js-20260606-165031-ka6qbd')</script>
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cca996ce3a1fb9cc44bcacc9002798fc66eab27146004d38e65ef98539510f66
MD5 be40db6c8fd0d8b32dd97d14f10f8d1c
SHA1 b0f3a526f60d03ca3e0e6ecd5340358b0d345768
SHA512 0c595146fef4919951f9f04b2f13a03094d51c87063882ffe9beb1f1b0e36fb08ca3ff53bdf0bf1c234e02ac7f878fe5bf185ec8db2c437651e74a9a47414f4f
TLSH
T1B9117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8F7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a7dd972424019b0668bf196b34e30295110a5c9378ea780675fd8f5a7caa4067
MD5 6ff68ca130fbf845f7c96be4f56f948a
SHA1 b8b3e8e95bdadb0cf3bb816987fba434b15b0e75
SHA512 2cf787777a2024802c319a480e71684ed174319551fd5d02a54ba77bbc9dcb49bd188b9b2bfa0669ce3257fa5d4613c0784c9bafdeef0d64b7733529c8c575b9
TLSH
T16821A833B39CC135C8D9017A108CAD01B2B5C3CB449ECECB7B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_aaqxygfa.hoq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aaqxygfa.hoq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gf-browser-dom-child.ps1

Path C:\Users\Admin\AppData\Local\Temp\gf-browser-dom-child.ps1
Size 24B
SHA256 43db22287ca83d83622db8334b302f788c4ea58f127149366cede41a594c2baf
MD5 d6750ea694896a17206c1c03d27a7785
SHA1 5918cba5ae3b2e1efbb763e05cf491103181fed9
SHA512 feb8df3aca9ff5f8c9393051dbb1fe723a442b008156547dac34cb4ca5a3faf63c7ab08ee59ee53e52e7767495a87611684aabe6b7bd3d12497281268e41655b
MD5 SHA1 SHA512

Submit Download

memory/4312-11-0x0000014BB19A0000-0x0000014BB19B0000-memory.dmp

Download

memory/4312-12-0x0000014BB19A0000-0x0000014BB19B0000-memory.dmp

Download

memory/4312-19-0x0000014BB19A0000-0x0000014BB19B0000-memory.dmp

Download

memory/4664-9-0x0000017EAD320000-0x0000017EAD330000-memory.dmp

Download

memory/4664-1-0x0000017EAD320000-0x0000017EAD330000-memory.dmp

Download

memory/4664-7-0x0000017EAD5E0000-0x0000017EAD602000-memory.dmp

Download

memory/4664-31-0x0000017EAD320000-0x0000017EAD330000-memory.dmp

Download

memory/4664-32-0x0000017EAD320000-0x0000017EAD330000-memory.dmp

Download

memory/4664-34-0x0000017EAD320000-0x0000017EAD330000-memory.dmp

Download

memory/4664-0-0x0000017EAD320000-0x0000017EAD330000-memory.dmp

Download