Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
04/11/2026, 17:27
General
- Target cfx-sense-source\FiveM-CfxBase\AmGui\font_defines.ps1
- Size 729KB
- Sample261104-v1d2daes6p
- SHA256 48ef009fde933cd5ee94aeb8f6b18bc0cb77c069cfddb625e37ebd265948146d
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cfx-sense-source\FiveM-CfxBase\AmGui\font_defines.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_je4ohzwr.3yn.ps1
memory/3816-1-0x000001B07DD90000-0x000001B07DDA0000-memory.dmp
memory/3816-0-0x000001B07DD90000-0x000001B07DDA0000-memory.dmp
memory/3816-2-0x000001B07FE10000-0x000001B07FE32000-memory.dmp
memory/3816-9-0x000001B07DD90000-0x000001B07DDA0000-memory.dmp