PowerShell Payload Unpacked

PowerShell fires and starts pulling together several different pieces, including a fake Cloudflare page, browser processes with their sandbox disabled, and activity involving timeout.exe.

I follow the different processes the payload kicks off and try to figure out what is happening along the way.

Watch the full video: https://youtu.be/oJHOlNTH7lY?si=8LruOkxZlfvFLII-John HammondRead More