2aa12639dd68a5f5f62245c91d74f9ba3c76235193a3f448f3543415234bf593

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260628-trmfqaat9k
SHA256 2aa12639dd68a5f5f62245c91d74f9ba3c76235193a3f448f3543415234bf593
MD5 c69c4da028b628a212a6780ad982ce47
SHA1 d8f7db4d6cb1ab06e73e8ea0f441ec3e3a1e43d7
SHA512 1cc472d4b73780d87789d9bacb696ab982f3d3e89b553503bcfa511d1fe750f9afd7354702eefd4262179ae99fa015bdb00a24a84d6f5bd909bc7f1155319149
SSDEEP 393216:4NmLosJpcfXpRZvtu3CcTlfXMCHWUjXVcuI3/PGTAI:4NmzAfZHFu3CcTlfXMb8XiH/O7
TLSH
T1A1E6330866C612FAEEF34478EDE201D5D8A4B82507B1C9CB53F447D6ADA72E04D3DE86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2964	powershell.exe
3752	powershell.exe
5644	powershell.exe
2280	powershell.exe
3652	powershell.exe
2516	powershell.exe
4148	powershell.exe
3152	powershell.exe
3976	powershell.exe
4624	powershell.exe
984	powershell.exe
3060	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe
2556	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2556	default.dat.exe
2556	default.dat.exe
3152	powershell.exe
3152	powershell.exe
3976	powershell.exe
3976	powershell.exe
3752	powershell.exe
3752	powershell.exe
4624	powershell.exe
4624	powershell.exe
984	powershell.exe
984	powershell.exe
5644	powershell.exe
5644	powershell.exe
2280	powershell.exe
2280	powershell.exe
3652	powershell.exe
3652	powershell.exe
2516	powershell.exe
2516	powershell.exe
3060	powershell.exe
3060	powershell.exe
2964	powershell.exe
2964	powershell.exe
4148	powershell.exe
4148	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	default.dat.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeIncreaseQuotaPrivilege	3152	powershell.exe
Token: SeSecurityPrivilege	3152	powershell.exe
Token: SeTakeOwnershipPrivilege	3152	powershell.exe
Token: SeLoadDriverPrivilege	3152	powershell.exe
Token: SeSystemProfilePrivilege	3152	powershell.exe
Token: SeSystemtimePrivilege	3152	powershell.exe
Token: SeProfSingleProcessPrivilege	3152	powershell.exe
Token: SeIncBasePriorityPrivilege	3152	powershell.exe
Token: SeCreatePagefilePrivilege	3152	powershell.exe
Token: SeBackupPrivilege	3152	powershell.exe
Token: SeRestorePrivilege	3152	powershell.exe
Token: SeShutdownPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeSystemEnvironmentPrivilege	3152	powershell.exe
Token: SeRemoteShutdownPrivilege	3152	powershell.exe
Token: SeUndockPrivilege	3152	powershell.exe
Token: SeManageVolumePrivilege	3152	powershell.exe
Token: 33	3152	powershell.exe
Token: 34	3152	powershell.exe
Token: 35	3152	powershell.exe
Token: 36	3152	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeIncreaseQuotaPrivilege	3976	powershell.exe
Token: SeSecurityPrivilege	3976	powershell.exe
Token: SeTakeOwnershipPrivilege	3976	powershell.exe
Token: SeLoadDriverPrivilege	3976	powershell.exe
Token: SeSystemProfilePrivilege	3976	powershell.exe
Token: SeSystemtimePrivilege	3976	powershell.exe
Token: SeProfSingleProcessPrivilege	3976	powershell.exe
Token: SeIncBasePriorityPrivilege	3976	powershell.exe
Token: SeCreatePagefilePrivilege	3976	powershell.exe
Token: SeBackupPrivilege	3976	powershell.exe
Token: SeRestorePrivilege	3976	powershell.exe
Token: SeShutdownPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeSystemEnvironmentPrivilege	3976	powershell.exe
Token: SeRemoteShutdownPrivilege	3976	powershell.exe
Token: SeUndockPrivilege	3976	powershell.exe
Token: SeManageVolumePrivilege	3976	powershell.exe
Token: 33	3976	powershell.exe
Token: 34	3976	powershell.exe
Token: 35	3976	powershell.exe
Token: 36	3976	powershell.exe
Token: SeDebugPrivilege	3752	powershell.exe
Token: SeIncreaseQuotaPrivilege	3752	powershell.exe
Token: SeSecurityPrivilege	3752	powershell.exe
Token: SeTakeOwnershipPrivilege	3752	powershell.exe
Token: SeLoadDriverPrivilege	3752	powershell.exe
Token: SeSystemProfilePrivilege	3752	powershell.exe
Token: SeSystemtimePrivilege	3752	powershell.exe
Token: SeProfSingleProcessPrivilege	3752	powershell.exe
Token: SeIncBasePriorityPrivilege	3752	powershell.exe
Token: SeCreatePagefilePrivilege	3752	powershell.exe
Token: SeBackupPrivilege	3752	powershell.exe
Token: SeRestorePrivilege	3752	powershell.exe
Token: SeShutdownPrivilege	3752	powershell.exe
Token: SeDebugPrivilege	3752	powershell.exe
Token: SeSystemEnvironmentPrivilege	3752	powershell.exe
Token: SeRemoteShutdownPrivilege	3752	powershell.exe
Token: SeUndockPrivilege	3752	powershell.exe
Token: SeManageVolumePrivilege	3752	powershell.exe
Token: 33	3752	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2556	1448	default.dat.exe	89
PID 2556 wrote to memory of 4692	2556	default.dat.exe	90
PID 4692 wrote to memory of 3152	4692	cmd.exe	92
PID 2556 wrote to memory of 5828	2556	default.dat.exe	94
PID 5828 wrote to memory of 3976	5828	cmd.exe	96
PID 2556 wrote to memory of 5208	2556	default.dat.exe	97
PID 5208 wrote to memory of 3752	5208	cmd.exe	99
PID 2556 wrote to memory of 6040	2556	default.dat.exe	100
PID 6040 wrote to memory of 4624	6040	cmd.exe	102
PID 2556 wrote to memory of 3216	2556	default.dat.exe	103
PID 3216 wrote to memory of 984	3216	cmd.exe	105
PID 2556 wrote to memory of 2052	2556	default.dat.exe	106
PID 2052 wrote to memory of 5644	2052	cmd.exe	108
PID 2556 wrote to memory of 4772	2556	default.dat.exe	109
PID 4772 wrote to memory of 2280	4772	cmd.exe	111
PID 2556 wrote to memory of 4964	2556	default.dat.exe	112
PID 4964 wrote to memory of 3652	4964	cmd.exe	114
PID 2556 wrote to memory of 4548	2556	default.dat.exe	115
PID 4548 wrote to memory of 2516	4548	cmd.exe	117
PID 2556 wrote to memory of 4076	2556	default.dat.exe	118
PID 4076 wrote to memory of 3060	4076	cmd.exe	120
PID 2556 wrote to memory of 912	2556	default.dat.exe	121
PID 912 wrote to memory of 2964	912	cmd.exe	123
PID 2556 wrote to memory of 3900	2556	default.dat.exe	124
PID 3900 wrote to memory of 4148	3900	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\leziyiha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\leziyiha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact