422c55e0219b09d0262782b25420c601304f5d1b46a325f2b4859ef77244ff42

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260705-dc448agy2t
SHA256 422c55e0219b09d0262782b25420c601304f5d1b46a325f2b4859ef77244ff42
MD5 99755cc0b98e663e73aac9be9aa33c13
SHA1 116af423f975819cd0668484d7e0fb7c83460fb8
SHA512 0acc6c389da5372bef65a8629cbd32cc6e80be15b3d0cf11a25cc703c6422cf397d600ad5138cb10d845d03c97c6e83e3d050e65f53f9cbd23603420390427a9
SSDEEP 393216:WcPtPJhURu1YY0WpZYmPxz48ITXMCHWUjXWcuI3/PGTAI:Wclf9R5z4zTXMb8XrH/O7
TLSH
T1F4E63359A0D001EED533843CFE6185F2D56934A95BB2CA8F1BD4D3E1BC5B2E04E3A64B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5580	powershell.exe
4516	powershell.exe
5512	powershell.exe
4428	powershell.exe
3824	powershell.exe
1196	powershell.exe
5012	powershell.exe
5268	powershell.exe
4456	powershell.exe
260	powershell.exe
3552	powershell.exe
4540	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe
5568	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5568	default.dat.exe
5568	default.dat.exe
5580	powershell.exe
5580	powershell.exe
4516	powershell.exe
4516	powershell.exe
4456	powershell.exe
4456	powershell.exe
260	powershell.exe
260	powershell.exe
5512	powershell.exe
5512	powershell.exe
4428	powershell.exe
4428	powershell.exe
3824	powershell.exe
3824	powershell.exe
3552	powershell.exe
3552	powershell.exe
4540	powershell.exe
4540	powershell.exe
1196	powershell.exe
1196	powershell.exe
5012	powershell.exe
5012	powershell.exe
5268	powershell.exe
5268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5568	default.dat.exe
Token: SeDebugPrivilege	5580	powershell.exe
Token: SeIncreaseQuotaPrivilege	5580	powershell.exe
Token: SeSecurityPrivilege	5580	powershell.exe
Token: SeTakeOwnershipPrivilege	5580	powershell.exe
Token: SeLoadDriverPrivilege	5580	powershell.exe
Token: SeSystemProfilePrivilege	5580	powershell.exe
Token: SeSystemtimePrivilege	5580	powershell.exe
Token: SeProfSingleProcessPrivilege	5580	powershell.exe
Token: SeIncBasePriorityPrivilege	5580	powershell.exe
Token: SeCreatePagefilePrivilege	5580	powershell.exe
Token: SeBackupPrivilege	5580	powershell.exe
Token: SeRestorePrivilege	5580	powershell.exe
Token: SeShutdownPrivilege	5580	powershell.exe
Token: SeDebugPrivilege	5580	powershell.exe
Token: SeSystemEnvironmentPrivilege	5580	powershell.exe
Token: SeRemoteShutdownPrivilege	5580	powershell.exe
Token: SeUndockPrivilege	5580	powershell.exe
Token: SeManageVolumePrivilege	5580	powershell.exe
Token: 33	5580	powershell.exe
Token: 34	5580	powershell.exe
Token: 35	5580	powershell.exe
Token: 36	5580	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeIncreaseQuotaPrivilege	4516	powershell.exe
Token: SeSecurityPrivilege	4516	powershell.exe
Token: SeTakeOwnershipPrivilege	4516	powershell.exe
Token: SeLoadDriverPrivilege	4516	powershell.exe
Token: SeSystemProfilePrivilege	4516	powershell.exe
Token: SeSystemtimePrivilege	4516	powershell.exe
Token: SeProfSingleProcessPrivilege	4516	powershell.exe
Token: SeIncBasePriorityPrivilege	4516	powershell.exe
Token: SeCreatePagefilePrivilege	4516	powershell.exe
Token: SeBackupPrivilege	4516	powershell.exe
Token: SeRestorePrivilege	4516	powershell.exe
Token: SeShutdownPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeSystemEnvironmentPrivilege	4516	powershell.exe
Token: SeRemoteShutdownPrivilege	4516	powershell.exe
Token: SeUndockPrivilege	4516	powershell.exe
Token: SeManageVolumePrivilege	4516	powershell.exe
Token: 33	4516	powershell.exe
Token: 34	4516	powershell.exe
Token: 35	4516	powershell.exe
Token: 36	4516	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeIncreaseQuotaPrivilege	4456	powershell.exe
Token: SeSecurityPrivilege	4456	powershell.exe
Token: SeTakeOwnershipPrivilege	4456	powershell.exe
Token: SeLoadDriverPrivilege	4456	powershell.exe
Token: SeSystemProfilePrivilege	4456	powershell.exe
Token: SeSystemtimePrivilege	4456	powershell.exe
Token: SeProfSingleProcessPrivilege	4456	powershell.exe
Token: SeIncBasePriorityPrivilege	4456	powershell.exe
Token: SeCreatePagefilePrivilege	4456	powershell.exe
Token: SeBackupPrivilege	4456	powershell.exe
Token: SeRestorePrivilege	4456	powershell.exe
Token: SeShutdownPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeSystemEnvironmentPrivilege	4456	powershell.exe
Token: SeRemoteShutdownPrivilege	4456	powershell.exe
Token: SeUndockPrivilege	4456	powershell.exe
Token: SeManageVolumePrivilege	4456	powershell.exe
Token: 33	4456	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 5568	4912	default.dat.exe	88
PID 5568 wrote to memory of 760	5568	default.dat.exe	89
PID 760 wrote to memory of 5580	760	cmd.exe	91
PID 5568 wrote to memory of 1064	5568	default.dat.exe	93
PID 1064 wrote to memory of 4516	1064	cmd.exe	95
PID 5568 wrote to memory of 1712	5568	default.dat.exe	96
PID 1712 wrote to memory of 4456	1712	cmd.exe	98
PID 5568 wrote to memory of 1808	5568	default.dat.exe	99
PID 1808 wrote to memory of 260	1808	cmd.exe	101
PID 5568 wrote to memory of 5340	5568	default.dat.exe	102
PID 5340 wrote to memory of 5512	5340	cmd.exe	104
PID 5568 wrote to memory of 4324	5568	default.dat.exe	105
PID 4324 wrote to memory of 4428	4324	cmd.exe	107
PID 5568 wrote to memory of 1088	5568	default.dat.exe	108
PID 1088 wrote to memory of 3824	1088	cmd.exe	110
PID 5568 wrote to memory of 1768	5568	default.dat.exe	111
PID 1768 wrote to memory of 3552	1768	cmd.exe	113
PID 5568 wrote to memory of 5376	5568	default.dat.exe	114
PID 5376 wrote to memory of 4540	5376	cmd.exe	116
PID 5568 wrote to memory of 1608	5568	default.dat.exe	117
PID 1608 wrote to memory of 1196	1608	cmd.exe	119
PID 5568 wrote to memory of 1856	5568	default.dat.exe	120
PID 1856 wrote to memory of 5012	1856	cmd.exe	122
PID 5568 wrote to memory of 2988	5568	default.dat.exe	123
PID 2988 wrote to memory of 5268	2988	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact