d9f15a43821328bf482e2945ff9da40fa05f382777819d8e9fa3aaae8704862d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260705-efcd2scz3r
SHA256 d9f15a43821328bf482e2945ff9da40fa05f382777819d8e9fa3aaae8704862d
MD5 ba3544437b369bbd4687a2ce30077a3f
SHA1 612fb6725b2c4b8f2c0edf6a2de5b1e53c8b8a76
SHA512 ba22e3f047efc94d5f3ec601a84aa93509e5de4fdf2aa2473a73ebb73b54baa341a7d9749cf3e28b6e98dd893211cb49c8d7b5a4067f02ec1a667ea332d6244f
SSDEEP 393216:IPHX1Bpawu+ifaDgNDXMCHWUjXFcuI3/PGTAI:I/lBzbpDYDXMb8XyH/O7
TLSH
T10FE63318ABE001FEE9B7813C9DE19652D1B0B8651B61CEDF2798D7716E532E08C38B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5744	powershell.exe
864	powershell.exe
1504	powershell.exe
2112	powershell.exe
1924	powershell.exe
2236	powershell.exe
6040	powershell.exe
5480	powershell.exe
3860	powershell.exe
312	powershell.exe
2136	powershell.exe
5728	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe
4136	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4136	default.dat.exe
4136	default.dat.exe
5728	powershell.exe
5728	powershell.exe
5744	powershell.exe
5744	powershell.exe
6040	powershell.exe
6040	powershell.exe
5480	powershell.exe
5480	powershell.exe
864	powershell.exe
864	powershell.exe
1504	powershell.exe
1504	powershell.exe
2112	powershell.exe
2112	powershell.exe
3860	powershell.exe
3860	powershell.exe
312	powershell.exe
312	powershell.exe
1924	powershell.exe
1924	powershell.exe
2136	powershell.exe
2136	powershell.exe
2236	powershell.exe
2236	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	default.dat.exe
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4136	1788	default.dat.exe	85
PID 4136 wrote to memory of 5660	4136	default.dat.exe	86
PID 5660 wrote to memory of 5728	5660	cmd.exe	88
PID 4136 wrote to memory of 5884	4136	default.dat.exe	89
PID 5884 wrote to memory of 5744	5884	cmd.exe	91
PID 4136 wrote to memory of 3988	4136	default.dat.exe	92
PID 3988 wrote to memory of 6040	3988	cmd.exe	94
PID 4136 wrote to memory of 5700	4136	default.dat.exe	95
PID 5700 wrote to memory of 5480	5700	cmd.exe	97
PID 4136 wrote to memory of 940	4136	default.dat.exe	98
PID 940 wrote to memory of 864	940	cmd.exe	100
PID 4136 wrote to memory of 3964	4136	default.dat.exe	101
PID 3964 wrote to memory of 1504	3964	cmd.exe	103
PID 4136 wrote to memory of 3236	4136	default.dat.exe	104
PID 3236 wrote to memory of 2112	3236	cmd.exe	106
PID 4136 wrote to memory of 2648	4136	default.dat.exe	107
PID 2648 wrote to memory of 3860	2648	cmd.exe	109
PID 4136 wrote to memory of 5176	4136	default.dat.exe	110
PID 5176 wrote to memory of 312	5176	cmd.exe	112
PID 4136 wrote to memory of 2084	4136	default.dat.exe	113
PID 2084 wrote to memory of 1924	2084	cmd.exe	115
PID 4136 wrote to memory of 2688	4136	default.dat.exe	116
PID 2688 wrote to memory of 2136	2688	cmd.exe	118
PID 4136 wrote to memory of 4304	4136	default.dat.exe	119
PID 4304 wrote to memory of 2236	4304	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...