d9f15a43821328bf482e2945ff9da40fa05f382777819d8e9fa3aaae8704862d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260705-efcd2scz3r
SHA256 d9f15a43821328bf482e2945ff9da40fa05f382777819d8e9fa3aaae8704862d
MD5 ba3544437b369bbd4687a2ce30077a3f
SHA1 612fb6725b2c4b8f2c0edf6a2de5b1e53c8b8a76
SHA512 ba22e3f047efc94d5f3ec601a84aa93509e5de4fdf2aa2473a73ebb73b54baa341a7d9749cf3e28b6e98dd893211cb49c8d7b5a4067f02ec1a667ea332d6244f
SSDEEP 393216:IPHX1Bpawu+ifaDgNDXMCHWUjXFcuI3/PGTAI:I/lBzbpDYDXMb8XyH/O7
TLSH
T10FE63318ABE001FEE9B7813C9DE19652D1B0B8651B61CEDF2798D7716E532E08C38B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
568	powershell.exe
6632	powershell.exe
2792	powershell.exe
2012	powershell.exe
6812	powershell.exe
5168	powershell.exe
6836	powershell.exe
5720	powershell.exe
3720	powershell.exe
2972	powershell.exe
2268	powershell.exe
1160	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe
6044	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
6044	default.dat.exe
6044	default.dat.exe
568	powershell.exe
568	powershell.exe
6632	powershell.exe
6632	powershell.exe
2792	powershell.exe
2792	powershell.exe
5720	powershell.exe
5720	powershell.exe
3720	powershell.exe
3720	powershell.exe
2972	powershell.exe
2972	powershell.exe
2012	powershell.exe
2012	powershell.exe
6812	powershell.exe
6812	powershell.exe
5168	powershell.exe
5168	powershell.exe
6836	powershell.exe
6836	powershell.exe
2268	powershell.exe
2268	powershell.exe
1160	powershell.exe
1160	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	default.dat.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeIncreaseQuotaPrivilege	568	powershell.exe
Token: SeSecurityPrivilege	568	powershell.exe
Token: SeTakeOwnershipPrivilege	568	powershell.exe
Token: SeLoadDriverPrivilege	568	powershell.exe
Token: SeSystemProfilePrivilege	568	powershell.exe
Token: SeSystemtimePrivilege	568	powershell.exe
Token: SeProfSingleProcessPrivilege	568	powershell.exe
Token: SeIncBasePriorityPrivilege	568	powershell.exe
Token: SeCreatePagefilePrivilege	568	powershell.exe
Token: SeBackupPrivilege	568	powershell.exe
Token: SeRestorePrivilege	568	powershell.exe
Token: SeShutdownPrivilege	568	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeSystemEnvironmentPrivilege	568	powershell.exe
Token: SeRemoteShutdownPrivilege	568	powershell.exe
Token: SeUndockPrivilege	568	powershell.exe
Token: SeManageVolumePrivilege	568	powershell.exe
Token: 33	568	powershell.exe
Token: 34	568	powershell.exe
Token: 35	568	powershell.exe
Token: 36	568	powershell.exe
Token: SeDebugPrivilege	6632	powershell.exe
Token: SeIncreaseQuotaPrivilege	6632	powershell.exe
Token: SeSecurityPrivilege	6632	powershell.exe
Token: SeTakeOwnershipPrivilege	6632	powershell.exe
Token: SeLoadDriverPrivilege	6632	powershell.exe
Token: SeSystemProfilePrivilege	6632	powershell.exe
Token: SeSystemtimePrivilege	6632	powershell.exe
Token: SeProfSingleProcessPrivilege	6632	powershell.exe
Token: SeIncBasePriorityPrivilege	6632	powershell.exe
Token: SeCreatePagefilePrivilege	6632	powershell.exe
Token: SeBackupPrivilege	6632	powershell.exe
Token: SeRestorePrivilege	6632	powershell.exe
Token: SeShutdownPrivilege	6632	powershell.exe
Token: SeDebugPrivilege	6632	powershell.exe
Token: SeSystemEnvironmentPrivilege	6632	powershell.exe
Token: SeRemoteShutdownPrivilege	6632	powershell.exe
Token: SeUndockPrivilege	6632	powershell.exe
Token: SeManageVolumePrivilege	6632	powershell.exe
Token: 33	6632	powershell.exe
Token: 34	6632	powershell.exe
Token: 35	6632	powershell.exe
Token: 36	6632	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeIncreaseQuotaPrivilege	2792	powershell.exe
Token: SeSecurityPrivilege	2792	powershell.exe
Token: SeTakeOwnershipPrivilege	2792	powershell.exe
Token: SeLoadDriverPrivilege	2792	powershell.exe
Token: SeSystemProfilePrivilege	2792	powershell.exe
Token: SeSystemtimePrivilege	2792	powershell.exe
Token: SeProfSingleProcessPrivilege	2792	powershell.exe
Token: SeIncBasePriorityPrivilege	2792	powershell.exe
Token: SeCreatePagefilePrivilege	2792	powershell.exe
Token: SeBackupPrivilege	2792	powershell.exe
Token: SeRestorePrivilege	2792	powershell.exe
Token: SeShutdownPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeSystemEnvironmentPrivilege	2792	powershell.exe
Token: SeRemoteShutdownPrivilege	2792	powershell.exe
Token: SeUndockPrivilege	2792	powershell.exe
Token: SeManageVolumePrivilege	2792	powershell.exe
Token: 33	2792	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 6044	2796	default.dat.exe	89
PID 6044 wrote to memory of 6700	6044	default.dat.exe	90
PID 6700 wrote to memory of 568	6700	cmd.exe	92
PID 6044 wrote to memory of 3936	6044	default.dat.exe	94
PID 3936 wrote to memory of 6632	3936	cmd.exe	96
PID 6044 wrote to memory of 1292	6044	default.dat.exe	97
PID 1292 wrote to memory of 2792	1292	cmd.exe	99
PID 6044 wrote to memory of 760	6044	default.dat.exe	100
PID 760 wrote to memory of 5720	760	cmd.exe	102
PID 6044 wrote to memory of 3652	6044	default.dat.exe	103
PID 3652 wrote to memory of 3720	3652	cmd.exe	105
PID 6044 wrote to memory of 6440	6044	default.dat.exe	106
PID 6440 wrote to memory of 2972	6440	cmd.exe	108
PID 6044 wrote to memory of 5204	6044	default.dat.exe	109
PID 5204 wrote to memory of 2012	5204	cmd.exe	111
PID 6044 wrote to memory of 2928	6044	default.dat.exe	112
PID 2928 wrote to memory of 6812	2928	cmd.exe	114
PID 6044 wrote to memory of 5160	6044	default.dat.exe	115
PID 5160 wrote to memory of 5168	5160	cmd.exe	117
PID 6044 wrote to memory of 5268	6044	default.dat.exe	118
PID 5268 wrote to memory of 6836	5268	cmd.exe	120
PID 6044 wrote to memory of 6656	6044	default.dat.exe	121
PID 6656 wrote to memory of 2268	6656	cmd.exe	123
PID 6044 wrote to memory of 6508	6044	default.dat.exe	124
PID 6508 wrote to memory of 1160	6508	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact