68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260705-tba3radv3w
SHA256 68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee
MD5 a8677a450808a4be8857af5c6cffd836
SHA1 91fd716db049df251aeb238e6d283a2937d6a2b8
SHA512 396bbe1855bc687459fa30e697a53ba485f4c75d9ab16987e8a809262ac0609cd4e7f02bccc10a440877f3b15bcce128c764d39ddf8281bd59b9c92da0bfef8b
SSDEEP 393216:7/932dnLSb7gt17cFKRAylKNyEbXMCHWUjXTcuI3/PGTAI:DN+i7gtJcFK/QjbXMb8XQH/O7
TLSH
T1F9E6331862D013EFEBA341389BE0B5A2D8B2B8395775CB5F076887722E171D08D7D366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3572	powershell.exe
4800	powershell.exe
4504	powershell.exe
4120	powershell.exe
1940	powershell.exe
3372	powershell.exe
6400	powershell.exe
956	powershell.exe
4980	powershell.exe
5052	powershell.exe
252	powershell.exe
5860	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe
5768	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5768	default.dat.exe
5768	default.dat.exe
4800	powershell.exe
4800	powershell.exe
4504	powershell.exe
4504	powershell.exe
4980	powershell.exe
4980	powershell.exe
5052	powershell.exe
5052	powershell.exe
4120	powershell.exe
4120	powershell.exe
1940	powershell.exe
1940	powershell.exe
3372	powershell.exe
3372	powershell.exe
252	powershell.exe
252	powershell.exe
5860	powershell.exe
5860	powershell.exe
6400	powershell.exe
6400	powershell.exe
3572	powershell.exe
3572	powershell.exe
956	powershell.exe
956	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5768	default.dat.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeIncreaseQuotaPrivilege	4800	powershell.exe
Token: SeSecurityPrivilege	4800	powershell.exe
Token: SeTakeOwnershipPrivilege	4800	powershell.exe
Token: SeLoadDriverPrivilege	4800	powershell.exe
Token: SeSystemProfilePrivilege	4800	powershell.exe
Token: SeSystemtimePrivilege	4800	powershell.exe
Token: SeProfSingleProcessPrivilege	4800	powershell.exe
Token: SeIncBasePriorityPrivilege	4800	powershell.exe
Token: SeCreatePagefilePrivilege	4800	powershell.exe
Token: SeBackupPrivilege	4800	powershell.exe
Token: SeRestorePrivilege	4800	powershell.exe
Token: SeShutdownPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeSystemEnvironmentPrivilege	4800	powershell.exe
Token: SeRemoteShutdownPrivilege	4800	powershell.exe
Token: SeUndockPrivilege	4800	powershell.exe
Token: SeManageVolumePrivilege	4800	powershell.exe
Token: 33	4800	powershell.exe
Token: 34	4800	powershell.exe
Token: 35	4800	powershell.exe
Token: 36	4800	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeIncreaseQuotaPrivilege	4504	powershell.exe
Token: SeSecurityPrivilege	4504	powershell.exe
Token: SeTakeOwnershipPrivilege	4504	powershell.exe
Token: SeLoadDriverPrivilege	4504	powershell.exe
Token: SeSystemProfilePrivilege	4504	powershell.exe
Token: SeSystemtimePrivilege	4504	powershell.exe
Token: SeProfSingleProcessPrivilege	4504	powershell.exe
Token: SeIncBasePriorityPrivilege	4504	powershell.exe
Token: SeCreatePagefilePrivilege	4504	powershell.exe
Token: SeBackupPrivilege	4504	powershell.exe
Token: SeRestorePrivilege	4504	powershell.exe
Token: SeShutdownPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeSystemEnvironmentPrivilege	4504	powershell.exe
Token: SeRemoteShutdownPrivilege	4504	powershell.exe
Token: SeUndockPrivilege	4504	powershell.exe
Token: SeManageVolumePrivilege	4504	powershell.exe
Token: 33	4504	powershell.exe
Token: 34	4504	powershell.exe
Token: 35	4504	powershell.exe
Token: 36	4504	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeIncreaseQuotaPrivilege	4980	powershell.exe
Token: SeSecurityPrivilege	4980	powershell.exe
Token: SeTakeOwnershipPrivilege	4980	powershell.exe
Token: SeLoadDriverPrivilege	4980	powershell.exe
Token: SeSystemProfilePrivilege	4980	powershell.exe
Token: SeSystemtimePrivilege	4980	powershell.exe
Token: SeProfSingleProcessPrivilege	4980	powershell.exe
Token: SeIncBasePriorityPrivilege	4980	powershell.exe
Token: SeCreatePagefilePrivilege	4980	powershell.exe
Token: SeBackupPrivilege	4980	powershell.exe
Token: SeRestorePrivilege	4980	powershell.exe
Token: SeShutdownPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeSystemEnvironmentPrivilege	4980	powershell.exe
Token: SeRemoteShutdownPrivilege	4980	powershell.exe
Token: SeUndockPrivilege	4980	powershell.exe
Token: SeManageVolumePrivilege	4980	powershell.exe
Token: 33	4980	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 5768	716	default.dat.exe	89
PID 5768 wrote to memory of 2256	5768	default.dat.exe	90
PID 2256 wrote to memory of 4800	2256	cmd.exe	92
PID 5768 wrote to memory of 2560	5768	default.dat.exe	94
PID 2560 wrote to memory of 4504	2560	cmd.exe	96
PID 5768 wrote to memory of 6868	5768	default.dat.exe	97
PID 6868 wrote to memory of 4980	6868	cmd.exe	99
PID 5768 wrote to memory of 4836	5768	default.dat.exe	100
PID 4836 wrote to memory of 5052	4836	cmd.exe	102
PID 5768 wrote to memory of 5708	5768	default.dat.exe	103
PID 5708 wrote to memory of 4120	5708	cmd.exe	105
PID 5768 wrote to memory of 940	5768	default.dat.exe	106
PID 940 wrote to memory of 1940	940	cmd.exe	108
PID 5768 wrote to memory of 3656	5768	default.dat.exe	109
PID 3656 wrote to memory of 3372	3656	cmd.exe	111
PID 5768 wrote to memory of 6860	5768	default.dat.exe	112
PID 6860 wrote to memory of 252	6860	cmd.exe	114
PID 5768 wrote to memory of 1096	5768	default.dat.exe	115
PID 1096 wrote to memory of 5860	1096	cmd.exe	117
PID 5768 wrote to memory of 5624	5768	default.dat.exe	118
PID 5624 wrote to memory of 6400	5624	cmd.exe	120
PID 5768 wrote to memory of 1764	5768	default.dat.exe	121
PID 1764 wrote to memory of 3572	1764	cmd.exe	123
PID 5768 wrote to memory of 4972	5768	default.dat.exe	124
PID 4972 wrote to memory of 956	4972	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact