32f4dc44d81286d23683761744153d06c37df34eb6e9c95de020bfc3fccf74fb

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260707-a8fvqaex91
SHA256 32f4dc44d81286d23683761744153d06c37df34eb6e9c95de020bfc3fccf74fb
MD5 d031ed9d1e744f1df9e61457beb7620d
SHA1 61b57fafca9d334b89d311331c65423918d0e365
SHA512 932a6f26f368737b21c1b40e29663a7abbfff52d58bbc9a4c35756d40352eb7d157956d0c0dc28fb5b3a97355d315c3e002a9850cfb4454896991aa1ededbe2b
SSDEEP 393216:TonN5Fg8Ol8zDx2B3geXMCHWUjXHcuI3/PGTAI:TIF2leVgHXMb8X8H/O7
TLSH
T1C0E6335C8EE02BDDF073417CE9A11253F5FAB0B61B72CB9B976C42A22D471A04D39663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1580	powershell.exe
3680	powershell.exe
3336	powershell.exe
592	powershell.exe
1008	powershell.exe
816	powershell.exe
4128	powershell.exe
4132	powershell.exe
2332	powershell.exe
4016	powershell.exe
3588	powershell.exe
1880	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe
5052	default.dat.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
5052	default.dat.exe
5052	default.dat.exe
1580	powershell.exe
1580	powershell.exe
3680	powershell.exe
3680	powershell.exe
3336	powershell.exe
3336	powershell.exe
592	powershell.exe
592	powershell.exe
592	powershell.exe
1008	powershell.exe
1008	powershell.exe
1008	powershell.exe
2332	powershell.exe
2332	powershell.exe
2332	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4132	powershell.exe
4132	powershell.exe
4016	powershell.exe
4016	powershell.exe
3588	powershell.exe
3588	powershell.exe
1880	powershell.exe
1880	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	default.dat.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 5052	628	default.dat.exe	85
PID 5052 wrote to memory of 1148	5052	default.dat.exe	96
PID 1148 wrote to memory of 1580	1148	cmd.exe	98
PID 5052 wrote to memory of 4060	5052	default.dat.exe	99
PID 4060 wrote to memory of 3680	4060	cmd.exe	101
PID 5052 wrote to memory of 4540	5052	default.dat.exe	102
PID 4540 wrote to memory of 3336	4540	cmd.exe	104
PID 5052 wrote to memory of 952	5052	default.dat.exe	107
PID 952 wrote to memory of 592	952	cmd.exe	109
PID 5052 wrote to memory of 432	5052	default.dat.exe	110
PID 432 wrote to memory of 1008	432	cmd.exe	112
PID 5052 wrote to memory of 3484	5052	default.dat.exe	113
PID 3484 wrote to memory of 2332	3484	cmd.exe	115
PID 5052 wrote to memory of 1520	5052	default.dat.exe	116
PID 1520 wrote to memory of 816	1520	cmd.exe	118
PID 5052 wrote to memory of 1588	5052	default.dat.exe	119
PID 1588 wrote to memory of 4128	1588	cmd.exe	121
PID 5052 wrote to memory of 3952	5052	default.dat.exe	122
PID 3952 wrote to memory of 4132	3952	cmd.exe	124
PID 5052 wrote to memory of 1448	5052	default.dat.exe	125
PID 1448 wrote to memory of 4016	1448	cmd.exe	127
PID 5052 wrote to memory of 1748	5052	default.dat.exe	128
PID 1748 wrote to memory of 3588	1748	cmd.exe	130
PID 5052 wrote to memory of 592	5052	default.dat.exe	131
PID 592 wrote to memory of 1880	592	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\gihigawi'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\gihigawi'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...