886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260712-calpeses2x
SHA256 886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54
MD5 d8156051e4f18c42cc2c459e1ad0172f
SHA1 8e385c455f796264c8ffad0c35e32b244fa1556c
SHA512 1d60e6d7f0c0a5f372a155981d53908c5eeffb5982938c2c976c547042908d948c89e14cf88d92d6152436a2884b6f8e62612d17365347ffea3ab83cda6faf89
SSDEEP 393216:Oe04wr8F+CN9kdZsobN1XMCHWUjXHcuI3/PGTAI:OhYFhNmTXMb8X8H/O7
TLSH
T1C3E63358F6E023EDE6A38138DEF285A4E56174B50732C8DB177C8A55AE272D00E3E753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5884	powershell.exe
3808	powershell.exe
468	powershell.exe
672	powershell.exe
1048	powershell.exe
4688	powershell.exe
3408	powershell.exe
3356	powershell.exe
2200	powershell.exe
3784	powershell.exe
2332	powershell.exe
5828	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe
3192	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3192	default.dat.exe
3192	default.dat.exe
5828	powershell.exe
5828	powershell.exe
5884	powershell.exe
5884	powershell.exe
3808	powershell.exe
3808	powershell.exe
3356	powershell.exe
3356	powershell.exe
468	powershell.exe
468	powershell.exe
672	powershell.exe
672	powershell.exe
1048	powershell.exe
1048	powershell.exe
2200	powershell.exe
2200	powershell.exe
3784	powershell.exe
3784	powershell.exe
2332	powershell.exe
2332	powershell.exe
4688	powershell.exe
4688	powershell.exe
3408	powershell.exe
3408	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	default.dat.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeIncreaseQuotaPrivilege	5828	powershell.exe
Token: SeSecurityPrivilege	5828	powershell.exe
Token: SeTakeOwnershipPrivilege	5828	powershell.exe
Token: SeLoadDriverPrivilege	5828	powershell.exe
Token: SeSystemProfilePrivilege	5828	powershell.exe
Token: SeSystemtimePrivilege	5828	powershell.exe
Token: SeProfSingleProcessPrivilege	5828	powershell.exe
Token: SeIncBasePriorityPrivilege	5828	powershell.exe
Token: SeCreatePagefilePrivilege	5828	powershell.exe
Token: SeBackupPrivilege	5828	powershell.exe
Token: SeRestorePrivilege	5828	powershell.exe
Token: SeShutdownPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeSystemEnvironmentPrivilege	5828	powershell.exe
Token: SeRemoteShutdownPrivilege	5828	powershell.exe
Token: SeUndockPrivilege	5828	powershell.exe
Token: SeManageVolumePrivilege	5828	powershell.exe
Token: 33	5828	powershell.exe
Token: 34	5828	powershell.exe
Token: 35	5828	powershell.exe
Token: 36	5828	powershell.exe
Token: SeDebugPrivilege	5884	powershell.exe
Token: SeIncreaseQuotaPrivilege	5884	powershell.exe
Token: SeSecurityPrivilege	5884	powershell.exe
Token: SeTakeOwnershipPrivilege	5884	powershell.exe
Token: SeLoadDriverPrivilege	5884	powershell.exe
Token: SeSystemProfilePrivilege	5884	powershell.exe
Token: SeSystemtimePrivilege	5884	powershell.exe
Token: SeProfSingleProcessPrivilege	5884	powershell.exe
Token: SeIncBasePriorityPrivilege	5884	powershell.exe
Token: SeCreatePagefilePrivilege	5884	powershell.exe
Token: SeBackupPrivilege	5884	powershell.exe
Token: SeRestorePrivilege	5884	powershell.exe
Token: SeShutdownPrivilege	5884	powershell.exe
Token: SeDebugPrivilege	5884	powershell.exe
Token: SeSystemEnvironmentPrivilege	5884	powershell.exe
Token: SeRemoteShutdownPrivilege	5884	powershell.exe
Token: SeUndockPrivilege	5884	powershell.exe
Token: SeManageVolumePrivilege	5884	powershell.exe
Token: 33	5884	powershell.exe
Token: 34	5884	powershell.exe
Token: 35	5884	powershell.exe
Token: 36	5884	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeIncreaseQuotaPrivilege	3808	powershell.exe
Token: SeSecurityPrivilege	3808	powershell.exe
Token: SeTakeOwnershipPrivilege	3808	powershell.exe
Token: SeLoadDriverPrivilege	3808	powershell.exe
Token: SeSystemProfilePrivilege	3808	powershell.exe
Token: SeSystemtimePrivilege	3808	powershell.exe
Token: SeProfSingleProcessPrivilege	3808	powershell.exe
Token: SeIncBasePriorityPrivilege	3808	powershell.exe
Token: SeCreatePagefilePrivilege	3808	powershell.exe
Token: SeBackupPrivilege	3808	powershell.exe
Token: SeRestorePrivilege	3808	powershell.exe
Token: SeShutdownPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeSystemEnvironmentPrivilege	3808	powershell.exe
Token: SeRemoteShutdownPrivilege	3808	powershell.exe
Token: SeUndockPrivilege	3808	powershell.exe
Token: SeManageVolumePrivilege	3808	powershell.exe
Token: 33	3808	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3192	1368	default.dat.exe	87
PID 3192 wrote to memory of 2784	3192	default.dat.exe	88
PID 2784 wrote to memory of 5828	2784	cmd.exe	90
PID 3192 wrote to memory of 3100	3192	default.dat.exe	92
PID 3100 wrote to memory of 5884	3100	cmd.exe	94
PID 3192 wrote to memory of 5576	3192	default.dat.exe	95
PID 5576 wrote to memory of 3808	5576	cmd.exe	97
PID 3192 wrote to memory of 2484	3192	default.dat.exe	98
PID 2484 wrote to memory of 3356	2484	cmd.exe	100
PID 3192 wrote to memory of 5808	3192	default.dat.exe	101
PID 5808 wrote to memory of 468	5808	cmd.exe	103
PID 3192 wrote to memory of 3472	3192	default.dat.exe	104
PID 3472 wrote to memory of 672	3472	cmd.exe	106
PID 3192 wrote to memory of 5928	3192	default.dat.exe	107
PID 5928 wrote to memory of 1048	5928	cmd.exe	109
PID 3192 wrote to memory of 5708	3192	default.dat.exe	110
PID 5708 wrote to memory of 2200	5708	cmd.exe	112
PID 3192 wrote to memory of 6056	3192	default.dat.exe	113
PID 6056 wrote to memory of 3784	6056	cmd.exe	115
PID 3192 wrote to memory of 3340	3192	default.dat.exe	116
PID 3340 wrote to memory of 2332	3340	cmd.exe	118
PID 3192 wrote to memory of 4944	3192	default.dat.exe	119
PID 4944 wrote to memory of 4688	4944	cmd.exe	121
PID 3192 wrote to memory of 4900	3192	default.dat.exe	122
PID 4900 wrote to memory of 3408	4900	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact