a4c79a72a8aa38058a43b502d2a7faf04b8367f18875468f37d009c235a9249e

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260712-tbaf8aew2s
SHA256 a4c79a72a8aa38058a43b502d2a7faf04b8367f18875468f37d009c235a9249e
MD5 fb543254ed01bd259241edde0000157b
SHA1 c567472add370e797468c22b8b943bf61855853a
SHA512 931270692f2b6ba87539eb1c7260419e084e140a116f208d366a46f6a3ff9a2cd4f4db5fc85f00ca484caeaf423d227caa4ab24841dc48ceb86a1a49e91fff75
SSDEEP 393216:mvYg9FBFlBSkydKJ8qCXMCHWUjXycuI3/PGTAI:mvZ7zSkydKJ8qCXMb8XPH/O7
TLSH
T1DCE63309A5E042FEE6A3913CEDE296B8E570F4531B31CEDF07A48252AC972E1493D717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5400	powershell.exe
5920	powershell.exe
3788	powershell.exe
3684	powershell.exe
3720	powershell.exe
5044	powershell.exe
2496	powershell.exe
4664	powershell.exe
5932	powershell.exe
2588	powershell.exe
4296	powershell.exe
1620	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe
5668	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5668	default.dat.exe
5668	default.dat.exe
4664	powershell.exe
4664	powershell.exe
5932	powershell.exe
5932	powershell.exe
5400	powershell.exe
5400	powershell.exe
5920	powershell.exe
5920	powershell.exe
3788	powershell.exe
3788	powershell.exe
3684	powershell.exe
3684	powershell.exe
3720	powershell.exe
3720	powershell.exe
2588	powershell.exe
2588	powershell.exe
4296	powershell.exe
4296	powershell.exe
5044	powershell.exe
5044	powershell.exe
2496	powershell.exe
2496	powershell.exe
1620	powershell.exe
1620	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5668	default.dat.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeIncreaseQuotaPrivilege	4664	powershell.exe
Token: SeSecurityPrivilege	4664	powershell.exe
Token: SeTakeOwnershipPrivilege	4664	powershell.exe
Token: SeLoadDriverPrivilege	4664	powershell.exe
Token: SeSystemProfilePrivilege	4664	powershell.exe
Token: SeSystemtimePrivilege	4664	powershell.exe
Token: SeProfSingleProcessPrivilege	4664	powershell.exe
Token: SeIncBasePriorityPrivilege	4664	powershell.exe
Token: SeCreatePagefilePrivilege	4664	powershell.exe
Token: SeBackupPrivilege	4664	powershell.exe
Token: SeRestorePrivilege	4664	powershell.exe
Token: SeShutdownPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeSystemEnvironmentPrivilege	4664	powershell.exe
Token: SeRemoteShutdownPrivilege	4664	powershell.exe
Token: SeUndockPrivilege	4664	powershell.exe
Token: SeManageVolumePrivilege	4664	powershell.exe
Token: 33	4664	powershell.exe
Token: 34	4664	powershell.exe
Token: 35	4664	powershell.exe
Token: 36	4664	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeIncreaseQuotaPrivilege	5932	powershell.exe
Token: SeSecurityPrivilege	5932	powershell.exe
Token: SeTakeOwnershipPrivilege	5932	powershell.exe
Token: SeLoadDriverPrivilege	5932	powershell.exe
Token: SeSystemProfilePrivilege	5932	powershell.exe
Token: SeSystemtimePrivilege	5932	powershell.exe
Token: SeProfSingleProcessPrivilege	5932	powershell.exe
Token: SeIncBasePriorityPrivilege	5932	powershell.exe
Token: SeCreatePagefilePrivilege	5932	powershell.exe
Token: SeBackupPrivilege	5932	powershell.exe
Token: SeRestorePrivilege	5932	powershell.exe
Token: SeShutdownPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeSystemEnvironmentPrivilege	5932	powershell.exe
Token: SeRemoteShutdownPrivilege	5932	powershell.exe
Token: SeUndockPrivilege	5932	powershell.exe
Token: SeManageVolumePrivilege	5932	powershell.exe
Token: 33	5932	powershell.exe
Token: 34	5932	powershell.exe
Token: 35	5932	powershell.exe
Token: 36	5932	powershell.exe
Token: SeDebugPrivilege	5400	powershell.exe
Token: SeIncreaseQuotaPrivilege	5400	powershell.exe
Token: SeSecurityPrivilege	5400	powershell.exe
Token: SeTakeOwnershipPrivilege	5400	powershell.exe
Token: SeLoadDriverPrivilege	5400	powershell.exe
Token: SeSystemProfilePrivilege	5400	powershell.exe
Token: SeSystemtimePrivilege	5400	powershell.exe
Token: SeProfSingleProcessPrivilege	5400	powershell.exe
Token: SeIncBasePriorityPrivilege	5400	powershell.exe
Token: SeCreatePagefilePrivilege	5400	powershell.exe
Token: SeBackupPrivilege	5400	powershell.exe
Token: SeRestorePrivilege	5400	powershell.exe
Token: SeShutdownPrivilege	5400	powershell.exe
Token: SeDebugPrivilege	5400	powershell.exe
Token: SeSystemEnvironmentPrivilege	5400	powershell.exe
Token: SeRemoteShutdownPrivilege	5400	powershell.exe
Token: SeUndockPrivilege	5400	powershell.exe
Token: SeManageVolumePrivilege	5400	powershell.exe
Token: 33	5400	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5668	3332	default.dat.exe	86
PID 5668 wrote to memory of 3656	5668	default.dat.exe	87
PID 3656 wrote to memory of 4664	3656	cmd.exe	89
PID 5668 wrote to memory of 796	5668	default.dat.exe	91
PID 796 wrote to memory of 5932	796	cmd.exe	93
PID 5668 wrote to memory of 2956	5668	default.dat.exe	94
PID 2956 wrote to memory of 5400	2956	cmd.exe	96
PID 5668 wrote to memory of 864	5668	default.dat.exe	97
PID 864 wrote to memory of 5920	864	cmd.exe	99
PID 5668 wrote to memory of 1012	5668	default.dat.exe	100
PID 1012 wrote to memory of 3788	1012	cmd.exe	102
PID 5668 wrote to memory of 4236	5668	default.dat.exe	103
PID 4236 wrote to memory of 3684	4236	cmd.exe	105
PID 5668 wrote to memory of 5952	5668	default.dat.exe	106
PID 5952 wrote to memory of 3720	5952	cmd.exe	108
PID 5668 wrote to memory of 4964	5668	default.dat.exe	109
PID 4964 wrote to memory of 2588	4964	cmd.exe	111
PID 5668 wrote to memory of 244	5668	default.dat.exe	112
PID 244 wrote to memory of 4296	244	cmd.exe	114
PID 5668 wrote to memory of 1880	5668	default.dat.exe	115
PID 1880 wrote to memory of 5044	1880	cmd.exe	117
PID 5668 wrote to memory of 940	5668	default.dat.exe	119
PID 940 wrote to memory of 2496	940	cmd.exe	121
PID 5668 wrote to memory of 2576	5668	default.dat.exe	122
PID 2576 wrote to memory of 1620	2576	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact