fdb636d63b316929768ebe2c2ebf6b0a9eae33a18fef4426efdc62d13712f28f

Analysis

max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260712-yljvvsas2t
SHA256 fdb636d63b316929768ebe2c2ebf6b0a9eae33a18fef4426efdc62d13712f28f
MD5 caf7d5d928b90f08384795d8552f0df3
SHA1 69c404e697583f45a47e8a1b098e80e047e090b3
SHA512 d1012c46b8a622e680889b59f148d026d8f428cf3c88e81a60e8a667d85b3675ae39d9a8591bb66fae44cce37f51b10256464cd8494c2e4883c1c67b262c567e
SSDEEP 393216:zh/cCwAq1KPr2LzAT2GdgVXMCHWUjXxcuI3/PGTAI:zh/cXoyLs2AgVXMb8XmH/O7
TLSH
T163E6330DA6C112FDE1A7843CEB535219E2B2B4B70772CE9796E8C3895D5B2A1CC3C613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1116	powershell.exe
1888	powershell.exe
3936	powershell.exe
3060	powershell.exe
4312	powershell.exe
5944	powershell.exe
2400	powershell.exe
5220	powershell.exe
2884	powershell.exe
1280	powershell.exe
3100	powershell.exe
4300	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe
4292	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4292	default.dat.exe
4292	default.dat.exe
1116	powershell.exe
1116	powershell.exe
2400	powershell.exe
2400	powershell.exe
5220	powershell.exe
5220	powershell.exe
1888	powershell.exe
1888	powershell.exe
3936	powershell.exe
3936	powershell.exe
2884	powershell.exe
2884	powershell.exe
1280	powershell.exe
1280	powershell.exe
3060	powershell.exe
3060	powershell.exe
4312	powershell.exe
4312	powershell.exe
5944	powershell.exe
5944	powershell.exe
3100	powershell.exe
3100	powershell.exe
4300	powershell.exe
4300	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	default.dat.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeIncreaseQuotaPrivilege	1116	powershell.exe
Token: SeSecurityPrivilege	1116	powershell.exe
Token: SeTakeOwnershipPrivilege	1116	powershell.exe
Token: SeLoadDriverPrivilege	1116	powershell.exe
Token: SeSystemProfilePrivilege	1116	powershell.exe
Token: SeSystemtimePrivilege	1116	powershell.exe
Token: SeProfSingleProcessPrivilege	1116	powershell.exe
Token: SeIncBasePriorityPrivilege	1116	powershell.exe
Token: SeCreatePagefilePrivilege	1116	powershell.exe
Token: SeBackupPrivilege	1116	powershell.exe
Token: SeRestorePrivilege	1116	powershell.exe
Token: SeShutdownPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeSystemEnvironmentPrivilege	1116	powershell.exe
Token: SeRemoteShutdownPrivilege	1116	powershell.exe
Token: SeUndockPrivilege	1116	powershell.exe
Token: SeManageVolumePrivilege	1116	powershell.exe
Token: 33	1116	powershell.exe
Token: 34	1116	powershell.exe
Token: 35	1116	powershell.exe
Token: 36	1116	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeIncreaseQuotaPrivilege	2400	powershell.exe
Token: SeSecurityPrivilege	2400	powershell.exe
Token: SeTakeOwnershipPrivilege	2400	powershell.exe
Token: SeLoadDriverPrivilege	2400	powershell.exe
Token: SeSystemProfilePrivilege	2400	powershell.exe
Token: SeSystemtimePrivilege	2400	powershell.exe
Token: SeProfSingleProcessPrivilege	2400	powershell.exe
Token: SeIncBasePriorityPrivilege	2400	powershell.exe
Token: SeCreatePagefilePrivilege	2400	powershell.exe
Token: SeBackupPrivilege	2400	powershell.exe
Token: SeRestorePrivilege	2400	powershell.exe
Token: SeShutdownPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeSystemEnvironmentPrivilege	2400	powershell.exe
Token: SeRemoteShutdownPrivilege	2400	powershell.exe
Token: SeUndockPrivilege	2400	powershell.exe
Token: SeManageVolumePrivilege	2400	powershell.exe
Token: 33	2400	powershell.exe
Token: 34	2400	powershell.exe
Token: 35	2400	powershell.exe
Token: 36	2400	powershell.exe
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeIncreaseQuotaPrivilege	5220	powershell.exe
Token: SeSecurityPrivilege	5220	powershell.exe
Token: SeTakeOwnershipPrivilege	5220	powershell.exe
Token: SeLoadDriverPrivilege	5220	powershell.exe
Token: SeSystemProfilePrivilege	5220	powershell.exe
Token: SeSystemtimePrivilege	5220	powershell.exe
Token: SeProfSingleProcessPrivilege	5220	powershell.exe
Token: SeIncBasePriorityPrivilege	5220	powershell.exe
Token: SeCreatePagefilePrivilege	5220	powershell.exe
Token: SeBackupPrivilege	5220	powershell.exe
Token: SeRestorePrivilege	5220	powershell.exe
Token: SeShutdownPrivilege	5220	powershell.exe
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeSystemEnvironmentPrivilege	5220	powershell.exe
Token: SeRemoteShutdownPrivilege	5220	powershell.exe
Token: SeUndockPrivilege	5220	powershell.exe
Token: SeManageVolumePrivilege	5220	powershell.exe
Token: 33	5220	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4292	1268	default.dat.exe	87
PID 4292 wrote to memory of 3004	4292	default.dat.exe	88
PID 3004 wrote to memory of 1116	3004	cmd.exe	90
PID 4292 wrote to memory of 1596	4292	default.dat.exe	92
PID 1596 wrote to memory of 2400	1596	cmd.exe	94
PID 4292 wrote to memory of 4828	4292	default.dat.exe	95
PID 4828 wrote to memory of 5220	4828	cmd.exe	97
PID 4292 wrote to memory of 1240	4292	default.dat.exe	98
PID 1240 wrote to memory of 1888	1240	cmd.exe	100
PID 4292 wrote to memory of 1408	4292	default.dat.exe	101
PID 1408 wrote to memory of 3936	1408	cmd.exe	103
PID 4292 wrote to memory of 2172	4292	default.dat.exe	104
PID 2172 wrote to memory of 2884	2172	cmd.exe	106
PID 4292 wrote to memory of 3248	4292	default.dat.exe	107
PID 3248 wrote to memory of 1280	3248	cmd.exe	109
PID 4292 wrote to memory of 1972	4292	default.dat.exe	110
PID 1972 wrote to memory of 3060	1972	cmd.exe	112
PID 4292 wrote to memory of 2236	4292	default.dat.exe	113
PID 2236 wrote to memory of 4312	2236	cmd.exe	115
PID 4292 wrote to memory of 3140	4292	default.dat.exe	116
PID 3140 wrote to memory of 5944	3140	cmd.exe	118
PID 4292 wrote to memory of 5536	4292	default.dat.exe	119
PID 5536 wrote to memory of 3100	5536	cmd.exe	121
PID 4292 wrote to memory of 4060	4292	default.dat.exe	122
PID 4060 wrote to memory of 4300	4060	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\dovuyoja'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact