5da44e36790d8bb2ab51d7b70bbc25063d8236b959a3452cbb4bc41b5bcd4966

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260717-capfbahv9q
SHA256 5da44e36790d8bb2ab51d7b70bbc25063d8236b959a3452cbb4bc41b5bcd4966
MD5 e8c3c8d8b522b6c0879c364ccfbf38b0
SHA1 265109b8a26b6602bc5bcbb300fc7d38e7d07936
SHA512 a9c02df1f675c16bc60c0a11610692514b72e5b1a73f28a095aa220fc060dfe9a91b6be46cd931f365c35f64ff00b4832124520fe1dd04842869ee3b30103b47
SSDEEP 393216:dTqwYdIi8pp4cBKeB7+Sa5JnoXMCHWUjX1cuI3/PGTAI:dOkTpejeB7+S+mXMb8XCH/O7
TLSH
T1BCE63358BBD002EED8A3403CDBE191DEA69974771B31C59F57AC43A65E832E08E3C617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5568	powershell.exe
2860	powershell.exe
2512	powershell.exe
5000	powershell.exe
1120	powershell.exe
4416	powershell.exe
2560	powershell.exe
1708	powershell.exe
2636	powershell.exe
2484	powershell.exe
972	powershell.exe
3184	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe
3536	default.dat.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3536	default.dat.exe
3536	default.dat.exe
2636	powershell.exe
2636	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
2484	powershell.exe
2484	powershell.exe
2484	powershell.exe
972	powershell.exe
972	powershell.exe
972	powershell.exe
3184	powershell.exe
3184	powershell.exe
3184	powershell.exe
1708	powershell.exe
1708	powershell.exe
5568	powershell.exe
5568	powershell.exe
5568	powershell.exe
2860	powershell.exe
2860	powershell.exe
2860	powershell.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
5000	powershell.exe
5000	powershell.exe
5000	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	default.dat.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeIncreaseQuotaPrivilege	2636	powershell.exe
Token: SeSecurityPrivilege	2636	powershell.exe
Token: SeTakeOwnershipPrivilege	2636	powershell.exe
Token: SeLoadDriverPrivilege	2636	powershell.exe
Token: SeSystemProfilePrivilege	2636	powershell.exe
Token: SeSystemtimePrivilege	2636	powershell.exe
Token: SeProfSingleProcessPrivilege	2636	powershell.exe
Token: SeIncBasePriorityPrivilege	2636	powershell.exe
Token: SeCreatePagefilePrivilege	2636	powershell.exe
Token: SeBackupPrivilege	2636	powershell.exe
Token: SeRestorePrivilege	2636	powershell.exe
Token: SeShutdownPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeSystemEnvironmentPrivilege	2636	powershell.exe
Token: SeRemoteShutdownPrivilege	2636	powershell.exe
Token: SeUndockPrivilege	2636	powershell.exe
Token: SeManageVolumePrivilege	2636	powershell.exe
Token: 33	2636	powershell.exe
Token: 34	2636	powershell.exe
Token: 35	2636	powershell.exe
Token: 36	2636	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeIncreaseQuotaPrivilege	1120	powershell.exe
Token: SeSecurityPrivilege	1120	powershell.exe
Token: SeTakeOwnershipPrivilege	1120	powershell.exe
Token: SeLoadDriverPrivilege	1120	powershell.exe
Token: SeSystemProfilePrivilege	1120	powershell.exe
Token: SeSystemtimePrivilege	1120	powershell.exe
Token: SeProfSingleProcessPrivilege	1120	powershell.exe
Token: SeIncBasePriorityPrivilege	1120	powershell.exe
Token: SeCreatePagefilePrivilege	1120	powershell.exe
Token: SeBackupPrivilege	1120	powershell.exe
Token: SeRestorePrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeSystemEnvironmentPrivilege	1120	powershell.exe
Token: SeRemoteShutdownPrivilege	1120	powershell.exe
Token: SeUndockPrivilege	1120	powershell.exe
Token: SeManageVolumePrivilege	1120	powershell.exe
Token: 33	1120	powershell.exe
Token: 34	1120	powershell.exe
Token: 35	1120	powershell.exe
Token: 36	1120	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeIncreaseQuotaPrivilege	4416	powershell.exe
Token: SeSecurityPrivilege	4416	powershell.exe
Token: SeTakeOwnershipPrivilege	4416	powershell.exe
Token: SeLoadDriverPrivilege	4416	powershell.exe
Token: SeSystemProfilePrivilege	4416	powershell.exe
Token: SeSystemtimePrivilege	4416	powershell.exe
Token: SeProfSingleProcessPrivilege	4416	powershell.exe
Token: SeIncBasePriorityPrivilege	4416	powershell.exe
Token: SeCreatePagefilePrivilege	4416	powershell.exe
Token: SeBackupPrivilege	4416	powershell.exe
Token: SeRestorePrivilege	4416	powershell.exe
Token: SeShutdownPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeSystemEnvironmentPrivilege	4416	powershell.exe
Token: SeRemoteShutdownPrivilege	4416	powershell.exe
Token: SeUndockPrivilege	4416	powershell.exe
Token: SeManageVolumePrivilege	4416	powershell.exe
Token: 33	4416	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3536	2256	default.dat.exe	89
PID 3536 wrote to memory of 864	3536	default.dat.exe	90
PID 864 wrote to memory of 2636	864	cmd.exe	92
PID 3536 wrote to memory of 2648	3536	default.dat.exe	94
PID 2648 wrote to memory of 1120	2648	cmd.exe	96
PID 3536 wrote to memory of 1444	3536	default.dat.exe	97
PID 1444 wrote to memory of 4416	1444	cmd.exe	99
PID 3536 wrote to memory of 3088	3536	default.dat.exe	100
PID 3088 wrote to memory of 2560	3088	cmd.exe	102
PID 3536 wrote to memory of 2416	3536	default.dat.exe	103
PID 2416 wrote to memory of 2484	2416	cmd.exe	105
PID 3536 wrote to memory of 4344	3536	default.dat.exe	106
PID 4344 wrote to memory of 972	4344	cmd.exe	108
PID 3536 wrote to memory of 6080	3536	default.dat.exe	109
PID 6080 wrote to memory of 3184	6080	cmd.exe	111
PID 3536 wrote to memory of 2252	3536	default.dat.exe	112
PID 2252 wrote to memory of 1708	2252	cmd.exe	114
PID 3536 wrote to memory of 5640	3536	default.dat.exe	115
PID 5640 wrote to memory of 5568	5640	cmd.exe	117
PID 3536 wrote to memory of 3624	3536	default.dat.exe	118
PID 3624 wrote to memory of 2860	3624	cmd.exe	120
PID 3536 wrote to memory of 4604	3536	default.dat.exe	121
PID 4604 wrote to memory of 2512	4604	cmd.exe	123
PID 3536 wrote to memory of 3064	3536	default.dat.exe	124
PID 3064 wrote to memory of 5000	3064	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yoyumeme'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yoyumeme'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact