ed92e83b34b68c9898477f927fa6de6571ffa2f305703f99c7a27fd4cec9241b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260717-efd8msaw7p
SHA256 ed92e83b34b68c9898477f927fa6de6571ffa2f305703f99c7a27fd4cec9241b
MD5 e82a19747800d65ddf304d39198eef69
SHA1 32065d1a7c26eb1c464f095af5f6107d209be5ec
SHA512 921baad580b9118ce914635b31a122832b91166c7cc9bce7f1c2412e25c377c7f3100739361520be0e27d145517d62d891eff0fcdc1cf5aa6b1aab03f44efb69
SSDEEP 393216:Fbs8U33yRMsanX+vq4448nXMCHWUjXhcuI3/PGTAI:F/444tnXMb8X2H/O7
TLSH
T118E6334865D002FEF673923CFEE15665E4A9B4665B30C7DF4B68D7A2AF072A0483C607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5772	powershell.exe
4772	powershell.exe
5484	powershell.exe
5392	powershell.exe
2484	powershell.exe
916	powershell.exe
5948	powershell.exe
3064	powershell.exe
4792	powershell.exe
5724	powershell.exe
6108	powershell.exe
6128	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe
5000	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5000	default.dat.exe
5000	default.dat.exe
5724	powershell.exe
5724	powershell.exe
4772	powershell.exe
4772	powershell.exe
5484	powershell.exe
5484	powershell.exe
5392	powershell.exe
5392	powershell.exe
2484	powershell.exe
2484	powershell.exe
6108	powershell.exe
6108	powershell.exe
916	powershell.exe
916	powershell.exe
6128	powershell.exe
6128	powershell.exe
5948	powershell.exe
5948	powershell.exe
5772	powershell.exe
5772	powershell.exe
3064	powershell.exe
3064	powershell.exe
4792	powershell.exe
4792	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	default.dat.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeIncreaseQuotaPrivilege	5724	powershell.exe
Token: SeSecurityPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5724	powershell.exe
Token: SeLoadDriverPrivilege	5724	powershell.exe
Token: SeSystemProfilePrivilege	5724	powershell.exe
Token: SeSystemtimePrivilege	5724	powershell.exe
Token: SeProfSingleProcessPrivilege	5724	powershell.exe
Token: SeIncBasePriorityPrivilege	5724	powershell.exe
Token: SeCreatePagefilePrivilege	5724	powershell.exe
Token: SeBackupPrivilege	5724	powershell.exe
Token: SeRestorePrivilege	5724	powershell.exe
Token: SeShutdownPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeSystemEnvironmentPrivilege	5724	powershell.exe
Token: SeRemoteShutdownPrivilege	5724	powershell.exe
Token: SeUndockPrivilege	5724	powershell.exe
Token: SeManageVolumePrivilege	5724	powershell.exe
Token: 33	5724	powershell.exe
Token: 34	5724	powershell.exe
Token: 35	5724	powershell.exe
Token: 36	5724	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeIncreaseQuotaPrivilege	4772	powershell.exe
Token: SeSecurityPrivilege	4772	powershell.exe
Token: SeTakeOwnershipPrivilege	4772	powershell.exe
Token: SeLoadDriverPrivilege	4772	powershell.exe
Token: SeSystemProfilePrivilege	4772	powershell.exe
Token: SeSystemtimePrivilege	4772	powershell.exe
Token: SeProfSingleProcessPrivilege	4772	powershell.exe
Token: SeIncBasePriorityPrivilege	4772	powershell.exe
Token: SeCreatePagefilePrivilege	4772	powershell.exe
Token: SeBackupPrivilege	4772	powershell.exe
Token: SeRestorePrivilege	4772	powershell.exe
Token: SeShutdownPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeSystemEnvironmentPrivilege	4772	powershell.exe
Token: SeRemoteShutdownPrivilege	4772	powershell.exe
Token: SeUndockPrivilege	4772	powershell.exe
Token: SeManageVolumePrivilege	4772	powershell.exe
Token: 33	4772	powershell.exe
Token: 34	4772	powershell.exe
Token: 35	4772	powershell.exe
Token: 36	4772	powershell.exe
Token: SeDebugPrivilege	5484	powershell.exe
Token: SeIncreaseQuotaPrivilege	5484	powershell.exe
Token: SeSecurityPrivilege	5484	powershell.exe
Token: SeTakeOwnershipPrivilege	5484	powershell.exe
Token: SeLoadDriverPrivilege	5484	powershell.exe
Token: SeSystemProfilePrivilege	5484	powershell.exe
Token: SeSystemtimePrivilege	5484	powershell.exe
Token: SeProfSingleProcessPrivilege	5484	powershell.exe
Token: SeIncBasePriorityPrivilege	5484	powershell.exe
Token: SeCreatePagefilePrivilege	5484	powershell.exe
Token: SeBackupPrivilege	5484	powershell.exe
Token: SeRestorePrivilege	5484	powershell.exe
Token: SeShutdownPrivilege	5484	powershell.exe
Token: SeDebugPrivilege	5484	powershell.exe
Token: SeSystemEnvironmentPrivilege	5484	powershell.exe
Token: SeRemoteShutdownPrivilege	5484	powershell.exe
Token: SeUndockPrivilege	5484	powershell.exe
Token: SeManageVolumePrivilege	5484	powershell.exe
Token: 33	5484	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 5000	5024	default.dat.exe	87
PID 5000 wrote to memory of 1232	5000	default.dat.exe	88
PID 1232 wrote to memory of 5724	1232	cmd.exe	90
PID 5000 wrote to memory of 1224	5000	default.dat.exe	92
PID 1224 wrote to memory of 4772	1224	cmd.exe	94
PID 5000 wrote to memory of 4212	5000	default.dat.exe	95
PID 4212 wrote to memory of 5484	4212	cmd.exe	97
PID 5000 wrote to memory of 5364	5000	default.dat.exe	98
PID 5364 wrote to memory of 5392	5364	cmd.exe	100
PID 5000 wrote to memory of 1520	5000	default.dat.exe	101
PID 1520 wrote to memory of 2484	1520	cmd.exe	103
PID 5000 wrote to memory of 1772	5000	default.dat.exe	104
PID 1772 wrote to memory of 6108	1772	cmd.exe	106
PID 5000 wrote to memory of 3356	5000	default.dat.exe	107
PID 3356 wrote to memory of 916	3356	cmd.exe	109
PID 5000 wrote to memory of 4172	5000	default.dat.exe	110
PID 4172 wrote to memory of 6128	4172	cmd.exe	112
PID 5000 wrote to memory of 1420	5000	default.dat.exe	113
PID 1420 wrote to memory of 5948	1420	cmd.exe	115
PID 5000 wrote to memory of 3424	5000	default.dat.exe	116
PID 3424 wrote to memory of 5772	3424	cmd.exe	118
PID 5000 wrote to memory of 3808	5000	default.dat.exe	119
PID 3808 wrote to memory of 3064	3808	cmd.exe	121
PID 5000 wrote to memory of 1704	5000	default.dat.exe	122
PID 1704 wrote to memory of 4792	1704	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yoyumeme'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yoyumeme'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact