8c70ae6d0965351ec8417ed37bba85dd58b05afae292cf932efeb4fcc5c7b331

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260720-2tm42aat4v
SHA256 8c70ae6d0965351ec8417ed37bba85dd58b05afae292cf932efeb4fcc5c7b331
MD5 2ab739aea74c61a27a85c7e5c05abf52
SHA1 971147e924e096e95ed563eff41288a9fcc348cb
SHA512 3f2fc9e51eff89ade41a128052252d6f40006294e790b1959b16b2191cc33105e7b01d8161df4d0d8b4002b2ad8c59f04b3f190f778df8d35f9ecd6565f81167
SSDEEP 393216:bVGw47wd0g6UywFr5QYUxXMCHWUjX4cuI3/PGTAI:bVnd0PBs6YOXMb8XNH/O7
TLSH
T164E63314AAE101CFF6A3503DDDE30695F99A3CBB0771808F96E457726E672E2C839607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2172	powershell.exe
6140	powershell.exe
3416	powershell.exe
5272	powershell.exe
3492	powershell.exe
3608	powershell.exe
4264	powershell.exe
252	powershell.exe
5240	powershell.exe
984	powershell.exe
3480	powershell.exe
4884	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe
2780	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1932	cmd.exe
1748	cmd.exe
4612	cmd.exe
5256	cmd.exe
4652	cmd.exe
4336	cmd.exe
2824	cmd.exe
5972	cmd.exe
4320	cmd.exe
936	cmd.exe
3196	cmd.exe
2640	cmd.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2780	default.dat.exe
2780	default.dat.exe
2172	powershell.exe
2172	powershell.exe
6140	powershell.exe
6140	powershell.exe
3416	powershell.exe
3416	powershell.exe
5240	powershell.exe
5240	powershell.exe
984	powershell.exe
984	powershell.exe
3480	powershell.exe
3480	powershell.exe
5272	powershell.exe
5272	powershell.exe
3492	powershell.exe
3492	powershell.exe
3608	powershell.exe
3608	powershell.exe
4884	powershell.exe
4884	powershell.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe
252	powershell.exe
252	powershell.exe
252	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	default.dat.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeIncreaseQuotaPrivilege	2172	powershell.exe
Token: SeSecurityPrivilege	2172	powershell.exe
Token: SeTakeOwnershipPrivilege	2172	powershell.exe
Token: SeLoadDriverPrivilege	2172	powershell.exe
Token: SeSystemProfilePrivilege	2172	powershell.exe
Token: SeSystemtimePrivilege	2172	powershell.exe
Token: SeProfSingleProcessPrivilege	2172	powershell.exe
Token: SeIncBasePriorityPrivilege	2172	powershell.exe
Token: SeCreatePagefilePrivilege	2172	powershell.exe
Token: SeBackupPrivilege	2172	powershell.exe
Token: SeRestorePrivilege	2172	powershell.exe
Token: SeShutdownPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeSystemEnvironmentPrivilege	2172	powershell.exe
Token: SeRemoteShutdownPrivilege	2172	powershell.exe
Token: SeUndockPrivilege	2172	powershell.exe
Token: SeManageVolumePrivilege	2172	powershell.exe
Token: 33	2172	powershell.exe
Token: 34	2172	powershell.exe
Token: 35	2172	powershell.exe
Token: 36	2172	powershell.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeIncreaseQuotaPrivilege	6140	powershell.exe
Token: SeSecurityPrivilege	6140	powershell.exe
Token: SeTakeOwnershipPrivilege	6140	powershell.exe
Token: SeLoadDriverPrivilege	6140	powershell.exe
Token: SeSystemProfilePrivilege	6140	powershell.exe
Token: SeSystemtimePrivilege	6140	powershell.exe
Token: SeProfSingleProcessPrivilege	6140	powershell.exe
Token: SeIncBasePriorityPrivilege	6140	powershell.exe
Token: SeCreatePagefilePrivilege	6140	powershell.exe
Token: SeBackupPrivilege	6140	powershell.exe
Token: SeRestorePrivilege	6140	powershell.exe
Token: SeShutdownPrivilege	6140	powershell.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeSystemEnvironmentPrivilege	6140	powershell.exe
Token: SeRemoteShutdownPrivilege	6140	powershell.exe
Token: SeUndockPrivilege	6140	powershell.exe
Token: SeManageVolumePrivilege	6140	powershell.exe
Token: 33	6140	powershell.exe
Token: 34	6140	powershell.exe
Token: 35	6140	powershell.exe
Token: 36	6140	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeIncreaseQuotaPrivilege	3416	powershell.exe
Token: SeSecurityPrivilege	3416	powershell.exe
Token: SeTakeOwnershipPrivilege	3416	powershell.exe
Token: SeLoadDriverPrivilege	3416	powershell.exe
Token: SeSystemProfilePrivilege	3416	powershell.exe
Token: SeSystemtimePrivilege	3416	powershell.exe
Token: SeProfSingleProcessPrivilege	3416	powershell.exe
Token: SeIncBasePriorityPrivilege	3416	powershell.exe
Token: SeCreatePagefilePrivilege	3416	powershell.exe
Token: SeBackupPrivilege	3416	powershell.exe
Token: SeRestorePrivilege	3416	powershell.exe
Token: SeShutdownPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeSystemEnvironmentPrivilege	3416	powershell.exe
Token: SeRemoteShutdownPrivilege	3416	powershell.exe
Token: SeUndockPrivilege	3416	powershell.exe
Token: SeManageVolumePrivilege	3416	powershell.exe
Token: 33	3416	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2780	2440	default.dat.exe	89
PID 2780 wrote to memory of 4652	2780	default.dat.exe	90
PID 4652 wrote to memory of 2172	4652	cmd.exe	92
PID 2780 wrote to memory of 2640	2780	default.dat.exe	94
PID 2640 wrote to memory of 6140	2640	cmd.exe	96
PID 2780 wrote to memory of 1932	2780	default.dat.exe	97
PID 1932 wrote to memory of 3416	1932	cmd.exe	99
PID 2780 wrote to memory of 4336	2780	default.dat.exe	100
PID 4336 wrote to memory of 5240	4336	cmd.exe	102
PID 2780 wrote to memory of 1748	2780	default.dat.exe	103
PID 1748 wrote to memory of 984	1748	cmd.exe	105
PID 2780 wrote to memory of 2824	2780	default.dat.exe	106
PID 2824 wrote to memory of 3480	2824	cmd.exe	108
PID 2780 wrote to memory of 4612	2780	default.dat.exe	109
PID 4612 wrote to memory of 5272	4612	cmd.exe	111
PID 2780 wrote to memory of 5256	2780	default.dat.exe	112
PID 5256 wrote to memory of 3492	5256	cmd.exe	114
PID 2780 wrote to memory of 5972	2780	default.dat.exe	115
PID 5972 wrote to memory of 3608	5972	cmd.exe	117
PID 2780 wrote to memory of 4320	2780	default.dat.exe	118
PID 4320 wrote to memory of 4884	4320	cmd.exe	120
PID 2780 wrote to memory of 936	2780	default.dat.exe	121
PID 936 wrote to memory of 4264	936	cmd.exe	123
PID 2780 wrote to memory of 3196	2780	default.dat.exe	124
PID 3196 wrote to memory of 252	3196	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact