08138715841b5e43cd0a1ec83ceeda599ccfd4149250a47604b5eeb49df7adf8

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260720-lwchbady2r
SHA256 08138715841b5e43cd0a1ec83ceeda599ccfd4149250a47604b5eeb49df7adf8
MD5 6dc060b0ef5c1eeefea3a4c71fce3ae1
SHA1 61a75190ddc96d44faaf5f4c36de7a5ff77aede7
SHA512 9d795a25e3e7bb769c3160149f711664bcdc63f5efdb86e2fb9a5993b1f9e9100377eae1f811ac950726f214d4adf261b6ac0c9d9836ab373ff013b37330bceb
SSDEEP 393216:v4XgTPIahbFRjFrh6oG5XMCHWUjXxcuI3/PGTAI:vlXLhU5XMb8XmH/O7
TLSH
T184E6338CA9D012E9F9B3453EE5E01986E4A578394373C99B07BCC7B26E531E0493F663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe
2076	powershell.exe
1420	powershell.exe
4788	powershell.exe
1676	powershell.exe
2020	powershell.exe
1056	powershell.exe
3064	powershell.exe
628	powershell.exe
4884	powershell.exe
4616	powershell.exe
5512	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe
2064	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4492	cmd.exe
3336	cmd.exe
1696	cmd.exe
4916	cmd.exe
2876	cmd.exe
4836	cmd.exe
4576	cmd.exe
4168	cmd.exe
5672	cmd.exe
2940	cmd.exe
2260	cmd.exe
4800	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2064	default.dat.exe
2064	default.dat.exe
4616	powershell.exe
4616	powershell.exe
5512	powershell.exe
5512	powershell.exe
1420	powershell.exe
1420	powershell.exe
2696	powershell.exe
2696	powershell.exe
4788	powershell.exe
4788	powershell.exe
1676	powershell.exe
1676	powershell.exe
2020	powershell.exe
2020	powershell.exe
1056	powershell.exe
1056	powershell.exe
3064	powershell.exe
3064	powershell.exe
2076	powershell.exe
2076	powershell.exe
628	powershell.exe
628	powershell.exe
4884	powershell.exe
4884	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	default.dat.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeIncreaseQuotaPrivilege	4616	powershell.exe
Token: SeSecurityPrivilege	4616	powershell.exe
Token: SeTakeOwnershipPrivilege	4616	powershell.exe
Token: SeLoadDriverPrivilege	4616	powershell.exe
Token: SeSystemProfilePrivilege	4616	powershell.exe
Token: SeSystemtimePrivilege	4616	powershell.exe
Token: SeProfSingleProcessPrivilege	4616	powershell.exe
Token: SeIncBasePriorityPrivilege	4616	powershell.exe
Token: SeCreatePagefilePrivilege	4616	powershell.exe
Token: SeBackupPrivilege	4616	powershell.exe
Token: SeRestorePrivilege	4616	powershell.exe
Token: SeShutdownPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeSystemEnvironmentPrivilege	4616	powershell.exe
Token: SeRemoteShutdownPrivilege	4616	powershell.exe
Token: SeUndockPrivilege	4616	powershell.exe
Token: SeManageVolumePrivilege	4616	powershell.exe
Token: 33	4616	powershell.exe
Token: 34	4616	powershell.exe
Token: 35	4616	powershell.exe
Token: 36	4616	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeIncreaseQuotaPrivilege	5512	powershell.exe
Token: SeSecurityPrivilege	5512	powershell.exe
Token: SeTakeOwnershipPrivilege	5512	powershell.exe
Token: SeLoadDriverPrivilege	5512	powershell.exe
Token: SeSystemProfilePrivilege	5512	powershell.exe
Token: SeSystemtimePrivilege	5512	powershell.exe
Token: SeProfSingleProcessPrivilege	5512	powershell.exe
Token: SeIncBasePriorityPrivilege	5512	powershell.exe
Token: SeCreatePagefilePrivilege	5512	powershell.exe
Token: SeBackupPrivilege	5512	powershell.exe
Token: SeRestorePrivilege	5512	powershell.exe
Token: SeShutdownPrivilege	5512	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeSystemEnvironmentPrivilege	5512	powershell.exe
Token: SeRemoteShutdownPrivilege	5512	powershell.exe
Token: SeUndockPrivilege	5512	powershell.exe
Token: SeManageVolumePrivilege	5512	powershell.exe
Token: 33	5512	powershell.exe
Token: 34	5512	powershell.exe
Token: 35	5512	powershell.exe
Token: 36	5512	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeIncreaseQuotaPrivilege	1420	powershell.exe
Token: SeSecurityPrivilege	1420	powershell.exe
Token: SeTakeOwnershipPrivilege	1420	powershell.exe
Token: SeLoadDriverPrivilege	1420	powershell.exe
Token: SeSystemProfilePrivilege	1420	powershell.exe
Token: SeSystemtimePrivilege	1420	powershell.exe
Token: SeProfSingleProcessPrivilege	1420	powershell.exe
Token: SeIncBasePriorityPrivilege	1420	powershell.exe
Token: SeCreatePagefilePrivilege	1420	powershell.exe
Token: SeBackupPrivilege	1420	powershell.exe
Token: SeRestorePrivilege	1420	powershell.exe
Token: SeShutdownPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeSystemEnvironmentPrivilege	1420	powershell.exe
Token: SeRemoteShutdownPrivilege	1420	powershell.exe
Token: SeUndockPrivilege	1420	powershell.exe
Token: SeManageVolumePrivilege	1420	powershell.exe
Token: 33	1420	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2064	1096	default.dat.exe	89
PID 2064 wrote to memory of 4492	2064	default.dat.exe	90
PID 4492 wrote to memory of 4616	4492	cmd.exe	92
PID 2064 wrote to memory of 4168	2064	default.dat.exe	94
PID 4168 wrote to memory of 5512	4168	cmd.exe	96
PID 2064 wrote to memory of 5672	2064	default.dat.exe	97
PID 5672 wrote to memory of 1420	5672	cmd.exe	99
PID 2064 wrote to memory of 2940	2064	default.dat.exe	100
PID 2940 wrote to memory of 2696	2940	cmd.exe	102
PID 2064 wrote to memory of 3336	2064	default.dat.exe	103
PID 3336 wrote to memory of 4788	3336	cmd.exe	105
PID 2064 wrote to memory of 1696	2064	default.dat.exe	106
PID 1696 wrote to memory of 1676	1696	cmd.exe	108
PID 2064 wrote to memory of 4916	2064	default.dat.exe	109
PID 4916 wrote to memory of 2020	4916	cmd.exe	111
PID 2064 wrote to memory of 2876	2064	default.dat.exe	112
PID 2876 wrote to memory of 1056	2876	cmd.exe	114
PID 2064 wrote to memory of 2260	2064	default.dat.exe	115
PID 2260 wrote to memory of 3064	2260	cmd.exe	117
PID 2064 wrote to memory of 4836	2064	default.dat.exe	118
PID 4836 wrote to memory of 2076	4836	cmd.exe	120
PID 2064 wrote to memory of 4576	2064	default.dat.exe	121
PID 4576 wrote to memory of 628	4576	cmd.exe	123
PID 2064 wrote to memory of 4800	2064	default.dat.exe	124
PID 4800 wrote to memory of 4884	4800	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact