2c8bc292d127ec5fb5da2a9c8cbb8e4ec911f6b62437cb5f3a082ac196dc5784

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260720-tbbpaag16w
SHA256 2c8bc292d127ec5fb5da2a9c8cbb8e4ec911f6b62437cb5f3a082ac196dc5784
MD5 fe691c82407f7bfaf3ffe07f2186fb28
SHA1 30b55823efc60e74b0de80cabb8cf22384f738fd
SHA512 3dc7d394e66a17b0b516eefbe30c09d9025f350fa181e5ae3cd4394ece7f3338e0a7448d9395a94706508878d1a17232e90c5e86af402f8e588a58d45d17c11a
SSDEEP 393216:fuX9PHzbINtHIhcXMCHWUjXEcuI3/PGTAI:fuBHzOFIhcXMb8XRH/O7
TLSH
T136E633846AD013CFEB73413DEEE24685E998B4E52B71CA4B07A4A3563F232D0C97D617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
968	powershell.exe
4816	powershell.exe
4612	powershell.exe
432	powershell.exe
4972	powershell.exe
4536	powershell.exe
3228	powershell.exe
3280	powershell.exe
1220	powershell.exe
1836	powershell.exe
1292	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe
1792	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1272	cmd.exe
4928	cmd.exe
5668	cmd.exe
3444	cmd.exe
1668	cmd.exe
256	cmd.exe
3204	cmd.exe
3464	cmd.exe
1200	cmd.exe
2452	cmd.exe
964	cmd.exe
3512	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1792	default.dat.exe
1792	default.dat.exe
3280	powershell.exe
3280	powershell.exe
4816	powershell.exe
4816	powershell.exe
1220	powershell.exe
1220	powershell.exe
1836	powershell.exe
1836	powershell.exe
1292	powershell.exe
1292	powershell.exe
4612	powershell.exe
4612	powershell.exe
2420	powershell.exe
2420	powershell.exe
432	powershell.exe
432	powershell.exe
4972	powershell.exe
4972	powershell.exe
968	powershell.exe
968	powershell.exe
4536	powershell.exe
4536	powershell.exe
3228	powershell.exe
3228	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	default.dat.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeIncreaseQuotaPrivilege	3280	powershell.exe
Token: SeSecurityPrivilege	3280	powershell.exe
Token: SeTakeOwnershipPrivilege	3280	powershell.exe
Token: SeLoadDriverPrivilege	3280	powershell.exe
Token: SeSystemProfilePrivilege	3280	powershell.exe
Token: SeSystemtimePrivilege	3280	powershell.exe
Token: SeProfSingleProcessPrivilege	3280	powershell.exe
Token: SeIncBasePriorityPrivilege	3280	powershell.exe
Token: SeCreatePagefilePrivilege	3280	powershell.exe
Token: SeBackupPrivilege	3280	powershell.exe
Token: SeRestorePrivilege	3280	powershell.exe
Token: SeShutdownPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeSystemEnvironmentPrivilege	3280	powershell.exe
Token: SeRemoteShutdownPrivilege	3280	powershell.exe
Token: SeUndockPrivilege	3280	powershell.exe
Token: SeManageVolumePrivilege	3280	powershell.exe
Token: 33	3280	powershell.exe
Token: 34	3280	powershell.exe
Token: 35	3280	powershell.exe
Token: 36	3280	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeIncreaseQuotaPrivilege	4816	powershell.exe
Token: SeSecurityPrivilege	4816	powershell.exe
Token: SeTakeOwnershipPrivilege	4816	powershell.exe
Token: SeLoadDriverPrivilege	4816	powershell.exe
Token: SeSystemProfilePrivilege	4816	powershell.exe
Token: SeSystemtimePrivilege	4816	powershell.exe
Token: SeProfSingleProcessPrivilege	4816	powershell.exe
Token: SeIncBasePriorityPrivilege	4816	powershell.exe
Token: SeCreatePagefilePrivilege	4816	powershell.exe
Token: SeBackupPrivilege	4816	powershell.exe
Token: SeRestorePrivilege	4816	powershell.exe
Token: SeShutdownPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeSystemEnvironmentPrivilege	4816	powershell.exe
Token: SeRemoteShutdownPrivilege	4816	powershell.exe
Token: SeUndockPrivilege	4816	powershell.exe
Token: SeManageVolumePrivilege	4816	powershell.exe
Token: 33	4816	powershell.exe
Token: 34	4816	powershell.exe
Token: 35	4816	powershell.exe
Token: 36	4816	powershell.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeIncreaseQuotaPrivilege	1220	powershell.exe
Token: SeSecurityPrivilege	1220	powershell.exe
Token: SeTakeOwnershipPrivilege	1220	powershell.exe
Token: SeLoadDriverPrivilege	1220	powershell.exe
Token: SeSystemProfilePrivilege	1220	powershell.exe
Token: SeSystemtimePrivilege	1220	powershell.exe
Token: SeProfSingleProcessPrivilege	1220	powershell.exe
Token: SeIncBasePriorityPrivilege	1220	powershell.exe
Token: SeCreatePagefilePrivilege	1220	powershell.exe
Token: SeBackupPrivilege	1220	powershell.exe
Token: SeRestorePrivilege	1220	powershell.exe
Token: SeShutdownPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeSystemEnvironmentPrivilege	1220	powershell.exe
Token: SeRemoteShutdownPrivilege	1220	powershell.exe
Token: SeUndockPrivilege	1220	powershell.exe
Token: SeManageVolumePrivilege	1220	powershell.exe
Token: 33	1220	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 1792	5164	default.dat.exe	89
PID 1792 wrote to memory of 1668	1792	default.dat.exe	90
PID 1668 wrote to memory of 3280	1668	cmd.exe	92
PID 1792 wrote to memory of 256	1792	default.dat.exe	94
PID 256 wrote to memory of 4816	256	cmd.exe	96
PID 1792 wrote to memory of 1272	1792	default.dat.exe	97
PID 1272 wrote to memory of 1220	1272	cmd.exe	99
PID 1792 wrote to memory of 3204	1792	default.dat.exe	100
PID 3204 wrote to memory of 1836	3204	cmd.exe	102
PID 1792 wrote to memory of 3464	1792	default.dat.exe	103
PID 3464 wrote to memory of 1292	3464	cmd.exe	105
PID 1792 wrote to memory of 1200	1792	default.dat.exe	106
PID 1200 wrote to memory of 4612	1200	cmd.exe	108
PID 1792 wrote to memory of 4928	1792	default.dat.exe	109
PID 4928 wrote to memory of 2420	4928	cmd.exe	111
PID 1792 wrote to memory of 2452	1792	default.dat.exe	112
PID 2452 wrote to memory of 432	2452	cmd.exe	114
PID 1792 wrote to memory of 5668	1792	default.dat.exe	115
PID 5668 wrote to memory of 4972	5668	cmd.exe	117
PID 1792 wrote to memory of 964	1792	default.dat.exe	118
PID 964 wrote to memory of 968	964	cmd.exe	120
PID 1792 wrote to memory of 3444	1792	default.dat.exe	121
PID 3444 wrote to memory of 4536	3444	cmd.exe	123
PID 1792 wrote to memory of 3512	1792	default.dat.exe	124
PID 3512 wrote to memory of 3228	3512	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact