39ec954d66b2484f72787a62cc472fc1c8cf95042c2dae1e045f972731ee51e2

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260720-vdmd8sgx2k
SHA256 39ec954d66b2484f72787a62cc472fc1c8cf95042c2dae1e045f972731ee51e2
MD5 e5d1adc01b9b1ca525909358a97bfa3a
SHA1 2bc6800a208b92cd5629f0f64505871b33f62f2d
SHA512 32d189d67648aaf8a1d0b6bd1dd83e1e79a3562e578f32a5a4001be3c1330ea192318b4c02d46df8a706a54b4155ed9cd4cb3017578629b68dc9f15188fb5b63
SSDEEP 393216:5gZeGLJxrKEvTb+DRRXMCHWUjXecuI3/PGTAI:5gzjrKyTbQRXMb8XTH/O7
TLSH
T1E1E63358BAD052FEC573513DDEE241A5D9ACB83317B2C49F1B8882A5BE131E44E3DA13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2108	powershell.exe
1980	powershell.exe
5252	powershell.exe
5492	powershell.exe
5680	powershell.exe
1532	powershell.exe
1436	powershell.exe
4768	powershell.exe
3416	powershell.exe
1520	powershell.exe
5676	powershell.exe
1724	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe
4436	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	cmd.exe
4152	cmd.exe
6096	cmd.exe
248	cmd.exe
4988	cmd.exe
5960	cmd.exe
5652	cmd.exe
4452	cmd.exe
4308	cmd.exe
4424	cmd.exe
3456	cmd.exe
1296	cmd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4436	default.dat.exe
4436	default.dat.exe
5676	powershell.exe
5676	powershell.exe
1724	powershell.exe
1724	powershell.exe
1532	powershell.exe
1532	powershell.exe
2108	powershell.exe
2108	powershell.exe
1980	powershell.exe
1980	powershell.exe
5252	powershell.exe
5252	powershell.exe
1436	powershell.exe
1436	powershell.exe
5492	powershell.exe
5492	powershell.exe
5680	powershell.exe
5680	powershell.exe
3416	powershell.exe
3416	powershell.exe
1520	powershell.exe
1520	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	default.dat.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeIncreaseQuotaPrivilege	5676	powershell.exe
Token: SeSecurityPrivilege	5676	powershell.exe
Token: SeTakeOwnershipPrivilege	5676	powershell.exe
Token: SeLoadDriverPrivilege	5676	powershell.exe
Token: SeSystemProfilePrivilege	5676	powershell.exe
Token: SeSystemtimePrivilege	5676	powershell.exe
Token: SeProfSingleProcessPrivilege	5676	powershell.exe
Token: SeIncBasePriorityPrivilege	5676	powershell.exe
Token: SeCreatePagefilePrivilege	5676	powershell.exe
Token: SeBackupPrivilege	5676	powershell.exe
Token: SeRestorePrivilege	5676	powershell.exe
Token: SeShutdownPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeSystemEnvironmentPrivilege	5676	powershell.exe
Token: SeRemoteShutdownPrivilege	5676	powershell.exe
Token: SeUndockPrivilege	5676	powershell.exe
Token: SeManageVolumePrivilege	5676	powershell.exe
Token: 33	5676	powershell.exe
Token: 34	5676	powershell.exe
Token: 35	5676	powershell.exe
Token: 36	5676	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeIncreaseQuotaPrivilege	1724	powershell.exe
Token: SeSecurityPrivilege	1724	powershell.exe
Token: SeTakeOwnershipPrivilege	1724	powershell.exe
Token: SeLoadDriverPrivilege	1724	powershell.exe
Token: SeSystemProfilePrivilege	1724	powershell.exe
Token: SeSystemtimePrivilege	1724	powershell.exe
Token: SeProfSingleProcessPrivilege	1724	powershell.exe
Token: SeIncBasePriorityPrivilege	1724	powershell.exe
Token: SeCreatePagefilePrivilege	1724	powershell.exe
Token: SeBackupPrivilege	1724	powershell.exe
Token: SeRestorePrivilege	1724	powershell.exe
Token: SeShutdownPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeSystemEnvironmentPrivilege	1724	powershell.exe
Token: SeRemoteShutdownPrivilege	1724	powershell.exe
Token: SeUndockPrivilege	1724	powershell.exe
Token: SeManageVolumePrivilege	1724	powershell.exe
Token: 33	1724	powershell.exe
Token: 34	1724	powershell.exe
Token: 35	1724	powershell.exe
Token: 36	1724	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 4436	1216	default.dat.exe	89
PID 4436 wrote to memory of 6096	4436	default.dat.exe	90
PID 6096 wrote to memory of 5676	6096	cmd.exe	92
PID 4436 wrote to memory of 248	4436	default.dat.exe	94
PID 248 wrote to memory of 1724	248	cmd.exe	96
PID 4436 wrote to memory of 4988	4436	default.dat.exe	97
PID 4988 wrote to memory of 1532	4988	cmd.exe	99
PID 4436 wrote to memory of 4308	4436	default.dat.exe	100
PID 4308 wrote to memory of 2108	4308	cmd.exe	102
PID 4436 wrote to memory of 4424	4436	default.dat.exe	103
PID 4424 wrote to memory of 1980	4424	cmd.exe	105
PID 4436 wrote to memory of 3456	4436	default.dat.exe	106
PID 3456 wrote to memory of 5252	3456	cmd.exe	108
PID 4436 wrote to memory of 5960	4436	default.dat.exe	109
PID 5960 wrote to memory of 1436	5960	cmd.exe	111
PID 4436 wrote to memory of 5652	4436	default.dat.exe	112
PID 5652 wrote to memory of 5492	5652	cmd.exe	114
PID 4436 wrote to memory of 1296	4436	default.dat.exe	115
PID 1296 wrote to memory of 5680	1296	cmd.exe	117
PID 4436 wrote to memory of 4860	4436	default.dat.exe	118
PID 4860 wrote to memory of 4768	4860	cmd.exe	120
PID 4436 wrote to memory of 4452	4436	default.dat.exe	121
PID 4452 wrote to memory of 3416	4452	cmd.exe	123
PID 4436 wrote to memory of 4152	4436	default.dat.exe	124
PID 4152 wrote to memory of 1520	4152	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\juhugox'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact