65dc2da8e1dc43bcbe782754a06f03f144b490781f94ff07c37a12e0e66e6844

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260721-efdbcaes2k
SHA256 65dc2da8e1dc43bcbe782754a06f03f144b490781f94ff07c37a12e0e66e6844
MD5 ee2b57565c612eb5153a90e16d2e4bdc
SHA1 8da1744012c8ff14697a804f58b7a7eac43e18ae
SHA512 8d59b20570465bdb97e80d10c3d9e770d5a90b9d1f656a0d54b46f544aaf652a03f933ffcfae2acd4ff0996ec0b6a5310c264d33eb6b3a93d0380e7e90c4b00d
SSDEEP 393216:2z1Czkz/uEdht3XyuF/iIY8fw3Qt8p4VXMCHWUjX5cuI3/PGTAI:2IzkzvnyuFI8V8IXMb8XOH/O7
TLSH
T1EAE63308FAE022FFE477013DED515B999999B822AB35C5DF13B487316D971F08A39223
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5920	powershell.exe
4656	powershell.exe
5660	powershell.exe
4276	powershell.exe
4312	powershell.exe
628	powershell.exe
4696	powershell.exe
848	powershell.exe
2492	powershell.exe
4648	powershell.exe
5888	powershell.exe
5720	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe
2212	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1160	cmd.exe
2688	cmd.exe
6068	cmd.exe
4992	cmd.exe
5236	cmd.exe
2104	cmd.exe
5964	cmd.exe
2516	cmd.exe
6036	cmd.exe
4912	cmd.exe
2228	cmd.exe
3036	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2212	default.dat.exe
2212	default.dat.exe
5920	powershell.exe
5920	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe
5660	powershell.exe
5660	powershell.exe
5660	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4648	powershell.exe
4648	powershell.exe
4648	powershell.exe
5888	powershell.exe
5888	powershell.exe
5888	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
628	powershell.exe
628	powershell.exe
628	powershell.exe
5720	powershell.exe
5720	powershell.exe
5720	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	default.dat.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeIncreaseQuotaPrivilege	5920	powershell.exe
Token: SeSecurityPrivilege	5920	powershell.exe
Token: SeTakeOwnershipPrivilege	5920	powershell.exe
Token: SeLoadDriverPrivilege	5920	powershell.exe
Token: SeSystemProfilePrivilege	5920	powershell.exe
Token: SeSystemtimePrivilege	5920	powershell.exe
Token: SeProfSingleProcessPrivilege	5920	powershell.exe
Token: SeIncBasePriorityPrivilege	5920	powershell.exe
Token: SeCreatePagefilePrivilege	5920	powershell.exe
Token: SeBackupPrivilege	5920	powershell.exe
Token: SeRestorePrivilege	5920	powershell.exe
Token: SeShutdownPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeSystemEnvironmentPrivilege	5920	powershell.exe
Token: SeRemoteShutdownPrivilege	5920	powershell.exe
Token: SeUndockPrivilege	5920	powershell.exe
Token: SeManageVolumePrivilege	5920	powershell.exe
Token: 33	5920	powershell.exe
Token: 34	5920	powershell.exe
Token: 35	5920	powershell.exe
Token: 36	5920	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeIncreaseQuotaPrivilege	4696	powershell.exe
Token: SeSecurityPrivilege	4696	powershell.exe
Token: SeTakeOwnershipPrivilege	4696	powershell.exe
Token: SeLoadDriverPrivilege	4696	powershell.exe
Token: SeSystemProfilePrivilege	4696	powershell.exe
Token: SeSystemtimePrivilege	4696	powershell.exe
Token: SeProfSingleProcessPrivilege	4696	powershell.exe
Token: SeIncBasePriorityPrivilege	4696	powershell.exe
Token: SeCreatePagefilePrivilege	4696	powershell.exe
Token: SeBackupPrivilege	4696	powershell.exe
Token: SeRestorePrivilege	4696	powershell.exe
Token: SeShutdownPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeSystemEnvironmentPrivilege	4696	powershell.exe
Token: SeRemoteShutdownPrivilege	4696	powershell.exe
Token: SeUndockPrivilege	4696	powershell.exe
Token: SeManageVolumePrivilege	4696	powershell.exe
Token: 33	4696	powershell.exe
Token: 34	4696	powershell.exe
Token: 35	4696	powershell.exe
Token: 36	4696	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2212	2272	default.dat.exe	88
PID 2212 wrote to memory of 2516	2212	default.dat.exe	89
PID 2516 wrote to memory of 5920	2516	cmd.exe	91
PID 2212 wrote to memory of 2688	2212	default.dat.exe	93
PID 2688 wrote to memory of 4696	2688	cmd.exe	95
PID 2212 wrote to memory of 6036	2212	default.dat.exe	96
PID 6036 wrote to memory of 4656	6036	cmd.exe	98
PID 2212 wrote to memory of 4912	2212	default.dat.exe	99
PID 4912 wrote to memory of 5660	4912	cmd.exe	101
PID 2212 wrote to memory of 6068	2212	default.dat.exe	102
PID 6068 wrote to memory of 848	6068	cmd.exe	104
PID 2212 wrote to memory of 4992	2212	default.dat.exe	105
PID 4992 wrote to memory of 2492	4992	cmd.exe	107
PID 2212 wrote to memory of 2228	2212	default.dat.exe	108
PID 2228 wrote to memory of 4276	2228	cmd.exe	110
PID 2212 wrote to memory of 3036	2212	default.dat.exe	111
PID 3036 wrote to memory of 4648	3036	cmd.exe	113
PID 2212 wrote to memory of 5236	2212	default.dat.exe	114
PID 5236 wrote to memory of 5888	5236	cmd.exe	116
PID 2212 wrote to memory of 1160	2212	default.dat.exe	117
PID 1160 wrote to memory of 4312	1160	cmd.exe	119
PID 2212 wrote to memory of 2104	2212	default.dat.exe	120
PID 2104 wrote to memory of 628	2104	cmd.exe	122
PID 2212 wrote to memory of 5964	2212	default.dat.exe	123
PID 5964 wrote to memory of 5720	5964	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact