23dfafd4337c63ace81f90323ced61ed1132ee9b4bc977efa664ae08892e6c45

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260721-mys4hsdv4n
SHA256 23dfafd4337c63ace81f90323ced61ed1132ee9b4bc977efa664ae08892e6c45
MD5 d0e235665ee126f510df32a174753e91
SHA1 7f0c7ccce2e561162cf25398f9a6aa2b7e7b3d5c
SHA512 5553ed5a096cb973dcde412fa874942061f972e72f1fe3b17700515b3c8cc8f25b674da9d5be621956f2e4cd19ec9bfe7e3387bd52b536354ede93dd0e653e78
SSDEEP 393216:3jM23vNBGeqH0iwXMCHWUjX8cuI3/PGTAI:3jhv+YZXMb8XpH/O7
TLSH
T1E2E633085AE406EFEAB3413CBD929656D4BAB0352FB3C5DF5BB48B111D632A08D35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4548	powershell.exe
1676	powershell.exe
5312	powershell.exe
4876	powershell.exe
576	powershell.exe
5832	powershell.exe
4172	powershell.exe
5992	powershell.exe
1196	powershell.exe
4464	powershell.exe
4988	powershell.exe
4916	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe
5544	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3068	cmd.exe
4276	cmd.exe
4120	cmd.exe
5088	cmd.exe
5652	cmd.exe
4600	cmd.exe
3260	cmd.exe
4560	cmd.exe
476	cmd.exe
3432	cmd.exe
1332	cmd.exe
5540	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5544	default.dat.exe
5544	default.dat.exe
1196	powershell.exe
1196	powershell.exe
4464	powershell.exe
4464	powershell.exe
4464	powershell.exe
1676	powershell.exe
1676	powershell.exe
1676	powershell.exe
4988	powershell.exe
4988	powershell.exe
4988	powershell.exe
5312	powershell.exe
5312	powershell.exe
5312	powershell.exe
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe
4916	powershell.exe
4916	powershell.exe
4916	powershell.exe
576	powershell.exe
576	powershell.exe
576	powershell.exe
5832	powershell.exe
5832	powershell.exe
5832	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5544	default.dat.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeIncreaseQuotaPrivilege	1196	powershell.exe
Token: SeSecurityPrivilege	1196	powershell.exe
Token: SeTakeOwnershipPrivilege	1196	powershell.exe
Token: SeLoadDriverPrivilege	1196	powershell.exe
Token: SeSystemProfilePrivilege	1196	powershell.exe
Token: SeSystemtimePrivilege	1196	powershell.exe
Token: SeProfSingleProcessPrivilege	1196	powershell.exe
Token: SeIncBasePriorityPrivilege	1196	powershell.exe
Token: SeCreatePagefilePrivilege	1196	powershell.exe
Token: SeBackupPrivilege	1196	powershell.exe
Token: SeRestorePrivilege	1196	powershell.exe
Token: SeShutdownPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeSystemEnvironmentPrivilege	1196	powershell.exe
Token: SeRemoteShutdownPrivilege	1196	powershell.exe
Token: SeUndockPrivilege	1196	powershell.exe
Token: SeManageVolumePrivilege	1196	powershell.exe
Token: 33	1196	powershell.exe
Token: 34	1196	powershell.exe
Token: 35	1196	powershell.exe
Token: 36	1196	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeIncreaseQuotaPrivilege	4464	powershell.exe
Token: SeSecurityPrivilege	4464	powershell.exe
Token: SeTakeOwnershipPrivilege	4464	powershell.exe
Token: SeLoadDriverPrivilege	4464	powershell.exe
Token: SeSystemProfilePrivilege	4464	powershell.exe
Token: SeSystemtimePrivilege	4464	powershell.exe
Token: SeProfSingleProcessPrivilege	4464	powershell.exe
Token: SeIncBasePriorityPrivilege	4464	powershell.exe
Token: SeCreatePagefilePrivilege	4464	powershell.exe
Token: SeBackupPrivilege	4464	powershell.exe
Token: SeRestorePrivilege	4464	powershell.exe
Token: SeShutdownPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeSystemEnvironmentPrivilege	4464	powershell.exe
Token: SeRemoteShutdownPrivilege	4464	powershell.exe
Token: SeUndockPrivilege	4464	powershell.exe
Token: SeManageVolumePrivilege	4464	powershell.exe
Token: 33	4464	powershell.exe
Token: 34	4464	powershell.exe
Token: 35	4464	powershell.exe
Token: 36	4464	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	powershell.exe
Token: SeSecurityPrivilege	1676	powershell.exe
Token: SeTakeOwnershipPrivilege	1676	powershell.exe
Token: SeLoadDriverPrivilege	1676	powershell.exe
Token: SeSystemProfilePrivilege	1676	powershell.exe
Token: SeSystemtimePrivilege	1676	powershell.exe
Token: SeProfSingleProcessPrivilege	1676	powershell.exe
Token: SeIncBasePriorityPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe
Token: SeBackupPrivilege	1676	powershell.exe
Token: SeRestorePrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeSystemEnvironmentPrivilege	1676	powershell.exe
Token: SeRemoteShutdownPrivilege	1676	powershell.exe
Token: SeUndockPrivilege	1676	powershell.exe
Token: SeManageVolumePrivilege	1676	powershell.exe
Token: 33	1676	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 5544	1980	default.dat.exe	89
PID 5544 wrote to memory of 3068	5544	default.dat.exe	90
PID 3068 wrote to memory of 1196	3068	cmd.exe	92
PID 5544 wrote to memory of 476	5544	default.dat.exe	94
PID 476 wrote to memory of 4464	476	cmd.exe	96
PID 5544 wrote to memory of 3432	5544	default.dat.exe	97
PID 3432 wrote to memory of 1676	3432	cmd.exe	99
PID 5544 wrote to memory of 4276	5544	default.dat.exe	100
PID 4276 wrote to memory of 4988	4276	cmd.exe	102
PID 5544 wrote to memory of 4120	5544	default.dat.exe	103
PID 4120 wrote to memory of 5312	4120	cmd.exe	105
PID 5544 wrote to memory of 5088	5544	default.dat.exe	106
PID 5088 wrote to memory of 4876	5088	cmd.exe	108
PID 5544 wrote to memory of 5652	5544	default.dat.exe	109
PID 5652 wrote to memory of 4916	5652	cmd.exe	111
PID 5544 wrote to memory of 4600	5544	default.dat.exe	112
PID 4600 wrote to memory of 576	4600	cmd.exe	114
PID 5544 wrote to memory of 3260	5544	default.dat.exe	115
PID 3260 wrote to memory of 5832	3260	cmd.exe	117
PID 5544 wrote to memory of 4560	5544	default.dat.exe	118
PID 4560 wrote to memory of 4172	4560	cmd.exe	120
PID 5544 wrote to memory of 1332	5544	default.dat.exe	121
PID 1332 wrote to memory of 4548	1332	cmd.exe	123
PID 5544 wrote to memory of 5540	5544	default.dat.exe	124
PID 5540 wrote to memory of 5992	5540	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vuzowun'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact