efadd757ffcdc156c9dbcac6745e70be5ca5174636d8853518839da82cf7e7b6

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260722-dc1f2aaa23
SHA256 efadd757ffcdc156c9dbcac6745e70be5ca5174636d8853518839da82cf7e7b6
MD5 cb223174213a026c0dea090fc60de840
SHA1 f464e40ef739466b9a836b725575c4c396a6cb9f
SHA512 9e61789b805f28a66de0b15d4310c36f6ffd9dd33c7fc46073c5d841cd5f740a362b2caad194026a79ef86b0bfc0b8291af7f627be0bfbcc79b5a2561f6565f8
SSDEEP 393216:oCejAgyimIDE4eR95QXMCHWUjXwcuI3/PGTAI:okglbSrQXMb8XlH/O7
TLSH
T14DE6330CAAD041FDEA624039EEE14696DAA474B54B72CE9B27789328FF475E40D3C743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5912	powershell.exe
2556	powershell.exe
5944	powershell.exe
3736	powershell.exe
5460	powershell.exe
3216	powershell.exe
2168	powershell.exe
768	powershell.exe
3856	powershell.exe
6036	powershell.exe
3588	powershell.exe
3176	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe
608	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2544	cmd.exe
2988	cmd.exe
2636	cmd.exe
3900	cmd.exe
4212	cmd.exe
2560	cmd.exe
1868	cmd.exe
2796	cmd.exe
3680	cmd.exe
2116	cmd.exe
2820	cmd.exe
4652	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
608	default.dat.exe
608	default.dat.exe
3216	powershell.exe
3216	powershell.exe
2168	powershell.exe
2168	powershell.exe
5912	powershell.exe
5912	powershell.exe
5912	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
3856	powershell.exe
3856	powershell.exe
3856	powershell.exe
3736	powershell.exe
3736	powershell.exe
6036	powershell.exe
6036	powershell.exe
3588	powershell.exe
3588	powershell.exe
5460	powershell.exe
5460	powershell.exe
3176	powershell.exe
3176	powershell.exe
3176	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	608	default.dat.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeIncreaseQuotaPrivilege	3216	powershell.exe
Token: SeSecurityPrivilege	3216	powershell.exe
Token: SeTakeOwnershipPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	3216	powershell.exe
Token: SeSystemProfilePrivilege	3216	powershell.exe
Token: SeSystemtimePrivilege	3216	powershell.exe
Token: SeProfSingleProcessPrivilege	3216	powershell.exe
Token: SeIncBasePriorityPrivilege	3216	powershell.exe
Token: SeCreatePagefilePrivilege	3216	powershell.exe
Token: SeBackupPrivilege	3216	powershell.exe
Token: SeRestorePrivilege	3216	powershell.exe
Token: SeShutdownPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeSystemEnvironmentPrivilege	3216	powershell.exe
Token: SeRemoteShutdownPrivilege	3216	powershell.exe
Token: SeUndockPrivilege	3216	powershell.exe
Token: SeManageVolumePrivilege	3216	powershell.exe
Token: 33	3216	powershell.exe
Token: 34	3216	powershell.exe
Token: 35	3216	powershell.exe
Token: 36	3216	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeIncreaseQuotaPrivilege	2168	powershell.exe
Token: SeSecurityPrivilege	2168	powershell.exe
Token: SeTakeOwnershipPrivilege	2168	powershell.exe
Token: SeLoadDriverPrivilege	2168	powershell.exe
Token: SeSystemProfilePrivilege	2168	powershell.exe
Token: SeSystemtimePrivilege	2168	powershell.exe
Token: SeProfSingleProcessPrivilege	2168	powershell.exe
Token: SeIncBasePriorityPrivilege	2168	powershell.exe
Token: SeCreatePagefilePrivilege	2168	powershell.exe
Token: SeBackupPrivilege	2168	powershell.exe
Token: SeRestorePrivilege	2168	powershell.exe
Token: SeShutdownPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeSystemEnvironmentPrivilege	2168	powershell.exe
Token: SeRemoteShutdownPrivilege	2168	powershell.exe
Token: SeUndockPrivilege	2168	powershell.exe
Token: SeManageVolumePrivilege	2168	powershell.exe
Token: 33	2168	powershell.exe
Token: 34	2168	powershell.exe
Token: 35	2168	powershell.exe
Token: 36	2168	powershell.exe
Token: SeDebugPrivilege	5912	powershell.exe
Token: SeIncreaseQuotaPrivilege	5912	powershell.exe
Token: SeSecurityPrivilege	5912	powershell.exe
Token: SeTakeOwnershipPrivilege	5912	powershell.exe
Token: SeLoadDriverPrivilege	5912	powershell.exe
Token: SeSystemProfilePrivilege	5912	powershell.exe
Token: SeSystemtimePrivilege	5912	powershell.exe
Token: SeProfSingleProcessPrivilege	5912	powershell.exe
Token: SeIncBasePriorityPrivilege	5912	powershell.exe
Token: SeCreatePagefilePrivilege	5912	powershell.exe
Token: SeBackupPrivilege	5912	powershell.exe
Token: SeRestorePrivilege	5912	powershell.exe
Token: SeShutdownPrivilege	5912	powershell.exe
Token: SeDebugPrivilege	5912	powershell.exe
Token: SeSystemEnvironmentPrivilege	5912	powershell.exe
Token: SeRemoteShutdownPrivilege	5912	powershell.exe
Token: SeUndockPrivilege	5912	powershell.exe
Token: SeManageVolumePrivilege	5912	powershell.exe
Token: 33	5912	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 608	3488	default.dat.exe	89
PID 608 wrote to memory of 2796	608	default.dat.exe	90
PID 2796 wrote to memory of 3216	2796	cmd.exe	92
PID 608 wrote to memory of 3680	608	default.dat.exe	94
PID 3680 wrote to memory of 2168	3680	cmd.exe	96
PID 608 wrote to memory of 2116	608	default.dat.exe	97
PID 2116 wrote to memory of 5912	2116	cmd.exe	99
PID 608 wrote to memory of 2636	608	default.dat.exe	100
PID 2636 wrote to memory of 2556	2636	cmd.exe	102
PID 608 wrote to memory of 2820	608	default.dat.exe	103
PID 2820 wrote to memory of 5944	2820	cmd.exe	105
PID 608 wrote to memory of 3900	608	default.dat.exe	106
PID 3900 wrote to memory of 768	3900	cmd.exe	108
PID 608 wrote to memory of 4212	608	default.dat.exe	109
PID 4212 wrote to memory of 3856	4212	cmd.exe	111
PID 608 wrote to memory of 2560	608	default.dat.exe	112
PID 2560 wrote to memory of 3736	2560	cmd.exe	114
PID 608 wrote to memory of 4652	608	default.dat.exe	115
PID 4652 wrote to memory of 6036	4652	cmd.exe	117
PID 608 wrote to memory of 2544	608	default.dat.exe	118
PID 2544 wrote to memory of 3588	2544	cmd.exe	120
PID 608 wrote to memory of 2988	608	default.dat.exe	121
PID 2988 wrote to memory of 5460	2988	cmd.exe	123
PID 608 wrote to memory of 1868	608	default.dat.exe	124
PID 1868 wrote to memory of 3176	1868	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact