88b1992718e4ba9abeec72bb8be2945c402354ca6a1407dfe09de0a8b773dec3

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 04:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260722-fhp9csv1aw
SHA256 88b1992718e4ba9abeec72bb8be2945c402354ca6a1407dfe09de0a8b773dec3
MD5 5b1dbd70489b4ea2628d17733f141a25
SHA1 e9013962701599851205055884858aa368d5eb57
SHA512 7525543dbf24a8d0c2f67d20a8fcd68526b4e3d10b0819d7d9b434cc013e799e96045a58236bf73faf9d8ebba87d9c69054712612342efc0e835fccf7579501c
SSDEEP 393216:4n6AGC8za7JOe6fRimfjXXMCHWUjX7cuI3/PGTAI:wFKzAJx4iUjXXMb8X4H/O7
TLSH
T119E63344A6F012FEE6A3D23CDDD152A6CAF134794732C4AF625487E5AF1B2D02D35623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe
5648	powershell.exe
5692	powershell.exe
5908	powershell.exe
5032	powershell.exe
1556	powershell.exe
4260	powershell.exe
5972	powershell.exe
5888	powershell.exe
4624	powershell.exe
3868	powershell.exe
2128	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe
1292	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4128	cmd.exe
3972	cmd.exe
4132	cmd.exe
4860	cmd.exe
5952	cmd.exe
4780	cmd.exe
5460	cmd.exe
5848	cmd.exe
5084	cmd.exe
6060	cmd.exe
4948	cmd.exe
2172	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1292	default.dat.exe
1292	default.dat.exe
2100	powershell.exe
2100	powershell.exe
5648	powershell.exe
5648	powershell.exe
5648	powershell.exe
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
5972	powershell.exe
5972	powershell.exe
5972	powershell.exe
5692	powershell.exe
5692	powershell.exe
5692	powershell.exe
5888	powershell.exe
5888	powershell.exe
5888	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
2128	powershell.exe
2128	powershell.exe
2128	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	default.dat.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeIncreaseQuotaPrivilege	2100	powershell.exe
Token: SeSecurityPrivilege	2100	powershell.exe
Token: SeTakeOwnershipPrivilege	2100	powershell.exe
Token: SeLoadDriverPrivilege	2100	powershell.exe
Token: SeSystemProfilePrivilege	2100	powershell.exe
Token: SeSystemtimePrivilege	2100	powershell.exe
Token: SeProfSingleProcessPrivilege	2100	powershell.exe
Token: SeIncBasePriorityPrivilege	2100	powershell.exe
Token: SeCreatePagefilePrivilege	2100	powershell.exe
Token: SeBackupPrivilege	2100	powershell.exe
Token: SeRestorePrivilege	2100	powershell.exe
Token: SeShutdownPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeSystemEnvironmentPrivilege	2100	powershell.exe
Token: SeRemoteShutdownPrivilege	2100	powershell.exe
Token: SeUndockPrivilege	2100	powershell.exe
Token: SeManageVolumePrivilege	2100	powershell.exe
Token: 33	2100	powershell.exe
Token: 34	2100	powershell.exe
Token: 35	2100	powershell.exe
Token: 36	2100	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeIncreaseQuotaPrivilege	5648	powershell.exe
Token: SeSecurityPrivilege	5648	powershell.exe
Token: SeTakeOwnershipPrivilege	5648	powershell.exe
Token: SeLoadDriverPrivilege	5648	powershell.exe
Token: SeSystemProfilePrivilege	5648	powershell.exe
Token: SeSystemtimePrivilege	5648	powershell.exe
Token: SeProfSingleProcessPrivilege	5648	powershell.exe
Token: SeIncBasePriorityPrivilege	5648	powershell.exe
Token: SeCreatePagefilePrivilege	5648	powershell.exe
Token: SeBackupPrivilege	5648	powershell.exe
Token: SeRestorePrivilege	5648	powershell.exe
Token: SeShutdownPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeSystemEnvironmentPrivilege	5648	powershell.exe
Token: SeRemoteShutdownPrivilege	5648	powershell.exe
Token: SeUndockPrivilege	5648	powershell.exe
Token: SeManageVolumePrivilege	5648	powershell.exe
Token: 33	5648	powershell.exe
Token: 34	5648	powershell.exe
Token: 35	5648	powershell.exe
Token: 36	5648	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeIncreaseQuotaPrivilege	1556	powershell.exe
Token: SeSecurityPrivilege	1556	powershell.exe
Token: SeTakeOwnershipPrivilege	1556	powershell.exe
Token: SeLoadDriverPrivilege	1556	powershell.exe
Token: SeSystemProfilePrivilege	1556	powershell.exe
Token: SeSystemtimePrivilege	1556	powershell.exe
Token: SeProfSingleProcessPrivilege	1556	powershell.exe
Token: SeIncBasePriorityPrivilege	1556	powershell.exe
Token: SeCreatePagefilePrivilege	1556	powershell.exe
Token: SeBackupPrivilege	1556	powershell.exe
Token: SeRestorePrivilege	1556	powershell.exe
Token: SeShutdownPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeSystemEnvironmentPrivilege	1556	powershell.exe
Token: SeRemoteShutdownPrivilege	1556	powershell.exe
Token: SeUndockPrivilege	1556	powershell.exe
Token: SeManageVolumePrivilege	1556	powershell.exe
Token: 33	1556	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1292	4492	default.dat.exe	89
PID 1292 wrote to memory of 5460	1292	default.dat.exe	90
PID 5460 wrote to memory of 2100	5460	cmd.exe	92
PID 1292 wrote to memory of 5848	1292	default.dat.exe	94
PID 5848 wrote to memory of 5648	5848	cmd.exe	96
PID 1292 wrote to memory of 5084	1292	default.dat.exe	97
PID 5084 wrote to memory of 1556	5084	cmd.exe	99
PID 1292 wrote to memory of 3972	1292	default.dat.exe	100
PID 3972 wrote to memory of 4260	3972	cmd.exe	102
PID 1292 wrote to memory of 6060	1292	default.dat.exe	103
PID 6060 wrote to memory of 5972	6060	cmd.exe	105
PID 1292 wrote to memory of 4132	1292	default.dat.exe	106
PID 4132 wrote to memory of 5692	4132	cmd.exe	108
PID 1292 wrote to memory of 4948	1292	default.dat.exe	109
PID 4948 wrote to memory of 5888	4948	cmd.exe	111
PID 1292 wrote to memory of 2172	1292	default.dat.exe	112
PID 2172 wrote to memory of 4624	2172	cmd.exe	114
PID 1292 wrote to memory of 4860	1292	default.dat.exe	115
PID 4860 wrote to memory of 3868	4860	cmd.exe	117
PID 1292 wrote to memory of 4128	1292	default.dat.exe	118
PID 4128 wrote to memory of 2128	4128	cmd.exe	120
PID 1292 wrote to memory of 5952	1292	default.dat.exe	121
PID 5952 wrote to memory of 5908	5952	cmd.exe	123
PID 1292 wrote to memory of 4780	1292	default.dat.exe	124
PID 4780 wrote to memory of 5032	4780	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dusunuk'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact