81775ecf00ef60ef088c4d79d37ad60154dcc43bc8edce4ec56bb509331feaa8

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260724-efcpta1vaw
SHA256 81775ecf00ef60ef088c4d79d37ad60154dcc43bc8edce4ec56bb509331feaa8
MD5 c5d14331d0910a8d4d724b3c00329ced
SHA1 8bc62193a60f3d63e0e56d4564d08a12fae7036b
SHA512 5c06171e7950ba74ed8ec44be4da2c1497c78d44cd886d4abbf54480c1b61cd313f30bbaab90c1709a216ca5b3da03b84d30a4809ea1d869ef9669b25ca6bc27
SSDEEP 393216:G8NJr56oT8Kich9T2LuXMCHWUjXwcuI3/PGTAI:G8D4i809aLuXMb8XlH/O7
TLSH
T177E63318B5E026EEC973413DEFA26056E47C38A50770CDCB07A4D2E55D6B2E14E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6036	powershell.exe
4220	powershell.exe
4140	powershell.exe
4132	powershell.exe
5436	powershell.exe
2808	powershell.exe
5516	powershell.exe
5760	powershell.exe
2844	powershell.exe
3972	powershell.exe
260	powershell.exe
4588	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe
4544	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3500	cmd.exe
5776	cmd.exe
3248	cmd.exe
2016	cmd.exe
3508	cmd.exe
3716	cmd.exe
2012	cmd.exe
4196	cmd.exe
5012	cmd.exe
6132	cmd.exe
4260	cmd.exe
3008	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4544	default.dat.exe
4544	default.dat.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
5760	powershell.exe
5760	powershell.exe
5760	powershell.exe
5516	powershell.exe
5516	powershell.exe
5516	powershell.exe
2808	powershell.exe
2808	powershell.exe
2808	powershell.exe
2844	powershell.exe
2844	powershell.exe
2844	powershell.exe
5436	powershell.exe
5436	powershell.exe
5436	powershell.exe
4132	powershell.exe
4132	powershell.exe
4132	powershell.exe
260	powershell.exe
260	powershell.exe
260	powershell.exe
4588	powershell.exe
4588	powershell.exe
4588	powershell.exe
6036	powershell.exe
6036	powershell.exe
6036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	default.dat.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeIncreaseQuotaPrivilege	4220	powershell.exe
Token: SeSecurityPrivilege	4220	powershell.exe
Token: SeTakeOwnershipPrivilege	4220	powershell.exe
Token: SeLoadDriverPrivilege	4220	powershell.exe
Token: SeSystemProfilePrivilege	4220	powershell.exe
Token: SeSystemtimePrivilege	4220	powershell.exe
Token: SeProfSingleProcessPrivilege	4220	powershell.exe
Token: SeIncBasePriorityPrivilege	4220	powershell.exe
Token: SeCreatePagefilePrivilege	4220	powershell.exe
Token: SeBackupPrivilege	4220	powershell.exe
Token: SeRestorePrivilege	4220	powershell.exe
Token: SeShutdownPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeSystemEnvironmentPrivilege	4220	powershell.exe
Token: SeRemoteShutdownPrivilege	4220	powershell.exe
Token: SeUndockPrivilege	4220	powershell.exe
Token: SeManageVolumePrivilege	4220	powershell.exe
Token: 33	4220	powershell.exe
Token: 34	4220	powershell.exe
Token: 35	4220	powershell.exe
Token: 36	4220	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeIncreaseQuotaPrivilege	4140	powershell.exe
Token: SeSecurityPrivilege	4140	powershell.exe
Token: SeTakeOwnershipPrivilege	4140	powershell.exe
Token: SeLoadDriverPrivilege	4140	powershell.exe
Token: SeSystemProfilePrivilege	4140	powershell.exe
Token: SeSystemtimePrivilege	4140	powershell.exe
Token: SeProfSingleProcessPrivilege	4140	powershell.exe
Token: SeIncBasePriorityPrivilege	4140	powershell.exe
Token: SeCreatePagefilePrivilege	4140	powershell.exe
Token: SeBackupPrivilege	4140	powershell.exe
Token: SeRestorePrivilege	4140	powershell.exe
Token: SeShutdownPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeSystemEnvironmentPrivilege	4140	powershell.exe
Token: SeRemoteShutdownPrivilege	4140	powershell.exe
Token: SeUndockPrivilege	4140	powershell.exe
Token: SeManageVolumePrivilege	4140	powershell.exe
Token: 33	4140	powershell.exe
Token: 34	4140	powershell.exe
Token: 35	4140	powershell.exe
Token: 36	4140	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeIncreaseQuotaPrivilege	3972	powershell.exe
Token: SeSecurityPrivilege	3972	powershell.exe
Token: SeTakeOwnershipPrivilege	3972	powershell.exe
Token: SeLoadDriverPrivilege	3972	powershell.exe
Token: SeSystemProfilePrivilege	3972	powershell.exe
Token: SeSystemtimePrivilege	3972	powershell.exe
Token: SeProfSingleProcessPrivilege	3972	powershell.exe
Token: SeIncBasePriorityPrivilege	3972	powershell.exe
Token: SeCreatePagefilePrivilege	3972	powershell.exe
Token: SeBackupPrivilege	3972	powershell.exe
Token: SeRestorePrivilege	3972	powershell.exe
Token: SeShutdownPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeSystemEnvironmentPrivilege	3972	powershell.exe
Token: SeRemoteShutdownPrivilege	3972	powershell.exe
Token: SeUndockPrivilege	3972	powershell.exe
Token: SeManageVolumePrivilege	3972	powershell.exe
Token: 33	3972	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6060 wrote to memory of 4544	6060	default.dat.exe	90
PID 4544 wrote to memory of 5012	4544	default.dat.exe	91
PID 5012 wrote to memory of 4220	5012	cmd.exe	93
PID 4544 wrote to memory of 6132	4544	default.dat.exe	95
PID 6132 wrote to memory of 4140	6132	cmd.exe	97
PID 4544 wrote to memory of 3716	4544	default.dat.exe	98
PID 3716 wrote to memory of 3972	3716	cmd.exe	100
PID 4544 wrote to memory of 3508	4544	default.dat.exe	101
PID 3508 wrote to memory of 5760	3508	cmd.exe	103
PID 4544 wrote to memory of 2016	4544	default.dat.exe	104
PID 2016 wrote to memory of 5516	2016	cmd.exe	106
PID 4544 wrote to memory of 3248	4544	default.dat.exe	107
PID 3248 wrote to memory of 2808	3248	cmd.exe	109
PID 4544 wrote to memory of 5776	4544	default.dat.exe	110
PID 5776 wrote to memory of 2844	5776	cmd.exe	112
PID 4544 wrote to memory of 4260	4544	default.dat.exe	113
PID 4260 wrote to memory of 5436	4260	cmd.exe	115
PID 4544 wrote to memory of 3500	4544	default.dat.exe	116
PID 3500 wrote to memory of 4132	3500	cmd.exe	118
PID 4544 wrote to memory of 2012	4544	default.dat.exe	119
PID 2012 wrote to memory of 260	2012	cmd.exe	121
PID 4544 wrote to memory of 4196	4544	default.dat.exe	122
PID 4196 wrote to memory of 4588	4196	cmd.exe	124
PID 4544 wrote to memory of 3008	4544	default.dat.exe	125
PID 3008 wrote to memory of 6036	3008	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cuveged'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cuveged'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact