ca7fa72c6642d5cb83ea60ce873964eff752e6ad66aac959da25d722ce19256e

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260725-ylqcmsbc83
SHA256 ca7fa72c6642d5cb83ea60ce873964eff752e6ad66aac959da25d722ce19256e
MD5 17ac3a4c603191a68d14a046245ba522
SHA1 514dc84190643116c35edba01dcf2eee6c908fcd
SHA512 cb7a60715edf63d5f34c65fac751407f8e21af0096784cba62170b51791eaf80ba906b003fd47a7f6dc834324eae866a99e027d7faccfa01d02fe4c160231101
SSDEEP 393216:WMaY0ydC3a09+yWnmlT8kW3ryCtiXMCHWUjXucuI3/PGTAI:W3rjK0zs3ryvXMb8XDH/O7
TLSH
T190E63388A8D105EEDDA7513CFEF26841F8A838791F36C5CF17405764AD2B1F09A3D29A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4340	powershell.exe
1228	powershell.exe
4364	powershell.exe
5380	powershell.exe
1680	powershell.exe
1204	powershell.exe
1848	powershell.exe
1904	powershell.exe
5832	powershell.exe
2436	powershell.exe
4488	powershell.exe
5256	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe
4332	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1380	cmd.exe
1984	cmd.exe
3396	cmd.exe
2152	cmd.exe
4408	cmd.exe
2336	cmd.exe
800	cmd.exe
1764	cmd.exe
1216	cmd.exe
4844	cmd.exe
3152	cmd.exe
1588	cmd.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4332	default.dat.exe
4332	default.dat.exe
1204	powershell.exe
1204	powershell.exe
1848	powershell.exe
1848	powershell.exe
1904	powershell.exe
1904	powershell.exe
5256	powershell.exe
5256	powershell.exe
5256	powershell.exe
5832	powershell.exe
5832	powershell.exe
4340	powershell.exe
4340	powershell.exe
2436	powershell.exe
2436	powershell.exe
2436	powershell.exe
1228	powershell.exe
1228	powershell.exe
1228	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
5380	powershell.exe
5380	powershell.exe
5380	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
1680	powershell.exe
1680	powershell.exe
1680	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	default.dat.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeIncreaseQuotaPrivilege	1204	powershell.exe
Token: SeSecurityPrivilege	1204	powershell.exe
Token: SeTakeOwnershipPrivilege	1204	powershell.exe
Token: SeLoadDriverPrivilege	1204	powershell.exe
Token: SeSystemProfilePrivilege	1204	powershell.exe
Token: SeSystemtimePrivilege	1204	powershell.exe
Token: SeProfSingleProcessPrivilege	1204	powershell.exe
Token: SeIncBasePriorityPrivilege	1204	powershell.exe
Token: SeCreatePagefilePrivilege	1204	powershell.exe
Token: SeBackupPrivilege	1204	powershell.exe
Token: SeRestorePrivilege	1204	powershell.exe
Token: SeShutdownPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeSystemEnvironmentPrivilege	1204	powershell.exe
Token: SeRemoteShutdownPrivilege	1204	powershell.exe
Token: SeUndockPrivilege	1204	powershell.exe
Token: SeManageVolumePrivilege	1204	powershell.exe
Token: 33	1204	powershell.exe
Token: 34	1204	powershell.exe
Token: 35	1204	powershell.exe
Token: 36	1204	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeIncreaseQuotaPrivilege	1848	powershell.exe
Token: SeSecurityPrivilege	1848	powershell.exe
Token: SeTakeOwnershipPrivilege	1848	powershell.exe
Token: SeLoadDriverPrivilege	1848	powershell.exe
Token: SeSystemProfilePrivilege	1848	powershell.exe
Token: SeSystemtimePrivilege	1848	powershell.exe
Token: SeProfSingleProcessPrivilege	1848	powershell.exe
Token: SeIncBasePriorityPrivilege	1848	powershell.exe
Token: SeCreatePagefilePrivilege	1848	powershell.exe
Token: SeBackupPrivilege	1848	powershell.exe
Token: SeRestorePrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeSystemEnvironmentPrivilege	1848	powershell.exe
Token: SeRemoteShutdownPrivilege	1848	powershell.exe
Token: SeUndockPrivilege	1848	powershell.exe
Token: SeManageVolumePrivilege	1848	powershell.exe
Token: 33	1848	powershell.exe
Token: 34	1848	powershell.exe
Token: 35	1848	powershell.exe
Token: 36	1848	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeIncreaseQuotaPrivilege	1904	powershell.exe
Token: SeSecurityPrivilege	1904	powershell.exe
Token: SeTakeOwnershipPrivilege	1904	powershell.exe
Token: SeLoadDriverPrivilege	1904	powershell.exe
Token: SeSystemProfilePrivilege	1904	powershell.exe
Token: SeSystemtimePrivilege	1904	powershell.exe
Token: SeProfSingleProcessPrivilege	1904	powershell.exe
Token: SeIncBasePriorityPrivilege	1904	powershell.exe
Token: SeCreatePagefilePrivilege	1904	powershell.exe
Token: SeBackupPrivilege	1904	powershell.exe
Token: SeRestorePrivilege	1904	powershell.exe
Token: SeShutdownPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeSystemEnvironmentPrivilege	1904	powershell.exe
Token: SeRemoteShutdownPrivilege	1904	powershell.exe
Token: SeUndockPrivilege	1904	powershell.exe
Token: SeManageVolumePrivilege	1904	powershell.exe
Token: 33	1904	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 4332	5672	default.dat.exe	89
PID 4332 wrote to memory of 1380	4332	default.dat.exe	90
PID 1380 wrote to memory of 1204	1380	cmd.exe	92
PID 4332 wrote to memory of 1764	4332	default.dat.exe	94
PID 1764 wrote to memory of 1848	1764	cmd.exe	96
PID 4332 wrote to memory of 1984	4332	default.dat.exe	97
PID 1984 wrote to memory of 1904	1984	cmd.exe	99
PID 4332 wrote to memory of 1216	4332	default.dat.exe	100
PID 1216 wrote to memory of 5256	1216	cmd.exe	102
PID 4332 wrote to memory of 3396	4332	default.dat.exe	103
PID 3396 wrote to memory of 5832	3396	cmd.exe	105
PID 4332 wrote to memory of 2152	4332	default.dat.exe	106
PID 2152 wrote to memory of 4340	2152	cmd.exe	108
PID 4332 wrote to memory of 4844	4332	default.dat.exe	109
PID 4844 wrote to memory of 2436	4844	cmd.exe	111
PID 4332 wrote to memory of 4408	4332	default.dat.exe	112
PID 4408 wrote to memory of 1228	4408	cmd.exe	114
PID 4332 wrote to memory of 2336	4332	default.dat.exe	115
PID 2336 wrote to memory of 4364	2336	cmd.exe	117
PID 4332 wrote to memory of 3152	4332	default.dat.exe	118
PID 3152 wrote to memory of 5380	3152	cmd.exe	120
PID 4332 wrote to memory of 1588	4332	default.dat.exe	121
PID 1588 wrote to memory of 4488	1588	cmd.exe	123
PID 4332 wrote to memory of 800	4332	default.dat.exe	124
PID 800 wrote to memory of 1680	800	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vihomos'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\vihomos'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact