0bc71f56b650c93a4f50e11ba41af659c46fba843cd019e2dbb152a536ed714f

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260726-efwspayvbs
SHA256 0bc71f56b650c93a4f50e11ba41af659c46fba843cd019e2dbb152a536ed714f
MD5 0ff0126ed66be4858a161aa773cd9a76
SHA1 904da862281f6a19155a5710c9bfb26f81485a26
SHA512 40a06c3bee77ed83b45196f732706bde7c9c922acf9cf56f21fc352a499bebee22f8f23d3f5270bc96ff9fcb9c2fd088ec195f55622add385749b56acd50a01b
SSDEEP 393216:1gp7tsvr/AAD9Jy9ap2OOXMCHWUjX0cuI3/PGTAI:1gxOz/dD9JyM4xXMb8XhH/O7
TLSH
T15BE6331576E001FEDA730239EDE20659F9F1B4B68731C19B1BA88B756A231A0CD3D763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
256	powershell.exe
4664	powershell.exe
1100	powershell.exe
4488	powershell.exe
1488	powershell.exe
3176	powershell.exe
5660	powershell.exe
1332	powershell.exe
4312	powershell.exe
3372	powershell.exe
4916	powershell.exe
4540	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe
1448	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3132	cmd.exe
4184	cmd.exe
1320	cmd.exe
5656	cmd.exe
5128	cmd.exe
3268	cmd.exe
1360	cmd.exe
4952	cmd.exe
2148	cmd.exe
1252	cmd.exe
3292	cmd.exe
1532	cmd.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1448	default.dat.exe
1448	default.dat.exe
4540	powershell.exe
4540	powershell.exe
256	powershell.exe
256	powershell.exe
256	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
1100	powershell.exe
1100	powershell.exe
4488	powershell.exe
4488	powershell.exe
1488	powershell.exe
1488	powershell.exe
3176	powershell.exe
3176	powershell.exe
3372	powershell.exe
3372	powershell.exe
5660	powershell.exe
5660	powershell.exe
4916	powershell.exe
4916	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	default.dat.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeIncreaseQuotaPrivilege	4540	powershell.exe
Token: SeSecurityPrivilege	4540	powershell.exe
Token: SeTakeOwnershipPrivilege	4540	powershell.exe
Token: SeLoadDriverPrivilege	4540	powershell.exe
Token: SeSystemProfilePrivilege	4540	powershell.exe
Token: SeSystemtimePrivilege	4540	powershell.exe
Token: SeProfSingleProcessPrivilege	4540	powershell.exe
Token: SeIncBasePriorityPrivilege	4540	powershell.exe
Token: SeCreatePagefilePrivilege	4540	powershell.exe
Token: SeBackupPrivilege	4540	powershell.exe
Token: SeRestorePrivilege	4540	powershell.exe
Token: SeShutdownPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeSystemEnvironmentPrivilege	4540	powershell.exe
Token: SeRemoteShutdownPrivilege	4540	powershell.exe
Token: SeUndockPrivilege	4540	powershell.exe
Token: SeManageVolumePrivilege	4540	powershell.exe
Token: 33	4540	powershell.exe
Token: 34	4540	powershell.exe
Token: 35	4540	powershell.exe
Token: 36	4540	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeIncreaseQuotaPrivilege	256	powershell.exe
Token: SeSecurityPrivilege	256	powershell.exe
Token: SeTakeOwnershipPrivilege	256	powershell.exe
Token: SeLoadDriverPrivilege	256	powershell.exe
Token: SeSystemProfilePrivilege	256	powershell.exe
Token: SeSystemtimePrivilege	256	powershell.exe
Token: SeProfSingleProcessPrivilege	256	powershell.exe
Token: SeIncBasePriorityPrivilege	256	powershell.exe
Token: SeCreatePagefilePrivilege	256	powershell.exe
Token: SeBackupPrivilege	256	powershell.exe
Token: SeRestorePrivilege	256	powershell.exe
Token: SeShutdownPrivilege	256	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeSystemEnvironmentPrivilege	256	powershell.exe
Token: SeRemoteShutdownPrivilege	256	powershell.exe
Token: SeUndockPrivilege	256	powershell.exe
Token: SeManageVolumePrivilege	256	powershell.exe
Token: 33	256	powershell.exe
Token: 34	256	powershell.exe
Token: 35	256	powershell.exe
Token: 36	256	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeIncreaseQuotaPrivilege	1332	powershell.exe
Token: SeSecurityPrivilege	1332	powershell.exe
Token: SeTakeOwnershipPrivilege	1332	powershell.exe
Token: SeLoadDriverPrivilege	1332	powershell.exe
Token: SeSystemProfilePrivilege	1332	powershell.exe
Token: SeSystemtimePrivilege	1332	powershell.exe
Token: SeProfSingleProcessPrivilege	1332	powershell.exe
Token: SeIncBasePriorityPrivilege	1332	powershell.exe
Token: SeCreatePagefilePrivilege	1332	powershell.exe
Token: SeBackupPrivilege	1332	powershell.exe
Token: SeRestorePrivilege	1332	powershell.exe
Token: SeShutdownPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeSystemEnvironmentPrivilege	1332	powershell.exe
Token: SeRemoteShutdownPrivilege	1332	powershell.exe
Token: SeUndockPrivilege	1332	powershell.exe
Token: SeManageVolumePrivilege	1332	powershell.exe
Token: 33	1332	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1448	4424	default.dat.exe	89
PID 1448 wrote to memory of 1532	1448	default.dat.exe	90
PID 1532 wrote to memory of 4540	1532	cmd.exe	92
PID 1448 wrote to memory of 3132	1448	default.dat.exe	94
PID 3132 wrote to memory of 256	3132	cmd.exe	96
PID 1448 wrote to memory of 4184	1448	default.dat.exe	97
PID 4184 wrote to memory of 1332	4184	cmd.exe	99
PID 1448 wrote to memory of 1320	1448	default.dat.exe	100
PID 1320 wrote to memory of 4664	1320	cmd.exe	102
PID 1448 wrote to memory of 5656	1448	default.dat.exe	103
PID 5656 wrote to memory of 4312	5656	cmd.exe	105
PID 1448 wrote to memory of 5128	1448	default.dat.exe	106
PID 5128 wrote to memory of 1100	5128	cmd.exe	108
PID 1448 wrote to memory of 4952	1448	default.dat.exe	109
PID 4952 wrote to memory of 4488	4952	cmd.exe	111
PID 1448 wrote to memory of 2148	1448	default.dat.exe	112
PID 2148 wrote to memory of 1488	2148	cmd.exe	114
PID 1448 wrote to memory of 1252	1448	default.dat.exe	115
PID 1252 wrote to memory of 3176	1252	cmd.exe	117
PID 1448 wrote to memory of 3268	1448	default.dat.exe	118
PID 3268 wrote to memory of 3372	3268	cmd.exe	120
PID 1448 wrote to memory of 1360	1448	default.dat.exe	121
PID 1360 wrote to memory of 5660	1360	cmd.exe	123
PID 1448 wrote to memory of 3292	1448	default.dat.exe	124
PID 3292 wrote to memory of 4916	3292	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\keqeyuq'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\keqeyuq'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact