6f23c7805963d98f57ba6497f17168967545e203774f383b23807f0dcb86e0d0

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260727-tb4p3ahn71
SHA256 6f23c7805963d98f57ba6497f17168967545e203774f383b23807f0dcb86e0d0
MD5 7696f9286237810feb2fcdce7eb6b953
SHA1 8057152364fdbcbd18811eb09baabae1a32b2db5
SHA512 3c03b2e7f54dc2f280cf218301b3b348c728bf049858c943da1108c41bab144236309b2b6bd06bc1ac7ae079d0fc109da9a8272d28b408f36f294289447e0558
SSDEEP 393216:Oq0Ciuz51iyGC6WR/XtXZFXMCHWUjX7cuI3/PGTAI:OqVDZRRzXMb8X4H/O7
TLSH
T180E633085AD107FADA73823C99E2539DE2A5BC720BB2C69F1ED8D3652E471E04D3C653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3876	powershell.exe
5212	powershell.exe
3280	powershell.exe
2900	powershell.exe
3376	powershell.exe
1052	powershell.exe
6016	powershell.exe
5548	powershell.exe
5340	powershell.exe
5676	powershell.exe
3848	powershell.exe
3628	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe
4740	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3748	cmd.exe
1660	cmd.exe
5536	cmd.exe
1704	cmd.exe
4292	cmd.exe
2436	cmd.exe
5156	cmd.exe
4872	cmd.exe
3452	cmd.exe
1040	cmd.exe
1740	cmd.exe
1328	cmd.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4740	default.dat.exe
4740	default.dat.exe
5548	powershell.exe
5548	powershell.exe
5340	powershell.exe
5340	powershell.exe
3280	powershell.exe
3280	powershell.exe
2900	powershell.exe
2900	powershell.exe
5676	powershell.exe
5676	powershell.exe
3848	powershell.exe
3848	powershell.exe
3628	powershell.exe
3628	powershell.exe
3376	powershell.exe
3376	powershell.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
3876	powershell.exe
3876	powershell.exe
6016	powershell.exe
6016	powershell.exe
5212	powershell.exe
5212	powershell.exe
5212	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	default.dat.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeIncreaseQuotaPrivilege	5548	powershell.exe
Token: SeSecurityPrivilege	5548	powershell.exe
Token: SeTakeOwnershipPrivilege	5548	powershell.exe
Token: SeLoadDriverPrivilege	5548	powershell.exe
Token: SeSystemProfilePrivilege	5548	powershell.exe
Token: SeSystemtimePrivilege	5548	powershell.exe
Token: SeProfSingleProcessPrivilege	5548	powershell.exe
Token: SeIncBasePriorityPrivilege	5548	powershell.exe
Token: SeCreatePagefilePrivilege	5548	powershell.exe
Token: SeBackupPrivilege	5548	powershell.exe
Token: SeRestorePrivilege	5548	powershell.exe
Token: SeShutdownPrivilege	5548	powershell.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeSystemEnvironmentPrivilege	5548	powershell.exe
Token: SeRemoteShutdownPrivilege	5548	powershell.exe
Token: SeUndockPrivilege	5548	powershell.exe
Token: SeManageVolumePrivilege	5548	powershell.exe
Token: 33	5548	powershell.exe
Token: 34	5548	powershell.exe
Token: 35	5548	powershell.exe
Token: 36	5548	powershell.exe
Token: SeDebugPrivilege	5340	powershell.exe
Token: SeIncreaseQuotaPrivilege	5340	powershell.exe
Token: SeSecurityPrivilege	5340	powershell.exe
Token: SeTakeOwnershipPrivilege	5340	powershell.exe
Token: SeLoadDriverPrivilege	5340	powershell.exe
Token: SeSystemProfilePrivilege	5340	powershell.exe
Token: SeSystemtimePrivilege	5340	powershell.exe
Token: SeProfSingleProcessPrivilege	5340	powershell.exe
Token: SeIncBasePriorityPrivilege	5340	powershell.exe
Token: SeCreatePagefilePrivilege	5340	powershell.exe
Token: SeBackupPrivilege	5340	powershell.exe
Token: SeRestorePrivilege	5340	powershell.exe
Token: SeShutdownPrivilege	5340	powershell.exe
Token: SeDebugPrivilege	5340	powershell.exe
Token: SeSystemEnvironmentPrivilege	5340	powershell.exe
Token: SeRemoteShutdownPrivilege	5340	powershell.exe
Token: SeUndockPrivilege	5340	powershell.exe
Token: SeManageVolumePrivilege	5340	powershell.exe
Token: 33	5340	powershell.exe
Token: 34	5340	powershell.exe
Token: 35	5340	powershell.exe
Token: 36	5340	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeIncreaseQuotaPrivilege	3280	powershell.exe
Token: SeSecurityPrivilege	3280	powershell.exe
Token: SeTakeOwnershipPrivilege	3280	powershell.exe
Token: SeLoadDriverPrivilege	3280	powershell.exe
Token: SeSystemProfilePrivilege	3280	powershell.exe
Token: SeSystemtimePrivilege	3280	powershell.exe
Token: SeProfSingleProcessPrivilege	3280	powershell.exe
Token: SeIncBasePriorityPrivilege	3280	powershell.exe
Token: SeCreatePagefilePrivilege	3280	powershell.exe
Token: SeBackupPrivilege	3280	powershell.exe
Token: SeRestorePrivilege	3280	powershell.exe
Token: SeShutdownPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeSystemEnvironmentPrivilege	3280	powershell.exe
Token: SeRemoteShutdownPrivilege	3280	powershell.exe
Token: SeUndockPrivilege	3280	powershell.exe
Token: SeManageVolumePrivilege	3280	powershell.exe
Token: 33	3280	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4740	4160	default.dat.exe	89
PID 4740 wrote to memory of 4872	4740	default.dat.exe	90
PID 4872 wrote to memory of 5548	4872	cmd.exe	92
PID 4740 wrote to memory of 3452	4740	default.dat.exe	94
PID 3452 wrote to memory of 5340	3452	cmd.exe	96
PID 4740 wrote to memory of 3748	4740	default.dat.exe	97
PID 3748 wrote to memory of 3280	3748	cmd.exe	99
PID 4740 wrote to memory of 1660	4740	default.dat.exe	100
PID 1660 wrote to memory of 2900	1660	cmd.exe	102
PID 4740 wrote to memory of 1040	4740	default.dat.exe	103
PID 1040 wrote to memory of 5676	1040	cmd.exe	105
PID 4740 wrote to memory of 5536	4740	default.dat.exe	106
PID 5536 wrote to memory of 3848	5536	cmd.exe	108
PID 4740 wrote to memory of 1704	4740	default.dat.exe	109
PID 1704 wrote to memory of 3628	1704	cmd.exe	111
PID 4740 wrote to memory of 1740	4740	default.dat.exe	112
PID 1740 wrote to memory of 3376	1740	cmd.exe	114
PID 4740 wrote to memory of 4292	4740	default.dat.exe	115
PID 4292 wrote to memory of 1052	4292	cmd.exe	117
PID 4740 wrote to memory of 2436	4740	default.dat.exe	118
PID 2436 wrote to memory of 3876	2436	cmd.exe	120
PID 4740 wrote to memory of 5156	4740	default.dat.exe	121
PID 5156 wrote to memory of 6016	5156	cmd.exe	123
PID 4740 wrote to memory of 1328	4740	default.dat.exe	124
PID 1328 wrote to memory of 5212	1328	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\diwenoy'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\diwenoy'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact