8a5cd46a4e91474deaeea3fb1277bc993524a547bd09138a15fefa456155d4b6

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260729-efdxwatdrf
SHA256 8a5cd46a4e91474deaeea3fb1277bc993524a547bd09138a15fefa456155d4b6
MD5 b18dbb4364eb84c4fcd6e405006d2fc2
SHA1 3e3c72a35aee2040bc517bd90ff3717b68c7cc2b
SHA512 27392ca32bb038821cce95332ba9446308c9ac348291fd80df8d3cb892ee2a041bd640813e69032e61542ddab4bb4bfe4d7dfbba531207888a855bd8f6d5ccc1
SSDEEP 393216:0q7JQ2bNddLQtx/vm5GVfzHvi0XMCHWUjXycuI3/PGTAI:0qtjbNddLQLXVflXMb8XPH/O7
TLSH
T180E6338CE6E401BDE2B3523DDDD165F5D17674A603B2C1EB1BA48291BC2B2D18E3DA13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2004	powershell.exe
5652	powershell.exe
5284	powershell.exe
2652	powershell.exe
2696	powershell.exe
1520	powershell.exe
3220	powershell.exe
1420	powershell.exe
4288	powershell.exe
960	powershell.exe
1488	powershell.exe
2312	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe
2336	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5396	cmd.exe
5572	cmd.exe
6128	cmd.exe
4552	cmd.exe
3460	cmd.exe
3300	cmd.exe
1168	cmd.exe
2920	cmd.exe
3508	cmd.exe
5088	cmd.exe
3172	cmd.exe
1248	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2336	default.dat.exe
2336	default.dat.exe
4288	powershell.exe
4288	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
5652	powershell.exe
5652	powershell.exe
5652	powershell.exe
5284	powershell.exe
5284	powershell.exe
5284	powershell.exe
2652	powershell.exe
2652	powershell.exe
2652	powershell.exe
960	powershell.exe
960	powershell.exe
960	powershell.exe
2696	powershell.exe
2696	powershell.exe
2696	powershell.exe
1488	powershell.exe
1488	powershell.exe
1488	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	default.dat.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeIncreaseQuotaPrivilege	4288	powershell.exe
Token: SeSecurityPrivilege	4288	powershell.exe
Token: SeTakeOwnershipPrivilege	4288	powershell.exe
Token: SeLoadDriverPrivilege	4288	powershell.exe
Token: SeSystemProfilePrivilege	4288	powershell.exe
Token: SeSystemtimePrivilege	4288	powershell.exe
Token: SeProfSingleProcessPrivilege	4288	powershell.exe
Token: SeIncBasePriorityPrivilege	4288	powershell.exe
Token: SeCreatePagefilePrivilege	4288	powershell.exe
Token: SeBackupPrivilege	4288	powershell.exe
Token: SeRestorePrivilege	4288	powershell.exe
Token: SeShutdownPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeSystemEnvironmentPrivilege	4288	powershell.exe
Token: SeRemoteShutdownPrivilege	4288	powershell.exe
Token: SeUndockPrivilege	4288	powershell.exe
Token: SeManageVolumePrivilege	4288	powershell.exe
Token: 33	4288	powershell.exe
Token: 34	4288	powershell.exe
Token: 35	4288	powershell.exe
Token: 36	4288	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeIncreaseQuotaPrivilege	2004	powershell.exe
Token: SeSecurityPrivilege	2004	powershell.exe
Token: SeTakeOwnershipPrivilege	2004	powershell.exe
Token: SeLoadDriverPrivilege	2004	powershell.exe
Token: SeSystemProfilePrivilege	2004	powershell.exe
Token: SeSystemtimePrivilege	2004	powershell.exe
Token: SeProfSingleProcessPrivilege	2004	powershell.exe
Token: SeIncBasePriorityPrivilege	2004	powershell.exe
Token: SeCreatePagefilePrivilege	2004	powershell.exe
Token: SeBackupPrivilege	2004	powershell.exe
Token: SeRestorePrivilege	2004	powershell.exe
Token: SeShutdownPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeSystemEnvironmentPrivilege	2004	powershell.exe
Token: SeRemoteShutdownPrivilege	2004	powershell.exe
Token: SeUndockPrivilege	2004	powershell.exe
Token: SeManageVolumePrivilege	2004	powershell.exe
Token: 33	2004	powershell.exe
Token: 34	2004	powershell.exe
Token: 35	2004	powershell.exe
Token: 36	2004	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeIncreaseQuotaPrivilege	5652	powershell.exe
Token: SeSecurityPrivilege	5652	powershell.exe
Token: SeTakeOwnershipPrivilege	5652	powershell.exe
Token: SeLoadDriverPrivilege	5652	powershell.exe
Token: SeSystemProfilePrivilege	5652	powershell.exe
Token: SeSystemtimePrivilege	5652	powershell.exe
Token: SeProfSingleProcessPrivilege	5652	powershell.exe
Token: SeIncBasePriorityPrivilege	5652	powershell.exe
Token: SeCreatePagefilePrivilege	5652	powershell.exe
Token: SeBackupPrivilege	5652	powershell.exe
Token: SeRestorePrivilege	5652	powershell.exe
Token: SeShutdownPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeSystemEnvironmentPrivilege	5652	powershell.exe
Token: SeRemoteShutdownPrivilege	5652	powershell.exe
Token: SeUndockPrivilege	5652	powershell.exe
Token: SeManageVolumePrivilege	5652	powershell.exe
Token: 33	5652	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 2336	572	default.dat.exe	89
PID 2336 wrote to memory of 1168	2336	default.dat.exe	90
PID 1168 wrote to memory of 4288	1168	cmd.exe	92
PID 2336 wrote to memory of 2920	2336	default.dat.exe	94
PID 2920 wrote to memory of 2004	2920	cmd.exe	96
PID 2336 wrote to memory of 5396	2336	default.dat.exe	97
PID 5396 wrote to memory of 5652	5396	cmd.exe	99
PID 2336 wrote to memory of 3508	2336	default.dat.exe	100
PID 3508 wrote to memory of 5284	3508	cmd.exe	102
PID 2336 wrote to memory of 5572	2336	default.dat.exe	103
PID 5572 wrote to memory of 2652	5572	cmd.exe	105
PID 2336 wrote to memory of 5088	2336	default.dat.exe	106
PID 5088 wrote to memory of 960	5088	cmd.exe	108
PID 2336 wrote to memory of 6128	2336	default.dat.exe	109
PID 6128 wrote to memory of 2696	6128	cmd.exe	111
PID 2336 wrote to memory of 4552	2336	default.dat.exe	112
PID 4552 wrote to memory of 1488	4552	cmd.exe	114
PID 2336 wrote to memory of 3172	2336	default.dat.exe	115
PID 3172 wrote to memory of 1520	3172	cmd.exe	117
PID 2336 wrote to memory of 3460	2336	default.dat.exe	118
PID 3460 wrote to memory of 3220	3460	cmd.exe	120
PID 2336 wrote to memory of 1248	2336	default.dat.exe	121
PID 1248 wrote to memory of 1420	1248	cmd.exe	123
PID 2336 wrote to memory of 3300	2336	default.dat.exe	124
PID 3300 wrote to memory of 2312	3300	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact