504d3db673cea7561272630dcdbcb132c470cdb6b4735af762f541f3adf19942

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260729-lwebxafe88
SHA256 504d3db673cea7561272630dcdbcb132c470cdb6b4735af762f541f3adf19942
MD5 fc5062774b187283d0e3edfe421a001a
SHA1 4a2bb63c5007379ea2dffb8669743af4cc773844
SHA512 d234fa494122be73a614da72cb39db5afd2e2733b34805bb2085ab5f1d5b64ee5bc97dfd347a8036b6a70b228dc2aa1b9488e6c6c9aa39a0d33e01a54e5d1d18
SSDEEP 393216:u7unA9OfZgfTp15aPrwuv39lXMCHWUjXTcuI3/PGTAI:uD9OfZw1Uk0XMb8XQH/O7
TLSH
T1D2E6334CAAF402FDE563903CD5F22967E876F0B55734CADB17A882912D1B2B08C3D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6124	powershell.exe
4264	powershell.exe
2752	powershell.exe
4564	powershell.exe
4420	powershell.exe
2968	powershell.exe
5336	powershell.exe
5344	powershell.exe
5416	powershell.exe
5896	powershell.exe
2644	powershell.exe
1252	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe
4380	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4708	cmd.exe
1956	cmd.exe
1492	cmd.exe
1460	cmd.exe
1760	cmd.exe
976	cmd.exe
2508	cmd.exe
5560	cmd.exe
5872	cmd.exe
4196	cmd.exe
2856	cmd.exe
4772	cmd.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4380	default.dat.exe
4380	default.dat.exe
5336	powershell.exe
5336	powershell.exe
6124	powershell.exe
6124	powershell.exe
6124	powershell.exe
4264	powershell.exe
4264	powershell.exe
5344	powershell.exe
5344	powershell.exe
2752	powershell.exe
2752	powershell.exe
4564	powershell.exe
4564	powershell.exe
4420	powershell.exe
4420	powershell.exe
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
5416	powershell.exe
5416	powershell.exe
5896	powershell.exe
5896	powershell.exe
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe
1252	powershell.exe
1252	powershell.exe
1252	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	default.dat.exe
Token: SeDebugPrivilege	5336	powershell.exe
Token: SeIncreaseQuotaPrivilege	5336	powershell.exe
Token: SeSecurityPrivilege	5336	powershell.exe
Token: SeTakeOwnershipPrivilege	5336	powershell.exe
Token: SeLoadDriverPrivilege	5336	powershell.exe
Token: SeSystemProfilePrivilege	5336	powershell.exe
Token: SeSystemtimePrivilege	5336	powershell.exe
Token: SeProfSingleProcessPrivilege	5336	powershell.exe
Token: SeIncBasePriorityPrivilege	5336	powershell.exe
Token: SeCreatePagefilePrivilege	5336	powershell.exe
Token: SeBackupPrivilege	5336	powershell.exe
Token: SeRestorePrivilege	5336	powershell.exe
Token: SeShutdownPrivilege	5336	powershell.exe
Token: SeDebugPrivilege	5336	powershell.exe
Token: SeSystemEnvironmentPrivilege	5336	powershell.exe
Token: SeRemoteShutdownPrivilege	5336	powershell.exe
Token: SeUndockPrivilege	5336	powershell.exe
Token: SeManageVolumePrivilege	5336	powershell.exe
Token: 33	5336	powershell.exe
Token: 34	5336	powershell.exe
Token: 35	5336	powershell.exe
Token: 36	5336	powershell.exe
Token: SeDebugPrivilege	6124	powershell.exe
Token: SeIncreaseQuotaPrivilege	6124	powershell.exe
Token: SeSecurityPrivilege	6124	powershell.exe
Token: SeTakeOwnershipPrivilege	6124	powershell.exe
Token: SeLoadDriverPrivilege	6124	powershell.exe
Token: SeSystemProfilePrivilege	6124	powershell.exe
Token: SeSystemtimePrivilege	6124	powershell.exe
Token: SeProfSingleProcessPrivilege	6124	powershell.exe
Token: SeIncBasePriorityPrivilege	6124	powershell.exe
Token: SeCreatePagefilePrivilege	6124	powershell.exe
Token: SeBackupPrivilege	6124	powershell.exe
Token: SeRestorePrivilege	6124	powershell.exe
Token: SeShutdownPrivilege	6124	powershell.exe
Token: SeDebugPrivilege	6124	powershell.exe
Token: SeSystemEnvironmentPrivilege	6124	powershell.exe
Token: SeRemoteShutdownPrivilege	6124	powershell.exe
Token: SeUndockPrivilege	6124	powershell.exe
Token: SeManageVolumePrivilege	6124	powershell.exe
Token: 33	6124	powershell.exe
Token: 34	6124	powershell.exe
Token: 35	6124	powershell.exe
Token: 36	6124	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	powershell.exe
Token: SeSecurityPrivilege	4264	powershell.exe
Token: SeTakeOwnershipPrivilege	4264	powershell.exe
Token: SeLoadDriverPrivilege	4264	powershell.exe
Token: SeSystemProfilePrivilege	4264	powershell.exe
Token: SeSystemtimePrivilege	4264	powershell.exe
Token: SeProfSingleProcessPrivilege	4264	powershell.exe
Token: SeIncBasePriorityPrivilege	4264	powershell.exe
Token: SeCreatePagefilePrivilege	4264	powershell.exe
Token: SeBackupPrivilege	4264	powershell.exe
Token: SeRestorePrivilege	4264	powershell.exe
Token: SeShutdownPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeSystemEnvironmentPrivilege	4264	powershell.exe
Token: SeRemoteShutdownPrivilege	4264	powershell.exe
Token: SeUndockPrivilege	4264	powershell.exe
Token: SeManageVolumePrivilege	4264	powershell.exe
Token: 33	4264	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 4380	1312	default.dat.exe	89
PID 4380 wrote to memory of 976	4380	default.dat.exe	90
PID 976 wrote to memory of 5336	976	cmd.exe	92
PID 4380 wrote to memory of 1956	4380	default.dat.exe	94
PID 1956 wrote to memory of 6124	1956	cmd.exe	96
PID 4380 wrote to memory of 2508	4380	default.dat.exe	97
PID 2508 wrote to memory of 4264	2508	cmd.exe	99
PID 4380 wrote to memory of 1492	4380	default.dat.exe	100
PID 1492 wrote to memory of 5344	1492	cmd.exe	102
PID 4380 wrote to memory of 5560	4380	default.dat.exe	103
PID 5560 wrote to memory of 2752	5560	cmd.exe	105
PID 4380 wrote to memory of 5872	4380	default.dat.exe	106
PID 5872 wrote to memory of 4564	5872	cmd.exe	108
PID 4380 wrote to memory of 4196	4380	default.dat.exe	109
PID 4196 wrote to memory of 4420	4196	cmd.exe	111
PID 4380 wrote to memory of 2856	4380	default.dat.exe	112
PID 2856 wrote to memory of 2968	2856	cmd.exe	114
PID 4380 wrote to memory of 4772	4380	default.dat.exe	115
PID 4772 wrote to memory of 5416	4772	cmd.exe	117
PID 4380 wrote to memory of 4708	4380	default.dat.exe	118
PID 4708 wrote to memory of 5896	4708	cmd.exe	120
PID 4380 wrote to memory of 1460	4380	default.dat.exe	121
PID 1460 wrote to memory of 2644	1460	cmd.exe	123
PID 4380 wrote to memory of 1760	4380	default.dat.exe	124
PID 1760 wrote to memory of 1252	1760	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact