b4f3acd50d0947aded733854216516d46990d57ce5e2cdcfdec432f0e498472a

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260729-p4y8tsgp2w
SHA256 b4f3acd50d0947aded733854216516d46990d57ce5e2cdcfdec432f0e498472a
MD5 0a7f48c4c09e3f9d552fc60dc4727fef
SHA1 115ce860ef3071481af5395668c3014e9349876d
SHA512 17f6da9798512b54305b9345fb3a60040a55934ae25301607822323851b8b682af4846986f2969383a87980b24c969000567919c6aa00b86e1905ff3910086fd
SSDEEP 393216:PS4u6K/QbOk310ZXBLVOYXMCHWUjXHcuI3/PGTAI:PDOk3aJB1XMb8X8H/O7
TLSH
T1DFE6332496E010EFDA63C47CEEE14497F5A6B4B50B71C68F6BE48AA05D473E08D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe
2068	powershell.exe
5916	powershell.exe
4160	powershell.exe
5824	powershell.exe
2472	powershell.exe
2416	powershell.exe
4256	powershell.exe
6056	powershell.exe
1348	powershell.exe
5656	powershell.exe
5428	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe
820	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2440	cmd.exe
5764	cmd.exe
6008	cmd.exe
5224	cmd.exe
5400	cmd.exe
4308	cmd.exe
5844	cmd.exe
5312	cmd.exe
4132	cmd.exe
4252	cmd.exe
2852	cmd.exe
4780	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
820	default.dat.exe
820	default.dat.exe
5656	powershell.exe
5656	powershell.exe
5656	powershell.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
4464	powershell.exe
4464	powershell.exe
4464	powershell.exe
2472	powershell.exe
2472	powershell.exe
2472	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
4256	powershell.exe
4256	powershell.exe
4256	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
5916	powershell.exe
5916	powershell.exe
5916	powershell.exe
4160	powershell.exe
4160	powershell.exe
4160	powershell.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
5824	powershell.exe
5824	powershell.exe
5824	powershell.exe
1348	powershell.exe
1348	powershell.exe
1348	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	default.dat.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeIncreaseQuotaPrivilege	5656	powershell.exe
Token: SeSecurityPrivilege	5656	powershell.exe
Token: SeTakeOwnershipPrivilege	5656	powershell.exe
Token: SeLoadDriverPrivilege	5656	powershell.exe
Token: SeSystemProfilePrivilege	5656	powershell.exe
Token: SeSystemtimePrivilege	5656	powershell.exe
Token: SeProfSingleProcessPrivilege	5656	powershell.exe
Token: SeIncBasePriorityPrivilege	5656	powershell.exe
Token: SeCreatePagefilePrivilege	5656	powershell.exe
Token: SeBackupPrivilege	5656	powershell.exe
Token: SeRestorePrivilege	5656	powershell.exe
Token: SeShutdownPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeSystemEnvironmentPrivilege	5656	powershell.exe
Token: SeRemoteShutdownPrivilege	5656	powershell.exe
Token: SeUndockPrivilege	5656	powershell.exe
Token: SeManageVolumePrivilege	5656	powershell.exe
Token: 33	5656	powershell.exe
Token: 34	5656	powershell.exe
Token: 35	5656	powershell.exe
Token: 36	5656	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeIncreaseQuotaPrivilege	4464	powershell.exe
Token: SeSecurityPrivilege	4464	powershell.exe
Token: SeTakeOwnershipPrivilege	4464	powershell.exe
Token: SeLoadDriverPrivilege	4464	powershell.exe
Token: SeSystemProfilePrivilege	4464	powershell.exe
Token: SeSystemtimePrivilege	4464	powershell.exe
Token: SeProfSingleProcessPrivilege	4464	powershell.exe
Token: SeIncBasePriorityPrivilege	4464	powershell.exe
Token: SeCreatePagefilePrivilege	4464	powershell.exe
Token: SeBackupPrivilege	4464	powershell.exe
Token: SeRestorePrivilege	4464	powershell.exe
Token: SeShutdownPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeSystemEnvironmentPrivilege	4464	powershell.exe
Token: SeRemoteShutdownPrivilege	4464	powershell.exe
Token: SeUndockPrivilege	4464	powershell.exe
Token: SeManageVolumePrivilege	4464	powershell.exe
Token: 33	4464	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 820	1388	default.dat.exe	88
PID 820 wrote to memory of 4252	820	default.dat.exe	89
PID 4252 wrote to memory of 5656	4252	cmd.exe	91
PID 820 wrote to memory of 5764	820	default.dat.exe	93
PID 5764 wrote to memory of 5428	5764	cmd.exe	95
PID 820 wrote to memory of 6008	820	default.dat.exe	96
PID 6008 wrote to memory of 4464	6008	cmd.exe	98
PID 820 wrote to memory of 2852	820	default.dat.exe	99
PID 2852 wrote to memory of 2472	2852	cmd.exe	101
PID 820 wrote to memory of 5224	820	default.dat.exe	102
PID 5224 wrote to memory of 2416	5224	cmd.exe	104
PID 820 wrote to memory of 5400	820	default.dat.exe	105
PID 5400 wrote to memory of 4256	5400	cmd.exe	107
PID 820 wrote to memory of 4780	820	default.dat.exe	108
PID 4780 wrote to memory of 2068	4780	cmd.exe	110
PID 820 wrote to memory of 4308	820	default.dat.exe	111
PID 4308 wrote to memory of 5916	4308	cmd.exe	113
PID 820 wrote to memory of 5844	820	default.dat.exe	114
PID 5844 wrote to memory of 4160	5844	cmd.exe	116
PID 820 wrote to memory of 5312	820	default.dat.exe	117
PID 5312 wrote to memory of 6056	5312	cmd.exe	119
PID 820 wrote to memory of 4132	820	default.dat.exe	120
PID 4132 wrote to memory of 5824	4132	cmd.exe	122
PID 820 wrote to memory of 2440	820	default.dat.exe	123
PID 2440 wrote to memory of 1348	2440	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact