31e86a063a1bdb8f77d70a05c0b67ea7f962ccdd527a40311fe0debefb724375

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260730-ddhmlsag38
SHA256 31e86a063a1bdb8f77d70a05c0b67ea7f962ccdd527a40311fe0debefb724375
MD5 c88e46c406f6e91ac0175fc9f8efd240
SHA1 09b17c8374bfca50b7a634355a636f79af19e6a5
SHA512 3e5f3e79f9b7e765d8382f76e70a04b4e2c4c7ea0d7a845e7f2925885366927a5c28589ea6aa3cd9eb72e39fc97fb8ed77852f9e158b40d4133f02ebdea66678
SSDEEP 393216:HUuse67YdpNXtK6FQpRQwibpPkXMCHWUjXvcuI3/PGTAI:HU0RXtKkQpRQGXMb8XkH/O7
TLSH
T145E6339C76E425EDED67C03DADE20409E6B5B8751B72CADB47B407A26F631E00C3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
796	powershell.exe
5836	powershell.exe
4472	powershell.exe
4476	powershell.exe
6100	powershell.exe
1432	powershell.exe
4408	powershell.exe
1904	powershell.exe
5560	powershell.exe
6132	powershell.exe
5092	powershell.exe
5072	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe
4316	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3316	cmd.exe
1148	cmd.exe
5888	cmd.exe
3360	cmd.exe
1400	cmd.exe
3528	cmd.exe
1568	cmd.exe
2192	cmd.exe
6052	cmd.exe
1360	cmd.exe
2356	cmd.exe
3376	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4316	default.dat.exe
4316	default.dat.exe
6100	powershell.exe
6100	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
4408	powershell.exe
4408	powershell.exe
4408	powershell.exe
5072	powershell.exe
5072	powershell.exe
5072	powershell.exe
796	powershell.exe
796	powershell.exe
796	powershell.exe
5836	powershell.exe
5836	powershell.exe
5836	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe
6132	powershell.exe
6132	powershell.exe
6132	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	default.dat.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeIncreaseQuotaPrivilege	6100	powershell.exe
Token: SeSecurityPrivilege	6100	powershell.exe
Token: SeTakeOwnershipPrivilege	6100	powershell.exe
Token: SeLoadDriverPrivilege	6100	powershell.exe
Token: SeSystemProfilePrivilege	6100	powershell.exe
Token: SeSystemtimePrivilege	6100	powershell.exe
Token: SeProfSingleProcessPrivilege	6100	powershell.exe
Token: SeIncBasePriorityPrivilege	6100	powershell.exe
Token: SeCreatePagefilePrivilege	6100	powershell.exe
Token: SeBackupPrivilege	6100	powershell.exe
Token: SeRestorePrivilege	6100	powershell.exe
Token: SeShutdownPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeSystemEnvironmentPrivilege	6100	powershell.exe
Token: SeRemoteShutdownPrivilege	6100	powershell.exe
Token: SeUndockPrivilege	6100	powershell.exe
Token: SeManageVolumePrivilege	6100	powershell.exe
Token: 33	6100	powershell.exe
Token: 34	6100	powershell.exe
Token: 35	6100	powershell.exe
Token: 36	6100	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeIncreaseQuotaPrivilege	1432	powershell.exe
Token: SeSecurityPrivilege	1432	powershell.exe
Token: SeTakeOwnershipPrivilege	1432	powershell.exe
Token: SeLoadDriverPrivilege	1432	powershell.exe
Token: SeSystemProfilePrivilege	1432	powershell.exe
Token: SeSystemtimePrivilege	1432	powershell.exe
Token: SeProfSingleProcessPrivilege	1432	powershell.exe
Token: SeIncBasePriorityPrivilege	1432	powershell.exe
Token: SeCreatePagefilePrivilege	1432	powershell.exe
Token: SeBackupPrivilege	1432	powershell.exe
Token: SeRestorePrivilege	1432	powershell.exe
Token: SeShutdownPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeSystemEnvironmentPrivilege	1432	powershell.exe
Token: SeRemoteShutdownPrivilege	1432	powershell.exe
Token: SeUndockPrivilege	1432	powershell.exe
Token: SeManageVolumePrivilege	1432	powershell.exe
Token: 33	1432	powershell.exe
Token: 34	1432	powershell.exe
Token: 35	1432	powershell.exe
Token: 36	1432	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeIncreaseQuotaPrivilege	5092	powershell.exe
Token: SeSecurityPrivilege	5092	powershell.exe
Token: SeTakeOwnershipPrivilege	5092	powershell.exe
Token: SeLoadDriverPrivilege	5092	powershell.exe
Token: SeSystemProfilePrivilege	5092	powershell.exe
Token: SeSystemtimePrivilege	5092	powershell.exe
Token: SeProfSingleProcessPrivilege	5092	powershell.exe
Token: SeIncBasePriorityPrivilege	5092	powershell.exe
Token: SeCreatePagefilePrivilege	5092	powershell.exe
Token: SeBackupPrivilege	5092	powershell.exe
Token: SeRestorePrivilege	5092	powershell.exe
Token: SeShutdownPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeSystemEnvironmentPrivilege	5092	powershell.exe
Token: SeRemoteShutdownPrivilege	5092	powershell.exe
Token: SeUndockPrivilege	5092	powershell.exe
Token: SeManageVolumePrivilege	5092	powershell.exe
Token: 33	5092	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 4316	2084	default.dat.exe	89
PID 4316 wrote to memory of 3376	4316	default.dat.exe	90
PID 3376 wrote to memory of 6100	3376	cmd.exe	92
PID 4316 wrote to memory of 1568	4316	default.dat.exe	94
PID 1568 wrote to memory of 1432	1568	cmd.exe	96
PID 4316 wrote to memory of 2192	4316	default.dat.exe	97
PID 2192 wrote to memory of 5092	2192	cmd.exe	99
PID 4316 wrote to memory of 6052	4316	default.dat.exe	100
PID 6052 wrote to memory of 4408	6052	cmd.exe	102
PID 4316 wrote to memory of 1360	4316	default.dat.exe	103
PID 1360 wrote to memory of 5072	1360	cmd.exe	105
PID 4316 wrote to memory of 2356	4316	default.dat.exe	106
PID 2356 wrote to memory of 796	2356	cmd.exe	108
PID 4316 wrote to memory of 3316	4316	default.dat.exe	109
PID 3316 wrote to memory of 5836	3316	cmd.exe	111
PID 4316 wrote to memory of 1148	4316	default.dat.exe	112
PID 1148 wrote to memory of 4472	1148	cmd.exe	114
PID 4316 wrote to memory of 5888	4316	default.dat.exe	115
PID 5888 wrote to memory of 1904	5888	cmd.exe	117
PID 4316 wrote to memory of 3360	4316	default.dat.exe	119
PID 3360 wrote to memory of 4476	3360	cmd.exe	121
PID 4316 wrote to memory of 1400	4316	default.dat.exe	122
PID 1400 wrote to memory of 5560	1400	cmd.exe	124
PID 4316 wrote to memory of 3528	4316	default.dat.exe	125
PID 3528 wrote to memory of 6132	3528	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact