5f1146ec4c1130cd64af934de2687d6dc78330b3bc6c8486deb39b9305b10d72

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260730-p4dbcsaq6v
SHA256 5f1146ec4c1130cd64af934de2687d6dc78330b3bc6c8486deb39b9305b10d72
MD5 dd79f535f6108df5bea9c3b2be064a09
SHA1 ad55499168f6028869bb7ebdd83406b948ede9f1
SHA512 67f8454c52ecee1323a9aa6669111f4ceee5d3f6558205b28f759a408effb7342e82099cfd0eeace3533709b51fbbfc573cb6958e0fc339b8ebd6849c7f8370a
SSDEEP 393216:egmP3ruwRR5DAKB0+YOUS6E8TSeksEXMCHWUjXpcuI3/PGTAI:egmjuwV/BcTS6BTVksEXMb8XeH/O7
TLSH
T1EBE6331C7AD003EFDB93813CD9B263EAD594786A07B1CBDF466816B1BA530D0883E957
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2964	powershell.exe
3192	powershell.exe
5932	powershell.exe
996	powershell.exe
3536	powershell.exe
5764	powershell.exe
4764	powershell.exe
1056	powershell.exe
1924	powershell.exe
3796	powershell.exe
7128	powershell.exe
1280	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe
836	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4876	cmd.exe
6008	cmd.exe
4248	cmd.exe
2392	cmd.exe
5160	cmd.exe
4796	cmd.exe
4284	cmd.exe
7016	cmd.exe
5644	cmd.exe
1476	cmd.exe
3712	cmd.exe
5156	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
836	default.dat.exe
836	default.dat.exe
996	powershell.exe
996	powershell.exe
996	powershell.exe
3536	powershell.exe
3536	powershell.exe
3536	powershell.exe
1924	powershell.exe
1924	powershell.exe
1924	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
5764	powershell.exe
5764	powershell.exe
5764	powershell.exe
7128	powershell.exe
7128	powershell.exe
7128	powershell.exe
1280	powershell.exe
1280	powershell.exe
1280	powershell.exe
2964	powershell.exe
2964	powershell.exe
2964	powershell.exe
4764	powershell.exe
4764	powershell.exe
4764	powershell.exe
1056	powershell.exe
1056	powershell.exe
1056	powershell.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	default.dat.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeIncreaseQuotaPrivilege	996	powershell.exe
Token: SeSecurityPrivilege	996	powershell.exe
Token: SeTakeOwnershipPrivilege	996	powershell.exe
Token: SeLoadDriverPrivilege	996	powershell.exe
Token: SeSystemProfilePrivilege	996	powershell.exe
Token: SeSystemtimePrivilege	996	powershell.exe
Token: SeProfSingleProcessPrivilege	996	powershell.exe
Token: SeIncBasePriorityPrivilege	996	powershell.exe
Token: SeCreatePagefilePrivilege	996	powershell.exe
Token: SeBackupPrivilege	996	powershell.exe
Token: SeRestorePrivilege	996	powershell.exe
Token: SeShutdownPrivilege	996	powershell.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeSystemEnvironmentPrivilege	996	powershell.exe
Token: SeRemoteShutdownPrivilege	996	powershell.exe
Token: SeUndockPrivilege	996	powershell.exe
Token: SeManageVolumePrivilege	996	powershell.exe
Token: 33	996	powershell.exe
Token: 34	996	powershell.exe
Token: 35	996	powershell.exe
Token: 36	996	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeIncreaseQuotaPrivilege	3536	powershell.exe
Token: SeSecurityPrivilege	3536	powershell.exe
Token: SeTakeOwnershipPrivilege	3536	powershell.exe
Token: SeLoadDriverPrivilege	3536	powershell.exe
Token: SeSystemProfilePrivilege	3536	powershell.exe
Token: SeSystemtimePrivilege	3536	powershell.exe
Token: SeProfSingleProcessPrivilege	3536	powershell.exe
Token: SeIncBasePriorityPrivilege	3536	powershell.exe
Token: SeCreatePagefilePrivilege	3536	powershell.exe
Token: SeBackupPrivilege	3536	powershell.exe
Token: SeRestorePrivilege	3536	powershell.exe
Token: SeShutdownPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeSystemEnvironmentPrivilege	3536	powershell.exe
Token: SeRemoteShutdownPrivilege	3536	powershell.exe
Token: SeUndockPrivilege	3536	powershell.exe
Token: SeManageVolumePrivilege	3536	powershell.exe
Token: 33	3536	powershell.exe
Token: 34	3536	powershell.exe
Token: 35	3536	powershell.exe
Token: 36	3536	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeIncreaseQuotaPrivilege	1924	powershell.exe
Token: SeSecurityPrivilege	1924	powershell.exe
Token: SeTakeOwnershipPrivilege	1924	powershell.exe
Token: SeLoadDriverPrivilege	1924	powershell.exe
Token: SeSystemProfilePrivilege	1924	powershell.exe
Token: SeSystemtimePrivilege	1924	powershell.exe
Token: SeProfSingleProcessPrivilege	1924	powershell.exe
Token: SeIncBasePriorityPrivilege	1924	powershell.exe
Token: SeCreatePagefilePrivilege	1924	powershell.exe
Token: SeBackupPrivilege	1924	powershell.exe
Token: SeRestorePrivilege	1924	powershell.exe
Token: SeShutdownPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeSystemEnvironmentPrivilege	1924	powershell.exe
Token: SeRemoteShutdownPrivilege	1924	powershell.exe
Token: SeUndockPrivilege	1924	powershell.exe
Token: SeManageVolumePrivilege	1924	powershell.exe
Token: 33	1924	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 836	1796	default.dat.exe	90
PID 836 wrote to memory of 4876	836	default.dat.exe	91
PID 4876 wrote to memory of 996	4876	cmd.exe	93
PID 836 wrote to memory of 6008	836	default.dat.exe	95
PID 6008 wrote to memory of 3536	6008	cmd.exe	97
PID 836 wrote to memory of 4248	836	default.dat.exe	98
PID 4248 wrote to memory of 1924	4248	cmd.exe	100
PID 836 wrote to memory of 2392	836	default.dat.exe	101
PID 2392 wrote to memory of 3796	2392	cmd.exe	103
PID 836 wrote to memory of 5160	836	default.dat.exe	104
PID 5160 wrote to memory of 5764	5160	cmd.exe	106
PID 836 wrote to memory of 7016	836	default.dat.exe	107
PID 7016 wrote to memory of 7128	7016	cmd.exe	109
PID 836 wrote to memory of 4796	836	default.dat.exe	110
PID 4796 wrote to memory of 1280	4796	cmd.exe	112
PID 836 wrote to memory of 4284	836	default.dat.exe	113
PID 4284 wrote to memory of 2964	4284	cmd.exe	115
PID 836 wrote to memory of 5644	836	default.dat.exe	116
PID 5644 wrote to memory of 4764	5644	cmd.exe	118
PID 836 wrote to memory of 1476	836	default.dat.exe	119
PID 1476 wrote to memory of 1056	1476	cmd.exe	121
PID 836 wrote to memory of 3712	836	default.dat.exe	122
PID 3712 wrote to memory of 3192	3712	cmd.exe	124
PID 836 wrote to memory of 5156	836	default.dat.exe	125
PID 5156 wrote to memory of 5932	5156	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:7016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact