2670c97b169e77527f6db4726e58db1c95926c35b56e292c0a3a975dd6656cb8

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260731-ca78estyb1
SHA256 2670c97b169e77527f6db4726e58db1c95926c35b56e292c0a3a975dd6656cb8
MD5 e35810ed86789ee1d511550578dc81ec
SHA1 751e2692d1b8c18efba5b12c2e4076d57620e4eb
SHA512 3d260b4eb3247e5a55b03390bb2b730bbb98d2f355307130743ad57161089db96d5dd1e91796aeb0a447f4e7150776eaf1946c00a6bc36e52396e78ff1e2ae3e
SSDEEP 393216:igmkLdZLxHeuFJYzPUXMCHWUjXvcuI3/PGTAI:ig5HPYDUXMb8XkH/O7
TLSH
T187E6330872D01AFDEDA30278FEB15665D5A9B4320B71C8DF4E5497A36E0B1E08D3E267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3740	powershell.exe
5068	powershell.exe
4668	powershell.exe
1132	powershell.exe
3736	powershell.exe
2712	powershell.exe
3488	powershell.exe
6088	powershell.exe
252	powershell.exe
1932	powershell.exe
5012	powershell.exe
6104	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe
5736	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3228	cmd.exe
5052	cmd.exe
2668	cmd.exe
4680	cmd.exe
3824	cmd.exe
4792	cmd.exe
4744	cmd.exe
5436	cmd.exe
4396	cmd.exe
5332	cmd.exe
432	cmd.exe
1984	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5736	default.dat.exe
5736	default.dat.exe
3740	powershell.exe
3740	powershell.exe
252	powershell.exe
252	powershell.exe
5068	powershell.exe
5068	powershell.exe
4668	powershell.exe
4668	powershell.exe
1932	powershell.exe
1932	powershell.exe
1132	powershell.exe
1132	powershell.exe
3736	powershell.exe
3736	powershell.exe
2712	powershell.exe
2712	powershell.exe
3488	powershell.exe
3488	powershell.exe
6088	powershell.exe
6088	powershell.exe
5012	powershell.exe
5012	powershell.exe
6104	powershell.exe
6104	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5736	default.dat.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeIncreaseQuotaPrivilege	3740	powershell.exe
Token: SeSecurityPrivilege	3740	powershell.exe
Token: SeTakeOwnershipPrivilege	3740	powershell.exe
Token: SeLoadDriverPrivilege	3740	powershell.exe
Token: SeSystemProfilePrivilege	3740	powershell.exe
Token: SeSystemtimePrivilege	3740	powershell.exe
Token: SeProfSingleProcessPrivilege	3740	powershell.exe
Token: SeIncBasePriorityPrivilege	3740	powershell.exe
Token: SeCreatePagefilePrivilege	3740	powershell.exe
Token: SeBackupPrivilege	3740	powershell.exe
Token: SeRestorePrivilege	3740	powershell.exe
Token: SeShutdownPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeSystemEnvironmentPrivilege	3740	powershell.exe
Token: SeRemoteShutdownPrivilege	3740	powershell.exe
Token: SeUndockPrivilege	3740	powershell.exe
Token: SeManageVolumePrivilege	3740	powershell.exe
Token: 33	3740	powershell.exe
Token: 34	3740	powershell.exe
Token: 35	3740	powershell.exe
Token: 36	3740	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeIncreaseQuotaPrivilege	252	powershell.exe
Token: SeSecurityPrivilege	252	powershell.exe
Token: SeTakeOwnershipPrivilege	252	powershell.exe
Token: SeLoadDriverPrivilege	252	powershell.exe
Token: SeSystemProfilePrivilege	252	powershell.exe
Token: SeSystemtimePrivilege	252	powershell.exe
Token: SeProfSingleProcessPrivilege	252	powershell.exe
Token: SeIncBasePriorityPrivilege	252	powershell.exe
Token: SeCreatePagefilePrivilege	252	powershell.exe
Token: SeBackupPrivilege	252	powershell.exe
Token: SeRestorePrivilege	252	powershell.exe
Token: SeShutdownPrivilege	252	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeSystemEnvironmentPrivilege	252	powershell.exe
Token: SeRemoteShutdownPrivilege	252	powershell.exe
Token: SeUndockPrivilege	252	powershell.exe
Token: SeManageVolumePrivilege	252	powershell.exe
Token: 33	252	powershell.exe
Token: 34	252	powershell.exe
Token: 35	252	powershell.exe
Token: 36	252	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe
Token: SeUndockPrivilege	5068	powershell.exe
Token: SeManageVolumePrivilege	5068	powershell.exe
Token: 33	5068	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 5736	1836	default.dat.exe	89
PID 5736 wrote to memory of 4744	5736	default.dat.exe	90
PID 4744 wrote to memory of 3740	4744	cmd.exe	92
PID 5736 wrote to memory of 2668	5736	default.dat.exe	94
PID 2668 wrote to memory of 252	2668	cmd.exe	96
PID 5736 wrote to memory of 5436	5736	default.dat.exe	97
PID 5436 wrote to memory of 5068	5436	cmd.exe	99
PID 5736 wrote to memory of 4396	5736	default.dat.exe	100
PID 4396 wrote to memory of 4668	4396	cmd.exe	102
PID 5736 wrote to memory of 5332	5736	default.dat.exe	103
PID 5332 wrote to memory of 1932	5332	cmd.exe	105
PID 5736 wrote to memory of 4680	5736	default.dat.exe	106
PID 4680 wrote to memory of 1132	4680	cmd.exe	108
PID 5736 wrote to memory of 3824	5736	default.dat.exe	109
PID 3824 wrote to memory of 3736	3824	cmd.exe	111
PID 5736 wrote to memory of 432	5736	default.dat.exe	112
PID 432 wrote to memory of 2712	432	cmd.exe	114
PID 5736 wrote to memory of 1984	5736	default.dat.exe	115
PID 1984 wrote to memory of 3488	1984	cmd.exe	117
PID 5736 wrote to memory of 3228	5736	default.dat.exe	118
PID 3228 wrote to memory of 6088	3228	cmd.exe	120
PID 5736 wrote to memory of 5052	5736	default.dat.exe	121
PID 5052 wrote to memory of 5012	5052	cmd.exe	123
PID 5736 wrote to memory of 4792	5736	default.dat.exe	124
PID 4792 wrote to memory of 6104	4792	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\ceteqow'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\ceteqow'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact