7341fa7b28bdc411c4f73c171c036cf5cdd57b7fcd2b006231ac92c324a829fe

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.7MB
Sample260731-tbs9bsch74
SHA256 7341fa7b28bdc411c4f73c171c036cf5cdd57b7fcd2b006231ac92c324a829fe
MD5 16933fd1b134aa8c14a565df666ae354
SHA1 d476f801a5990b26053a220597b883eae8a3bfa5
SHA512 436a80fe5d4552806982d546dc092fee2739242880c208ff45ccf1de5bbb6f94d90c0450aaa717b87a81b8698b7a2ef5d80fa0fbea49d5016da4a307ff9267bb
SSDEEP 393216:drSxQ+EyxQ7V2ae3PTZzXMCHWUjlcuI3/PGTAI:dzXyxk2aefTZzXMb8SH/O7
TLSH
T114E6334C9BE002BEF5639039EEA265D0F7A4FC521331C9EB17AC83A6AD535F0593D216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5268	powershell.exe
1140	powershell.exe
5936	powershell.exe
2744	powershell.exe
1212	powershell.exe
876	powershell.exe
5756	powershell.exe
1944	powershell.exe
4444	powershell.exe
6068	powershell.exe
4488	powershell.exe
704	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe
2564	default.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3140	cmd.exe
2556	cmd.exe
2740	cmd.exe
1152	cmd.exe
4680	cmd.exe
5796	cmd.exe
3684	cmd.exe
6020	cmd.exe
4760	cmd.exe
4084	cmd.exe
2028	cmd.exe
4304	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2564	default.dat.exe
2564	default.dat.exe
1212	powershell.exe
1212	powershell.exe
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
876	powershell.exe
876	powershell.exe
876	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
5268	powershell.exe
5268	powershell.exe
5268	powershell.exe
5756	powershell.exe
5756	powershell.exe
5756	powershell.exe
1944	powershell.exe
1944	powershell.exe
1944	powershell.exe
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe
5936	powershell.exe
5936	powershell.exe
5936	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	default.dat.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1212	powershell.exe
Token: SeSecurityPrivilege	1212	powershell.exe
Token: SeTakeOwnershipPrivilege	1212	powershell.exe
Token: SeLoadDriverPrivilege	1212	powershell.exe
Token: SeSystemProfilePrivilege	1212	powershell.exe
Token: SeSystemtimePrivilege	1212	powershell.exe
Token: SeProfSingleProcessPrivilege	1212	powershell.exe
Token: SeIncBasePriorityPrivilege	1212	powershell.exe
Token: SeCreatePagefilePrivilege	1212	powershell.exe
Token: SeBackupPrivilege	1212	powershell.exe
Token: SeRestorePrivilege	1212	powershell.exe
Token: SeShutdownPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeSystemEnvironmentPrivilege	1212	powershell.exe
Token: SeRemoteShutdownPrivilege	1212	powershell.exe
Token: SeUndockPrivilege	1212	powershell.exe
Token: SeManageVolumePrivilege	1212	powershell.exe
Token: 33	1212	powershell.exe
Token: 34	1212	powershell.exe
Token: 35	1212	powershell.exe
Token: 36	1212	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeIncreaseQuotaPrivilege	6068	powershell.exe
Token: SeSecurityPrivilege	6068	powershell.exe
Token: SeTakeOwnershipPrivilege	6068	powershell.exe
Token: SeLoadDriverPrivilege	6068	powershell.exe
Token: SeSystemProfilePrivilege	6068	powershell.exe
Token: SeSystemtimePrivilege	6068	powershell.exe
Token: SeProfSingleProcessPrivilege	6068	powershell.exe
Token: SeIncBasePriorityPrivilege	6068	powershell.exe
Token: SeCreatePagefilePrivilege	6068	powershell.exe
Token: SeBackupPrivilege	6068	powershell.exe
Token: SeRestorePrivilege	6068	powershell.exe
Token: SeShutdownPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeSystemEnvironmentPrivilege	6068	powershell.exe
Token: SeRemoteShutdownPrivilege	6068	powershell.exe
Token: SeUndockPrivilege	6068	powershell.exe
Token: SeManageVolumePrivilege	6068	powershell.exe
Token: 33	6068	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2564	1172	default.dat.exe	89
PID 2564 wrote to memory of 2028	2564	default.dat.exe	90
PID 2028 wrote to memory of 1212	2028	cmd.exe	92
PID 2564 wrote to memory of 5796	2564	default.dat.exe	94
PID 5796 wrote to memory of 4444	5796	cmd.exe	96
PID 2564 wrote to memory of 3684	2564	default.dat.exe	97
PID 3684 wrote to memory of 6068	3684	cmd.exe	99
PID 2564 wrote to memory of 4304	2564	default.dat.exe	100
PID 4304 wrote to memory of 876	4304	cmd.exe	102
PID 2564 wrote to memory of 3140	2564	default.dat.exe	103
PID 3140 wrote to memory of 4488	3140	cmd.exe	105
PID 2564 wrote to memory of 2556	2564	default.dat.exe	106
PID 2556 wrote to memory of 704	2556	cmd.exe	108
PID 2564 wrote to memory of 2740	2564	default.dat.exe	109
PID 2740 wrote to memory of 5268	2740	cmd.exe	111
PID 2564 wrote to memory of 6020	2564	default.dat.exe	112
PID 6020 wrote to memory of 5756	6020	cmd.exe	114
PID 2564 wrote to memory of 4760	2564	default.dat.exe	115
PID 4760 wrote to memory of 1944	4760	cmd.exe	117
PID 2564 wrote to memory of 1152	2564	default.dat.exe	118
PID 1152 wrote to memory of 1140	1152	cmd.exe	120
PID 2564 wrote to memory of 4680	2564	default.dat.exe	121
PID 4680 wrote to memory of 5936	4680	cmd.exe	123
PID 2564 wrote to memory of 4084	2564	default.dat.exe	124
PID 4084 wrote to memory of 2744	4084	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\ceteqow'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\ceteqow'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact