68a80568fa5d934867c608dcd40eff254637a6921157da5867d362e03d84371e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260809-lwvznavfpg
SHA256 68a80568fa5d934867c608dcd40eff254637a6921157da5867d362e03d84371e
MD5 7297c3c76d0419914bc607861ca953a0
SHA1 af5d8293b53a913381172b62131e92a9ca5d065e
SHA512 5d9fcb4444ec616aec521dc5b905f42b2fb80430ff5548f23de5679ac2ce2d2962f8193e8d9b5bb8749202066e2b414dba129ec4276ba0a0f6fe0fbf0b5abbf5
SSDEEP 393216:PGmY/T2VnDNQ67Yu6Q3AXMCHWUjXcuI3/PGTAI:PGTTGnpz0u6/XMb8sH/O7
TLSH
T10AE63308AAC003FAE6A3517C9AE10064E575BD935371CADFC7E05B6A9E171F09D3EA13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2820	powershell.exe
1544	powershell.exe
1812	powershell.exe
5764	powershell.exe
3996	powershell.exe
2592	powershell.exe
4388	powershell.exe
572	powershell.exe
3076	powershell.exe
1496	powershell.exe
4460	powershell.exe
3536	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe
5988	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
932	cmd.exe
3440	cmd.exe
2724	cmd.exe
3460	cmd.exe
3288	cmd.exe
1300	cmd.exe
5212	cmd.exe
4912	cmd.exe
4300	cmd.exe
4696	cmd.exe
1328	cmd.exe
4664	cmd.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5988	composer.dat.exe
5988	composer.dat.exe
572	powershell.exe
572	powershell.exe
2820	powershell.exe
2820	powershell.exe
3076	powershell.exe
3076	powershell.exe
1544	powershell.exe
1544	powershell.exe
1496	powershell.exe
1496	powershell.exe
1812	powershell.exe
1812	powershell.exe
4460	powershell.exe
4460	powershell.exe
5764	powershell.exe
5764	powershell.exe
3536	powershell.exe
3536	powershell.exe
3996	powershell.exe
3996	powershell.exe
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	composer.dat.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeIncreaseQuotaPrivilege	572	powershell.exe
Token: SeSecurityPrivilege	572	powershell.exe
Token: SeTakeOwnershipPrivilege	572	powershell.exe
Token: SeLoadDriverPrivilege	572	powershell.exe
Token: SeSystemProfilePrivilege	572	powershell.exe
Token: SeSystemtimePrivilege	572	powershell.exe
Token: SeProfSingleProcessPrivilege	572	powershell.exe
Token: SeIncBasePriorityPrivilege	572	powershell.exe
Token: SeCreatePagefilePrivilege	572	powershell.exe
Token: SeBackupPrivilege	572	powershell.exe
Token: SeRestorePrivilege	572	powershell.exe
Token: SeShutdownPrivilege	572	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeSystemEnvironmentPrivilege	572	powershell.exe
Token: SeRemoteShutdownPrivilege	572	powershell.exe
Token: SeUndockPrivilege	572	powershell.exe
Token: SeManageVolumePrivilege	572	powershell.exe
Token: 33	572	powershell.exe
Token: 34	572	powershell.exe
Token: 35	572	powershell.exe
Token: 36	572	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeIncreaseQuotaPrivilege	2820	powershell.exe
Token: SeSecurityPrivilege	2820	powershell.exe
Token: SeTakeOwnershipPrivilege	2820	powershell.exe
Token: SeLoadDriverPrivilege	2820	powershell.exe
Token: SeSystemProfilePrivilege	2820	powershell.exe
Token: SeSystemtimePrivilege	2820	powershell.exe
Token: SeProfSingleProcessPrivilege	2820	powershell.exe
Token: SeIncBasePriorityPrivilege	2820	powershell.exe
Token: SeCreatePagefilePrivilege	2820	powershell.exe
Token: SeBackupPrivilege	2820	powershell.exe
Token: SeRestorePrivilege	2820	powershell.exe
Token: SeShutdownPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeSystemEnvironmentPrivilege	2820	powershell.exe
Token: SeRemoteShutdownPrivilege	2820	powershell.exe
Token: SeUndockPrivilege	2820	powershell.exe
Token: SeManageVolumePrivilege	2820	powershell.exe
Token: 33	2820	powershell.exe
Token: 34	2820	powershell.exe
Token: 35	2820	powershell.exe
Token: 36	2820	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeIncreaseQuotaPrivilege	3076	powershell.exe
Token: SeSecurityPrivilege	3076	powershell.exe
Token: SeTakeOwnershipPrivilege	3076	powershell.exe
Token: SeLoadDriverPrivilege	3076	powershell.exe
Token: SeSystemProfilePrivilege	3076	powershell.exe
Token: SeSystemtimePrivilege	3076	powershell.exe
Token: SeProfSingleProcessPrivilege	3076	powershell.exe
Token: SeIncBasePriorityPrivilege	3076	powershell.exe
Token: SeCreatePagefilePrivilege	3076	powershell.exe
Token: SeBackupPrivilege	3076	powershell.exe
Token: SeRestorePrivilege	3076	powershell.exe
Token: SeShutdownPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeSystemEnvironmentPrivilege	3076	powershell.exe
Token: SeRemoteShutdownPrivilege	3076	powershell.exe
Token: SeUndockPrivilege	3076	powershell.exe
Token: SeManageVolumePrivilege	3076	powershell.exe
Token: 33	3076	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 5988	4156	composer.dat.exe	89
PID 5988 wrote to memory of 3440	5988	composer.dat.exe	90
PID 3440 wrote to memory of 572	3440	cmd.exe	92
PID 5988 wrote to memory of 2724	5988	composer.dat.exe	94
PID 2724 wrote to memory of 2820	2724	cmd.exe	96
PID 5988 wrote to memory of 3460	5988	composer.dat.exe	97
PID 3460 wrote to memory of 3076	3460	cmd.exe	99
PID 5988 wrote to memory of 4696	5988	composer.dat.exe	100
PID 4696 wrote to memory of 1544	4696	cmd.exe	102
PID 5988 wrote to memory of 1328	5988	composer.dat.exe	103
PID 1328 wrote to memory of 1496	1328	cmd.exe	105
PID 5988 wrote to memory of 3288	5988	composer.dat.exe	106
PID 3288 wrote to memory of 1812	3288	cmd.exe	108
PID 5988 wrote to memory of 1300	5988	composer.dat.exe	109
PID 1300 wrote to memory of 4460	1300	cmd.exe	111
PID 5988 wrote to memory of 5212	5988	composer.dat.exe	112
PID 5212 wrote to memory of 5764	5212	cmd.exe	114
PID 5988 wrote to memory of 4912	5988	composer.dat.exe	115
PID 4912 wrote to memory of 3536	4912	cmd.exe	117
PID 5988 wrote to memory of 4300	5988	composer.dat.exe	118
PID 4300 wrote to memory of 3996	4300	cmd.exe	120
PID 5988 wrote to memory of 4664	5988	composer.dat.exe	121
PID 4664 wrote to memory of 2592	4664	cmd.exe	123
PID 5988 wrote to memory of 932	5988	composer.dat.exe	125
PID 932 wrote to memory of 4388	932	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact