f7a0fd41e0651ca37a99c1e9df3f02bb38a7d17d842a9c7f5a115d5994e1de9b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.6MB
Sample260809-my7a5sweqc
SHA256 f7a0fd41e0651ca37a99c1e9df3f02bb38a7d17d842a9c7f5a115d5994e1de9b
MD5 901181331d42ffabb2b57c001e672ac6
SHA1 741e58132d727469c88d2358a0444e4016d993c3
SHA512 70e69556ff19c175618f9c07daa59da213f6aa108bd437fca9b86819c016ac82194ce61641efe5923b5c83b484b44a907ccd5827d32a343b25baf91455fc38da
SSDEEP 393216:+Gmz7RsI9PXLsvCDy0pnK1j3EXMCHWUjVcuI3/PGTAI:+GW7Rj9feA/0EXMb8iH/O7
TLSH
T156E6335CABC052BFEB73657C9DE202E0D268B82697B1C5DB476C83926D133E0493E716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe
3432	powershell.exe
712	powershell.exe
6068	powershell.exe
3176	powershell.exe
5312	powershell.exe
5340	powershell.exe
1900	powershell.exe
1480	powershell.exe
2572	powershell.exe
3172	powershell.exe
4864	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe
1284	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1844	cmd.exe
1532	cmd.exe
1884	cmd.exe
3808	cmd.exe
2556	cmd.exe
4472	cmd.exe
3952	cmd.exe
3140	cmd.exe
3376	cmd.exe
4932	cmd.exe
4528	cmd.exe
5796	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1284	composer.dat.exe
1284	composer.dat.exe
1900	powershell.exe
1900	powershell.exe
1972	powershell.exe
1972	powershell.exe
1972	powershell.exe
3432	powershell.exe
3432	powershell.exe
3432	powershell.exe
1480	powershell.exe
1480	powershell.exe
1480	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe
2572	powershell.exe
2572	powershell.exe
2572	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
3176	powershell.exe
3176	powershell.exe
3176	powershell.exe
5312	powershell.exe
5312	powershell.exe
5312	powershell.exe
5340	powershell.exe
5340	powershell.exe
5340	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	composer.dat.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeIncreaseQuotaPrivilege	1900	powershell.exe
Token: SeSecurityPrivilege	1900	powershell.exe
Token: SeTakeOwnershipPrivilege	1900	powershell.exe
Token: SeLoadDriverPrivilege	1900	powershell.exe
Token: SeSystemProfilePrivilege	1900	powershell.exe
Token: SeSystemtimePrivilege	1900	powershell.exe
Token: SeProfSingleProcessPrivilege	1900	powershell.exe
Token: SeIncBasePriorityPrivilege	1900	powershell.exe
Token: SeCreatePagefilePrivilege	1900	powershell.exe
Token: SeBackupPrivilege	1900	powershell.exe
Token: SeRestorePrivilege	1900	powershell.exe
Token: SeShutdownPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeSystemEnvironmentPrivilege	1900	powershell.exe
Token: SeRemoteShutdownPrivilege	1900	powershell.exe
Token: SeUndockPrivilege	1900	powershell.exe
Token: SeManageVolumePrivilege	1900	powershell.exe
Token: 33	1900	powershell.exe
Token: 34	1900	powershell.exe
Token: 35	1900	powershell.exe
Token: 36	1900	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeIncreaseQuotaPrivilege	1972	powershell.exe
Token: SeSecurityPrivilege	1972	powershell.exe
Token: SeTakeOwnershipPrivilege	1972	powershell.exe
Token: SeLoadDriverPrivilege	1972	powershell.exe
Token: SeSystemProfilePrivilege	1972	powershell.exe
Token: SeSystemtimePrivilege	1972	powershell.exe
Token: SeProfSingleProcessPrivilege	1972	powershell.exe
Token: SeIncBasePriorityPrivilege	1972	powershell.exe
Token: SeCreatePagefilePrivilege	1972	powershell.exe
Token: SeBackupPrivilege	1972	powershell.exe
Token: SeRestorePrivilege	1972	powershell.exe
Token: SeShutdownPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeSystemEnvironmentPrivilege	1972	powershell.exe
Token: SeRemoteShutdownPrivilege	1972	powershell.exe
Token: SeUndockPrivilege	1972	powershell.exe
Token: SeManageVolumePrivilege	1972	powershell.exe
Token: 33	1972	powershell.exe
Token: 34	1972	powershell.exe
Token: 35	1972	powershell.exe
Token: 36	1972	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeIncreaseQuotaPrivilege	3432	powershell.exe
Token: SeSecurityPrivilege	3432	powershell.exe
Token: SeTakeOwnershipPrivilege	3432	powershell.exe
Token: SeLoadDriverPrivilege	3432	powershell.exe
Token: SeSystemProfilePrivilege	3432	powershell.exe
Token: SeSystemtimePrivilege	3432	powershell.exe
Token: SeProfSingleProcessPrivilege	3432	powershell.exe
Token: SeIncBasePriorityPrivilege	3432	powershell.exe
Token: SeCreatePagefilePrivilege	3432	powershell.exe
Token: SeBackupPrivilege	3432	powershell.exe
Token: SeRestorePrivilege	3432	powershell.exe
Token: SeShutdownPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeSystemEnvironmentPrivilege	3432	powershell.exe
Token: SeRemoteShutdownPrivilege	3432	powershell.exe
Token: SeUndockPrivilege	3432	powershell.exe
Token: SeManageVolumePrivilege	3432	powershell.exe
Token: 33	3432	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1284	4616	composer.dat.exe	89
PID 1284 wrote to memory of 3952	1284	composer.dat.exe	90
PID 3952 wrote to memory of 1900	3952	cmd.exe	92
PID 1284 wrote to memory of 1844	1284	composer.dat.exe	94
PID 1844 wrote to memory of 1972	1844	cmd.exe	96
PID 1284 wrote to memory of 3140	1284	composer.dat.exe	97
PID 3140 wrote to memory of 3432	3140	cmd.exe	99
PID 1284 wrote to memory of 1532	1284	composer.dat.exe	100
PID 1532 wrote to memory of 1480	1532	cmd.exe	102
PID 1284 wrote to memory of 1884	1284	composer.dat.exe	103
PID 1884 wrote to memory of 712	1884	cmd.exe	105
PID 1284 wrote to memory of 3808	1284	composer.dat.exe	106
PID 3808 wrote to memory of 2572	3808	cmd.exe	108
PID 1284 wrote to memory of 2556	1284	composer.dat.exe	109
PID 2556 wrote to memory of 3172	2556	cmd.exe	111
PID 1284 wrote to memory of 4472	1284	composer.dat.exe	112
PID 4472 wrote to memory of 6068	4472	cmd.exe	114
PID 1284 wrote to memory of 3376	1284	composer.dat.exe	115
PID 3376 wrote to memory of 3176	3376	cmd.exe	117
PID 1284 wrote to memory of 4932	1284	composer.dat.exe	118
PID 4932 wrote to memory of 5312	4932	cmd.exe	120
PID 1284 wrote to memory of 4528	1284	composer.dat.exe	121
PID 4528 wrote to memory of 5340	4528	cmd.exe	123
PID 1284 wrote to memory of 5796	1284	composer.dat.exe	125
PID 5796 wrote to memory of 4864	5796	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact