6aae6365dd4ff712994562ae8356e0562d3f411675546f12d0d76aee668f6ecf

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FotosDaFormatura.bat
Size 1KB
Sample260502-wpzdlsds61
SHA256 6aae6365dd4ff712994562ae8356e0562d3f411675546f12d0d76aee668f6ecf
MD5 b11e615609c58750261f36dae971e9ef
SHA1 8d61278ad39dc37a965c318890247497f447f836
SHA512 57befbe1252254180072112745d025c33d0c2ab27cd19dd3a9ff81c4c0714eb653789b88425ff0f3b6647547e10ba70345ba9f6d7fbd217d1c91c1c4612a45f5
TLSH
T1613198297786D0D62C520536CCE3B459B578E286450D9D58B0EE40D45F1F8D8B1B9C1A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution ransomware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://blog.cobasi.com.br/wp-content/uploads/2020/06/cuidar-de-gato-capa.png

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	2524	powershell.exe
13	2524	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2524	powershell.exe
4208	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\party_cat.png"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
2876	timeout.exe
3464	timeout.exe
5440	timeout.exe
4620	timeout.exe
2988	timeout.exe
4964	timeout.exe
3436	timeout.exe
5576	timeout.exe
2024	timeout.exe
5764	timeout.exe
1652	timeout.exe
4988	timeout.exe
2852	timeout.exe
6052	timeout.exe
608	timeout.exe
4072	timeout.exe
5228	timeout.exe
732	timeout.exe
5956	timeout.exe
2716	timeout.exe
3100	timeout.exe
6084	timeout.exe
5284	timeout.exe
4944	timeout.exe
5088	timeout.exe
5336	timeout.exe
1132	timeout.exe
2996	timeout.exe
3604	timeout.exe
4400	timeout.exe
1512	timeout.exe
5264	timeout.exe
5988	timeout.exe
5768	timeout.exe
6004	timeout.exe
3984	timeout.exe
628	timeout.exe
4324	timeout.exe
1872	timeout.exe
2712	timeout.exe
5360	timeout.exe
3152	timeout.exe
4536	timeout.exe
652	timeout.exe
5464	timeout.exe
5632	timeout.exe
5236	timeout.exe
5576	timeout.exe
3156	timeout.exe
1980	timeout.exe
4420	timeout.exe
4432	timeout.exe
5220	timeout.exe
5936	timeout.exe
5656	timeout.exe
2380	timeout.exe
4332	timeout.exe
3056	timeout.exe
5256	timeout.exe
5096	timeout.exe
1776	timeout.exe
3796	timeout.exe
4236	timeout.exe
5204	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1896	notepad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2524	powershell.exe
2524	powershell.exe
4208	powershell.exe
4208	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4716	4724	cmd.exe	86
PID 4724 wrote to memory of 4824	4724	cmd.exe	87
PID 4724 wrote to memory of 2524	4724	cmd.exe	88
PID 4724 wrote to memory of 4208	4724	cmd.exe	89
PID 4208 wrote to memory of 6020	4208	powershell.exe	90
PID 6020 wrote to memory of 5908	6020	csc.exe	93
PID 4724 wrote to memory of 3604	4724	cmd.exe	95
PID 4724 wrote to memory of 1896	4724	cmd.exe	106
PID 4724 wrote to memory of 5548	4724	cmd.exe	107
PID 4724 wrote to memory of 512	4724	cmd.exe	108
PID 4724 wrote to memory of 1132	4724	cmd.exe	110
PID 4724 wrote to memory of 3156	4724	cmd.exe	112
PID 4724 wrote to memory of 2660	4724	cmd.exe	113
PID 4724 wrote to memory of 3264	4724	cmd.exe	114
PID 4724 wrote to memory of 4988	4724	cmd.exe	115
PID 4724 wrote to memory of 2844	4724	cmd.exe	116
PID 4724 wrote to memory of 992	4724	cmd.exe	117
PID 4724 wrote to memory of 732	4724	cmd.exe	118
PID 4724 wrote to memory of 5088	4724	cmd.exe	119
PID 4724 wrote to memory of 6004	4724	cmd.exe	120
PID 4724 wrote to memory of 5576	4724	cmd.exe	121
PID 4724 wrote to memory of 1196	4724	cmd.exe	122
PID 4724 wrote to memory of 2712	4724	cmd.exe	123
PID 4724 wrote to memory of 2996	4724	cmd.exe	124
PID 4724 wrote to memory of 2860	4724	cmd.exe	125
PID 4724 wrote to memory of 2024	4724	cmd.exe	126
PID 4724 wrote to memory of 4944	4724	cmd.exe	127
PID 4724 wrote to memory of 5452	4724	cmd.exe	128
PID 4724 wrote to memory of 5632	4724	cmd.exe	129
PID 4724 wrote to memory of 5456	4724	cmd.exe	130
PID 4724 wrote to memory of 608	4724	cmd.exe	131
PID 4724 wrote to memory of 5360	4724	cmd.exe	132
PID 4724 wrote to memory of 3388	4724	cmd.exe	133
PID 4724 wrote to memory of 808	4724	cmd.exe	134
PID 4724 wrote to memory of 3464	4724	cmd.exe	135
PID 4724 wrote to memory of 1412	4724	cmd.exe	136
PID 4724 wrote to memory of 4352	4724	cmd.exe	137
PID 4724 wrote to memory of 5096	4724	cmd.exe	138
PID 4724 wrote to memory of 4432	4724	cmd.exe	139
PID 4724 wrote to memory of 5972	4724	cmd.exe	140
PID 4724 wrote to memory of 1776	4724	cmd.exe	141
PID 4724 wrote to memory of 5440	4724	cmd.exe	142
PID 4724 wrote to memory of 3984	4724	cmd.exe	143
PID 4724 wrote to memory of 2672	4724	cmd.exe	144
PID 4724 wrote to memory of 5572	4724	cmd.exe	145
PID 4724 wrote to memory of 1980	4724	cmd.exe	146
PID 4724 wrote to memory of 5220	4724	cmd.exe	147
PID 4724 wrote to memory of 5936	4724	cmd.exe	148
PID 4724 wrote to memory of 2244	4724	cmd.exe	149
PID 4724 wrote to memory of 5556	4724	cmd.exe	150
PID 4724 wrote to memory of 1576	4724	cmd.exe	151
PID 4724 wrote to memory of 3796	4724	cmd.exe	152
PID 4724 wrote to memory of 5764	4724	cmd.exe	153
PID 4724 wrote to memory of 3152	4724	cmd.exe	154
PID 4724 wrote to memory of 628	4724	cmd.exe	156
PID 4724 wrote to memory of 4728	4724	cmd.exe	157
PID 4724 wrote to memory of 4936	4724	cmd.exe	158
PID 4724 wrote to memory of 2852	4724	cmd.exe	159
PID 4724 wrote to memory of 4964	4724	cmd.exe	160
PID 4724 wrote to memory of 4496	4724	cmd.exe	161
PID 4724 wrote to memory of 4324	4724	cmd.exe	162
PID 4724 wrote to memory of 5656	4724	cmd.exe	163
PID 4724 wrote to memory of 4800	4724	cmd.exe	164
PID 4724 wrote to memory of 4620	4724	cmd.exe	165

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FotosDaFormatura.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:4716
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object Net.WebClient).DownloadFile('https://blog.cobasi.com.br/wp-content/uploads/2020/06/cuidar-de-gato-capa.png', 'C:\Users\Admin\AppData\Local\Temp\party_cat.png')"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'; [Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\party_cat.png', 3)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gg2wn4ku\gg2wn4ku.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B10.tmp" "c:\Users\Admin\AppData\Local\Temp\gg2wn4ku\CSCA7B205B8868B4EFA9D29294759B47394.TMP"
      4⤵
      PID:5908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fatal.vbs"
  2⤵
  PID:3604
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Admin\AppData\Local\Temp\hacked.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1896
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5548
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:512
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1132
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3156
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2660
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3264
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4988
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2844
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:992
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:732
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5088
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6004
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5576
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1196
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2712
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2996
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2860
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2024
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4944
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5452
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5632
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5456
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:608
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5360
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3388
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:808
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3464
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1412
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4352
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5096
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5972
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1776
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5440
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3984
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2672
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5572
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1980
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5220
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5936
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2244
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5556
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1576
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3796
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5764
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3152
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:628
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4728
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4936
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2852
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4964
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4496
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4324
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5656
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4800
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4620
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4604
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4236
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4420
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4832
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4400
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3720
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5336
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5956
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1512
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2380
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3692
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2716
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2468
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2988
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5284
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4072
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1872
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5564
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4332
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5264
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1904
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:868
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3056
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4080
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1668
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2972
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6052
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3144
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3100
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4264
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3604
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:372
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2316
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2756
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5204
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5256
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4536
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5408
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3436
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2744
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5236
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1660
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3868
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5988
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4036
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4008
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1652
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5768
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:652
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1828
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:680
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1428
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5088
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5228
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5576
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1196
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2876
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6084
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5292
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3732
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2024
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4944
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5624
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5464
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5388
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4976
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 98b838528d143f8156c7ee6c9c54bea19071d610731a495f58486c8859bfa3f5
MD5 b0ae8be8963ead415d29adb34cc692c1
SHA1 4c56dbc5e572e540adc35e3e105dce153bd2020d
SHA512 8f0bd01fea865a98e6589ff354c0721a295c47b7fbc68323012c71e912ff4ce28bc7074d40dc450fb22c8234e4a434b0d44d1125a4a3091032e8974f7c3b9046
TLSH
T1EE11B633B38C8921CC86113A409DAC1132B283C781AECF9F6FC0C210A0BF984CB712A0
MD5 SHA1 SHA512 TLSH

Submit Download

RES3B10.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3B10.tmp
Size 1KB
SHA256 b55c63f241a67a0df9e18793626f1559804906faec205d0450566823f86de032
MD5 bea4ca98c6ed9b929c6881add623b85a
SHA1 ae03176bed3eceb08d53f33f1d54bbbf5ac8151b
SHA512 0b59864fa62ebf1578e7ad719a70c94f0924d9742abcd7b4b126c9737a7aa392de343e425ac034b7368a335746dfc1a0968797e1d0f4b5c204cd91238db93f34
TLSH
T1E121890483E84B1EF077573169F6176B9238FD64AFB2939B858082281C51604EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fp1ascvi.euu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fp1ascvi.euu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fatal.vbs

Path C:\Users\Admin\AppData\Local\Temp\fatal.vbs
Size 168B
SHA256 c154bd74b93218f0f1e7f554426ac12a8990ed23010dd60528e20747108382ac
MD5 8063821fa200e223150e9211d8b0ee49
SHA1 5c059229b9828e61782234f6d482186f034a1aa8
SHA512 3de4c014c83b2a6ee6dd4ff49aeaf582c5df00eafa6fe466490ba940cf61305ef81ea770cbb3eea9201136ec1e4349c4e6367a559c76c2a9b9c887be691927a5
TLSH
T188C0807E45DDF4401B54444115D05A436148D554120E8A30135B4B55B76DC90C8F5126
MD5 SHA1 SHA512 TLSH

Submit Download

gg2wn4ku.dll

Path C:\Users\Admin\AppData\Local\Temp\gg2wn4ku\gg2wn4ku.dll
Size 3KB
SHA256 2ba4b0396aab3c0c2fc1e9fb4a10b989668df85bb9c706d8c86a132c956c2935
MD5 7832d6fb5bc6eba271ba4fb4fcf0de26
SHA1 39497a25b46ec78250e230624c79380672de756f
SHA512 cb5ffbd67d0abfcec3571c5fc22fac38e0022a034d5feb5a80bfc87793e51864dfdeabab6dbac7164943b0df0bf52296fe50077a105fd088a62c419ca4c8cfba
TLSH
T12951CC16A3E84A6BE8670774ADF387533774F8249F73A35D4980522C5C617681E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

hacked.txt

Path C:\Users\Admin\AppData\Local\Temp\hacked.txt
Size 66B
SHA256 7c421647fb85fc764dea2454967dbefb74b36ac6cb40d04e6d62e2612e479c21
MD5 7d5eed5dce095b7a46e0843715d7136e
SHA1 757b3a86612eafaa90d278a51e6f29b252c9513a
SHA512 107b0cbd3315e72eb0789f45ab89ed4f18856d2854153e943e2c30a3c74993359be832d6bb73ffebea0b8fc42cea3ff72b4510cee0d74dcbd10ba8fba239917e
TLSH
T1A0A002C441104D9B1EAFE33B61A5C4D07507724BBA46551923BD0EB99A14861D050E33
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA7B205B8868B4EFA9D29294759B47394.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gg2wn4ku\CSCA7B205B8868B4EFA9D29294759B47394.TMP
Size 652B
SHA256 b67a9e5bacdb3f175a419e4acb74e27302a14cf5f2f0273413108aa623c40ebd
MD5 42d9065ed9a89c42184fe63379ad848b
SHA1 a3bc4890b9dde9daeff3890f6947501ed2a849d0
SHA512 96b19ce0365fee63872f79e8e2c2ff1c2a23136b8fe9205c6ffcabf0323b984533d8f1f6395c6439cd2226d7da06dcf7407ab78a0e6473aea77ef3a0c09658af
TLSH
T17AF05E09A3F8120EF0F34B30BDF6436391A9FC65DE32A3ED1481131928649109A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gg2wn4ku.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gg2wn4ku\gg2wn4ku.0.cs
Size 234B
SHA256 d17a04b258a3f4d6c07a25e77ca59c310f7030062eceec328eea1f0d2047f024
MD5 b5bc6f9136dce704041d49aebb0b4fa1
SHA1 9b2966bebcbd68d70a40f85682f148d5c6bbb8bb
SHA512 e828bc3fae857240e623fd28c2524b56c8d294ac2bf45a24869dc6786a7cd2d5bd2299546a2a9b4b286f96b91e48c2d8f185a3d508808edf06a4da0e54b02c6a
TLSH
T1A2D0A734B747E6F94847090F4C83A0B97737939873E7791168EA6114CF9B8082636625
MD5 SHA1 SHA512 TLSH

Submit Download

gg2wn4ku.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gg2wn4ku\gg2wn4ku.cmdline
Size 369B
SHA256 48cdc1225e9832aa830ceab682bf92672424b4719913f39913081728266873e1
MD5 798933ccceeea1d45f5ac5cb93b0ee24
SHA1 7e597b661ee150537f9260c07d039657a0c8b2e2
SHA512 3f21925caec8ad5632f39bd1fc11a3fdf99f0809b298c6f0ca8032cbf301cadb176ff300d7d92322f1adffe17a8d32271a7eac64d0c002c62e71afc1fd58a400
TLSH
T1F2E0682A424BCA7D01DA6407616FC8FC82720A5329423F8CB048884FD01710027E1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/512-59-0x0000020F02610000-0x0000020F0267B000-memory.dmp

Download

memory/608-84-0x000001EE99040000-0x000001EE990AB000-memory.dmp

Download

memory/628-113-0x0000029C1A3A0000-0x0000029C1A40B000-memory.dmp

Download

memory/732-69-0x000001EDA4670000-0x000001EDA46DB000-memory.dmp

Download

memory/808-88-0x000002154BA10000-0x000002154BA7B000-memory.dmp

Download

memory/992-68-0x0000024403A40000-0x0000024403AAB000-memory.dmp

Download

memory/1132-61-0x000001C7CCA00000-0x000001C7CCA6B000-memory.dmp

Download

memory/1196-74-0x0000018180BA0000-0x0000018180C0B000-memory.dmp

Download

memory/1412-90-0x00000219D2C80000-0x00000219D2CEB000-memory.dmp

Download

memory/1576-109-0x0000011BE3980000-0x0000011BE39EB000-memory.dmp

Download

memory/1776-97-0x0000021A0B410000-0x0000021A0B47B000-memory.dmp

Download

memory/1896-57-0x0000017B04140000-0x0000017B041AB000-memory.dmp

Download

memory/1980-102-0x000001BD68860000-0x000001BD688CB000-memory.dmp

Download

memory/2024-79-0x0000021871CA0000-0x0000021871D0B000-memory.dmp

Download

memory/2244-106-0x000001D709DA0000-0x000001D709E0B000-memory.dmp

Download

memory/2524-1-0x000001EA63410000-0x000001EA63420000-memory.dmp

Download

memory/2524-2-0x000001EA4B1B0000-0x000001EA4B1D2000-memory.dmp

Download

memory/2524-13-0x000001EA49340000-0x000001EA4934C000-memory.dmp

Download

memory/2524-14-0x000001EA63230000-0x000001EA6329B000-memory.dmp

Download

memory/2660-63-0x0000019CA0640000-0x0000019CA06AB000-memory.dmp

Download

memory/2672-100-0x000001DFF9910000-0x000001DFF997B000-memory.dmp

Download

memory/2712-75-0x000001E495840000-0x000001E4958AB000-memory.dmp

Download

memory/2844-67-0x00000208D09A0000-0x00000208D0A0B000-memory.dmp

Download

memory/2852-117-0x000001B581890000-0x000001B5818FB000-memory.dmp

Download

memory/2860-77-0x0000023867DF0000-0x0000023867E5B000-memory.dmp

Download

memory/2996-76-0x000001D4A89F0000-0x000001D4A8A5B000-memory.dmp

Download

memory/3152-112-0x0000022B5C150000-0x0000022B5C1BB000-memory.dmp

Download

memory/3156-62-0x00000243655F0000-0x000002436565B000-memory.dmp

Download

memory/3264-64-0x000001B62AA50000-0x000001B62AABB000-memory.dmp

Download

memory/3388-87-0x0000022D6AC80000-0x0000022D6ACEB000-memory.dmp

Download

memory/3464-89-0x0000025320FB0000-0x000002532101B000-memory.dmp

Download

memory/3604-50-0x000001BAABA60000-0x000001BAABA6C000-memory.dmp

Download

memory/3604-51-0x000001BAAF140000-0x000001BAAF1AB000-memory.dmp

Download

memory/3796-110-0x000002B3C42E0000-0x000002B3C434B000-memory.dmp

Download

memory/3984-99-0x0000026A556A0000-0x0000026A5570B000-memory.dmp

Download

memory/4208-40-0x00000204EAD80000-0x00000204EAD88000-memory.dmp

Download

memory/4208-42-0x00000204D2AF0000-0x00000204D2AFC000-memory.dmp

Download

memory/4208-16-0x00000204EAE20000-0x00000204EAE30000-memory.dmp

Download

memory/4208-43-0x00000204EAF30000-0x00000204EAF9B000-memory.dmp

Download

memory/4208-17-0x00000204EAE20000-0x00000204EAE30000-memory.dmp

Download

memory/4324-121-0x0000020A62560000-0x0000020A625CB000-memory.dmp

Download

memory/4352-92-0x000002991CC60000-0x000002991CCCB000-memory.dmp

Download

memory/4432-94-0x0000025AEA780000-0x0000025AEA7EB000-memory.dmp

Download

memory/4496-119-0x0000022EE2D20000-0x0000022EE2D8B000-memory.dmp

Download

memory/4724-56-0x0000017D1BA70000-0x0000017D1BADB000-memory.dmp

Download

memory/4728-114-0x000001BB55000000-0x000001BB5506B000-memory.dmp

Download

memory/4824-0-0x000001EACECB0000-0x000001EACED1B000-memory.dmp

Download

memory/4936-116-0x0000017ACBE60000-0x0000017ACBECB000-memory.dmp

Download

memory/4944-80-0x0000026F62D30000-0x0000026F62D9B000-memory.dmp

Download

memory/4964-118-0x0000020A92AD0000-0x0000020A92B3B000-memory.dmp

Download

memory/4988-65-0x00000183EFB70000-0x00000183EFBDB000-memory.dmp

Download

memory/5088-70-0x0000023CE0070000-0x0000023CE00DB000-memory.dmp

Download

memory/5096-93-0x0000016E1AA60000-0x0000016E1AACB000-memory.dmp

Download

memory/5220-104-0x000002C33F950000-0x000002C33F9BB000-memory.dmp

Download

memory/5360-86-0x000001C43BC00000-0x000001C43BC6B000-memory.dmp

Download

memory/5440-98-0x000001629F940000-0x000001629F9AB000-memory.dmp

Download

memory/5452-81-0x00000167C7B40000-0x00000167C7BAB000-memory.dmp

Download

memory/5456-83-0x0000023B82990000-0x0000023B829FB000-memory.dmp

Download

memory/5548-58-0x00000207D0090000-0x00000207D00FB000-memory.dmp

Download

memory/5556-107-0x0000014AB8030000-0x0000014AB809B000-memory.dmp

Download

memory/5572-101-0x00000235D1AE0000-0x00000235D1B4B000-memory.dmp

Download

memory/5576-73-0x00000287C2880000-0x00000287C28EB000-memory.dmp

Download

memory/5632-82-0x000001D9F9300000-0x000001D9F936B000-memory.dmp

Download

memory/5764-111-0x0000020635B30000-0x0000020635B9B000-memory.dmp

Download

memory/5908-35-0x00000291D2B70000-0x00000291D2B7C000-memory.dmp

Download

memory/5936-105-0x00000227626E0000-0x000002276274B000-memory.dmp

Download

memory/5972-95-0x000002694A4F0000-0x000002694A55B000-memory.dmp

Download

memory/6004-71-0x0000021560820000-0x000002156088B000-memory.dmp

Download

memory/6020-38-0x000002959D260000-0x000002959D26C000-memory.dmp

Download