6aae6365dd4ff712994562ae8356e0562d3f411675546f12d0d76aee668f6ecf

Analysis

max time kernel
150s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FotosDaFormatura.bat
Size 1KB
Sample260502-wpzdlsds61
SHA256 6aae6365dd4ff712994562ae8356e0562d3f411675546f12d0d76aee668f6ecf
MD5 b11e615609c58750261f36dae971e9ef
SHA1 8d61278ad39dc37a965c318890247497f447f836
SHA512 57befbe1252254180072112745d025c33d0c2ab27cd19dd3a9ff81c4c0714eb653789b88425ff0f3b6647547e10ba70345ba9f6d7fbd217d1c91c1c4612a45f5
TLSH
T1613198297786D0D62C520536CCE3B459B578E286450D9D58B0EE40D45F1F8D8B1B9C1A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution ransomware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://blog.cobasi.com.br/wp-content/uploads/2020/06/cuidar-de-gato-capa.png

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4996	powershell.exe
3	4996	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe
3276	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\party_cat.png"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
5780	timeout.exe
2880	timeout.exe
2816	timeout.exe
1168	timeout.exe
6132	timeout.exe
3332	timeout.exe
1780	timeout.exe
112	timeout.exe
5804	timeout.exe
2828	timeout.exe
1464	timeout.exe
3688	timeout.exe
1912	timeout.exe
3824	timeout.exe
2516	timeout.exe
3612	timeout.exe
772	timeout.exe
3884	timeout.exe
5660	timeout.exe
944	timeout.exe
1432	timeout.exe
4860	timeout.exe
2792	timeout.exe
3272	timeout.exe
3236	timeout.exe
3692	timeout.exe
5552	timeout.exe
1232	timeout.exe
2192	timeout.exe
6136	timeout.exe
4800	timeout.exe
4396	timeout.exe
3940	timeout.exe
5888	timeout.exe
2940	timeout.exe
4328	timeout.exe
5048	timeout.exe
484	timeout.exe
612	timeout.exe
1944	timeout.exe
5476	timeout.exe
4728	timeout.exe
5348	timeout.exe
3752	timeout.exe
5872	timeout.exe
712	timeout.exe
3112	timeout.exe
5788	timeout.exe
4932	timeout.exe
6096	timeout.exe
1804	timeout.exe
5784	timeout.exe
2464	timeout.exe
4440	timeout.exe
1448	timeout.exe
3992	timeout.exe
3068	timeout.exe
5064	timeout.exe
1180	timeout.exe
6024	timeout.exe
1684	timeout.exe
5188	timeout.exe
1800	timeout.exe
4420	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
560	notepad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4996	powershell.exe
4996	powershell.exe
3276	powershell.exe
3276	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4784	4128	cmd.exe	79
PID 4128 wrote to memory of 1876	4128	cmd.exe	80
PID 4128 wrote to memory of 4996	4128	cmd.exe	81
PID 4128 wrote to memory of 3276	4128	cmd.exe	82
PID 3276 wrote to memory of 3228	3276	powershell.exe	83
PID 3228 wrote to memory of 1872	3228	csc.exe	84
PID 4128 wrote to memory of 3316	4128	cmd.exe	85
PID 4128 wrote to memory of 560	4128	cmd.exe	86
PID 4128 wrote to memory of 3992	4128	cmd.exe	87
PID 4128 wrote to memory of 3968	4128	cmd.exe	88
PID 4128 wrote to memory of 3752	4128	cmd.exe	89
PID 4128 wrote to memory of 1396	4128	cmd.exe	90
PID 4128 wrote to memory of 6092	4128	cmd.exe	91
PID 4128 wrote to memory of 5872	4128	cmd.exe	92
PID 4128 wrote to memory of 4348	4128	cmd.exe	93
PID 4128 wrote to memory of 5132	4128	cmd.exe	94
PID 4128 wrote to memory of 2516	4128	cmd.exe	95
PID 4128 wrote to memory of 6004	4128	cmd.exe	96
PID 4128 wrote to memory of 712	4128	cmd.exe	97
PID 4128 wrote to memory of 6100	4128	cmd.exe	98
PID 4128 wrote to memory of 2792	4128	cmd.exe	99
PID 4128 wrote to memory of 4440	4128	cmd.exe	100
PID 4128 wrote to memory of 5932	4128	cmd.exe	101
PID 4128 wrote to memory of 2828	4128	cmd.exe	102
PID 4128 wrote to memory of 5972	4128	cmd.exe	103
PID 4128 wrote to memory of 5780	4128	cmd.exe	104
PID 4128 wrote to memory of 5400	4128	cmd.exe	105
PID 4128 wrote to memory of 2108	4128	cmd.exe	106
PID 4128 wrote to memory of 2472	4128	cmd.exe	107
PID 4128 wrote to memory of 4448	4128	cmd.exe	108
PID 4128 wrote to memory of 3612	4128	cmd.exe	109
PID 4128 wrote to memory of 2224	4128	cmd.exe	110
PID 4128 wrote to memory of 6096	4128	cmd.exe	111
PID 4128 wrote to memory of 1800	4128	cmd.exe	112
PID 4128 wrote to memory of 1804	4128	cmd.exe	113
PID 4128 wrote to memory of 772	4128	cmd.exe	114
PID 4128 wrote to memory of 5808	4128	cmd.exe	115
PID 4128 wrote to memory of 6132	4128	cmd.exe	116
PID 4128 wrote to memory of 6024	4128	cmd.exe	117
PID 4128 wrote to memory of 3884	4128	cmd.exe	118
PID 4128 wrote to memory of 4396	4128	cmd.exe	119
PID 4128 wrote to memory of 484	4128	cmd.exe	120
PID 4128 wrote to memory of 2192	4128	cmd.exe	121
PID 4128 wrote to memory of 5548	4128	cmd.exe	122
PID 4128 wrote to memory of 1464	4128	cmd.exe	123
PID 4128 wrote to memory of 612	4128	cmd.exe	124
PID 4128 wrote to memory of 3688	4128	cmd.exe	125
PID 4128 wrote to memory of 5264	4128	cmd.exe	126
PID 4128 wrote to memory of 1912	4128	cmd.exe	127
PID 4128 wrote to memory of 568	4128	cmd.exe	128
PID 4128 wrote to memory of 5660	4128	cmd.exe	129
PID 4128 wrote to memory of 5552	4128	cmd.exe	130
PID 4128 wrote to memory of 4524	4128	cmd.exe	131
PID 4128 wrote to memory of 944	4128	cmd.exe	132
PID 4128 wrote to memory of 3940	4128	cmd.exe	133
PID 4128 wrote to memory of 5364	4128	cmd.exe	134
PID 4128 wrote to memory of 1368	4128	cmd.exe	135
PID 4128 wrote to memory of 5344	4128	cmd.exe	136
PID 4128 wrote to memory of 3064	4128	cmd.exe	137
PID 4128 wrote to memory of 1996	4128	cmd.exe	138
PID 4128 wrote to memory of 5348	4128	cmd.exe	139
PID 4128 wrote to memory of 5888	4128	cmd.exe	140
PID 4128 wrote to memory of 3068	4128	cmd.exe	141
PID 4128 wrote to memory of 5784	4128	cmd.exe	142

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FotosDaFormatura.bat"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:4784
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object Net.WebClient).DownloadFile('https://blog.cobasi.com.br/wp-content/uploads/2020/06/cuidar-de-gato-capa.png', 'C:\Users\Admin\AppData\Local\Temp\party_cat.png')"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'; [Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\party_cat.png', 3)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eboiaoco\eboiaoco.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES178A.tmp" "c:\Users\Admin\AppData\Local\Temp\eboiaoco\CSC3157EA7728AE4A4798F03D1485A41D3B.TMP"
      4⤵
      PID:1872
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fatal.vbs"
  2⤵
  PID:3316
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Admin\AppData\Local\Temp\hacked.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:560
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3992
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3968
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3752
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1396
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:6092
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5872
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4348
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5132
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2516
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:6004
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:712
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:6100
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2792
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4440
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5932
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2828
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5972
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5780
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5400
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2108
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2472
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4448
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3612
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2224
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6096
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1800
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1804
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:772
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5808
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6132
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6024
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3884
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4396
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:484
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2192
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5548
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1464
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:612
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3688
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5264
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1912
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:568
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5660
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5552
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4524
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:944
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3940
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5364
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1368
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5344
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3064
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1996
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5348
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5888
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3068
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5784
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5192
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2764
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5420
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1432
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1276
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5904
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3824
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3272
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1448
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1768
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1264
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4412
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4132
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4988
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4420
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1944
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5476
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3816
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1684
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4704
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2508
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5064
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3104
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4980
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1928
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:656
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1232
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3296
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2940
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3740
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3112
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1780
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5276
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:112
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3236
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6136
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3500
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2880
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2464
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:2832
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5804
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4884
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4800
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2816
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5288
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1484
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1180
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1640
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:3172
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5788
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:660
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4904
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4328
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5488
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1040
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3692
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4632
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1696
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4932
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5188
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4900
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4860
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4728
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4488
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5496
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3332
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1876
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1052
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4224
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1168
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cca996ce3a1fb9cc44bcacc9002798fc66eab27146004d38e65ef98539510f66
MD5 be40db6c8fd0d8b32dd97d14f10f8d1c
SHA1 b0f3a526f60d03ca3e0e6ecd5340358b0d345768
SHA512 0c595146fef4919951f9f04b2f13a03094d51c87063882ffe9beb1f1b0e36fb08ca3ff53bdf0bf1c234e02ac7f878fe5bf185ec8db2c437651e74a9a47414f4f
TLSH
T1B9117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8F7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

RES178A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES178A.tmp
Size 1KB
SHA256 f21c7a8335ca37e4f4b0314790cec463fd50577be87271cb9ff65f832f6e7893
MD5 9b747870306ba8ac38dcd5a05e04c289
SHA1 c1593fc858ef052115740b28bb96b00028c133d8
SHA512 478eb9c840b08d6df4199c40dd1f70204f39ea3dc063a7a9a44db5a2776df597c8ff70b738f594b1cf8b638e92c99c39bf51e16ba162311c0f8481ef3fbce9bd
TLSH
T18F218C0583F84B1EF0B35B3169F6035B9674FD55EF61939B8540422C2851544DEA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lwt0uwty.wu0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwt0uwty.wu0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

eboiaoco.dll

Path C:\Users\Admin\AppData\Local\Temp\eboiaoco\eboiaoco.dll
Size 3KB
SHA256 ae1f52214a5b1d85f89b68c1f43b40aa4d836ee5135616ac6a723e11fa498409
MD5 20f62c6d160f46c781672c9969da1e5c
SHA1 539cfc2296c404b3f3414924261731c7b40e54b3
SHA512 af326d0072cd3b6493f60c87e750b47b1ab7e98835748a35570d8daae13d91d79a50890e6e54f1ac67fe08706e5e73bca26cf45e1c7dc754226bcfec3a797dc7
TLSH
T19F51DD17A3E8466BE86B0B30AEF3475737B4F8149F72A35D0980422C9C617681E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

fatal.vbs

Path C:\Users\Admin\AppData\Local\Temp\fatal.vbs
Size 168B
SHA256 c154bd74b93218f0f1e7f554426ac12a8990ed23010dd60528e20747108382ac
MD5 8063821fa200e223150e9211d8b0ee49
SHA1 5c059229b9828e61782234f6d482186f034a1aa8
SHA512 3de4c014c83b2a6ee6dd4ff49aeaf582c5df00eafa6fe466490ba940cf61305ef81ea770cbb3eea9201136ec1e4349c4e6367a559c76c2a9b9c887be691927a5
TLSH
T188C0807E45DDF4401B54444115D05A436148D554120E8A30135B4B55B76DC90C8F5126
MD5 SHA1 SHA512 TLSH

Submit Download

hacked.txt

Path C:\Users\Admin\AppData\Local\Temp\hacked.txt
Size 66B
SHA256 7c421647fb85fc764dea2454967dbefb74b36ac6cb40d04e6d62e2612e479c21
MD5 7d5eed5dce095b7a46e0843715d7136e
SHA1 757b3a86612eafaa90d278a51e6f29b252c9513a
SHA512 107b0cbd3315e72eb0789f45ab89ed4f18856d2854153e943e2c30a3c74993359be832d6bb73ffebea0b8fc42cea3ff72b4510cee0d74dcbd10ba8fba239917e
TLSH
T1A0A002C441104D9B1EAFE33B61A5C4D07507724BBA46551923BD0EB99A14861D050E33
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3157EA7728AE4A4798F03D1485A41D3B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\eboiaoco\CSC3157EA7728AE4A4798F03D1485A41D3B.TMP
Size 652B
SHA256 bc74b3e21a589cf776428f440e31151888557585bc8d46d19f356d1dde8ba72e
MD5 ae0a76172572e84e842e55467b5171cb
SHA1 d2bb3219ed047edab88b173aefeda0825e8fb474
SHA512 55d9a88d59806a8c7ce9432f527ae0dcbf9fdd3d40767cde65fda9c12bf5a40a9cf7ff6a5ec4db9c7b92a94bc5d37bbcfe3b55ef2ce14add4600941692485b1b
TLSH
T1CAF05E09A3F8020EF0F34B30BDF643A395B9BC64DE3293ED2480032968649108962FB3
MD5 SHA1 SHA512 TLSH

Submit Download

eboiaoco.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\eboiaoco\eboiaoco.0.cs
Size 234B
SHA256 d17a04b258a3f4d6c07a25e77ca59c310f7030062eceec328eea1f0d2047f024
MD5 b5bc6f9136dce704041d49aebb0b4fa1
SHA1 9b2966bebcbd68d70a40f85682f148d5c6bbb8bb
SHA512 e828bc3fae857240e623fd28c2524b56c8d294ac2bf45a24869dc6786a7cd2d5bd2299546a2a9b4b286f96b91e48c2d8f185a3d508808edf06a4da0e54b02c6a
TLSH
T1A2D0A734B747E6F94847090F4C83A0B97737939873E7791168EA6114CF9B8082636625
MD5 SHA1 SHA512 TLSH

Submit Download

eboiaoco.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\eboiaoco\eboiaoco.cmdline
Size 369B
SHA256 2afa0b20ee2a89c9c62aa65da566086b64bf80402515dab708247bfe9fed14e5
MD5 38932100968a76d056b30f2c3105829e
SHA1 63e2303ecd67f54c7ecf432ace39ecdc1ba446f9
SHA512 4e067eb5b704cf03183233d488e8722335ecb15e986e937b5fc5d147974bc33390e127d4e13a9b50bb952ae3f7854a28beca703ae98d18e02f2d001c74854264
TLSH
T152E0C02AC247C27E91DD240B316AC4BCC6720F4729483F8C5445444DD017042A7D1B82
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3276-15-0x000001ED677E0000-0x000001ED677F0000-memory.dmp

Download

memory/3276-37-0x000001ED4F110000-0x000001ED4F122000-memory.dmp

Download

memory/3276-35-0x000001ED677D0000-0x000001ED677D8000-memory.dmp

Download

memory/4996-8-0x0000021E1FDE0000-0x0000021E1FE02000-memory.dmp

Download

memory/4996-0-0x0000021E07B60000-0x0000021E07B70000-memory.dmp

Download

memory/4996-1-0x0000021E07B60000-0x0000021E07B70000-memory.dmp

Download

memory/4996-13-0x0000021E07B70000-0x0000021E07B82000-memory.dmp

Download

memory/4996-9-0x0000021E07B60000-0x0000021E07B70000-memory.dmp

Download