180be48771c410b41abb5ecf3e6f47d69daee865ac6259e9f28b5c4671b4b1e4

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JogoDeGatinho.bat
Size 835B
Sample260502-wtak2sds9x
SHA256 180be48771c410b41abb5ecf3e6f47d69daee865ac6259e9f28b5c4671b4b1e4
MD5 536829bef1c0c838844e203be405fca0
SHA1 293625554da1ac8640b134ca00cb599446d319c5
SHA512 e202e1a77dd5562c625a41cf1546e66f98f343a4e3579596fec0bc6c1da124085f163069186171daf88a810cb830262b976fa0de0137c8e5869dc57510a8f770
TLSH
T159011226BF85A1E50D67052784C3F475F235B286E34AAE8EB0DA10A485BF9446636910
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4452	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gato.png"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	powershell.exe
4452	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4452	4344	cmd.exe	86
PID 4452 wrote to memory of 4708	4452	powershell.exe	87
PID 4708 wrote to memory of 816	4708	csc.exe	88
PID 4344 wrote to memory of 4612	4344	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JogoDeGatinho.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'; [Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\gato.png', 3)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w2fg1ef1\w2fg1ef1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES24F8.tmp" "c:\Users\Admin\AppData\Local\Temp\w2fg1ef1\CSC9C4D2476DA4948539A58C0586F54F75.TMP"
      4⤵
      PID:816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\m.vbs"
  2⤵
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

RES24F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES24F8.tmp
Size 1KB
SHA256 0a30c271bb70e65d5dae46c455e6f9a2faa74194cf38684c8a4d17afd2d0821c
MD5 10d135bd1ef0ca3ac8f25468cf41c4fc
SHA1 be328c03a74bb25a1954b8ce77262e84360c6638
SHA512 3aab521cb5e0bf133e248fcd43b94abb20f4ce8d135e322fdff62cb3388b4e76682c68dfee6ab1abe29f24acd7a5b1c548c5bfe110ea835c49f0f68a4c181719
TLSH
T1E2217B0953E84B1EF0B75732A9FA272F9279FD94EFA1536F8981422C1C51144EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qx0uhelf.hg2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qx0uhelf.hg2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

m.vbs

Path C:\Users\Admin\AppData\Local\Temp\m.vbs
Size 68B
SHA256 52e744cb25d8a3f86ece007dfc9f50ba8bfbc97c38114c6b33f40b15ffe597a2
MD5 efa06ca6bab2bb0967ea73adda0aa0d2
SHA1 7ef8e59d27aaa871005a8e6d3b3f4355630d2e1f
SHA512 0f296c99269cd67a480da4e4513a613afc5ecff5307b33a1183a06c75da649fd4891d9656712739083e0969657600fddc11a307f9faafacac7250b9e3028bcff
TLSH
T179A002D1574C7696A6C900316756E815605B6983F28A3E754B0E297C063CD9507D1C86
MD5 SHA1 SHA512 TLSH

Submit Download

w2fg1ef1.dll

Path C:\Users\Admin\AppData\Local\Temp\w2fg1ef1\w2fg1ef1.dll
Size 3KB
SHA256 2b4a5b4d178816cbc88f4630d7680988fb43e237009b0dcf52139e23bd2b8278
MD5 9cea0e2d8c6b9da4c9d82888e8d3e735
SHA1 eb03d02814f4b678844edcf7eab2f148b9679923
SHA512 88896b4fd07fea350e19441eb37ad0409667514c3491d496b9795ab5be214fcc5e9b198cd248a319aabb450d2dab03cd41f9e21353c550ffe3dd2d7e75bb4eb7
TLSH
T19051DD1A67E8066BE8AB0735ADF387172774F8109F73A35D0980022CAC517285E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9C4D2476DA4948539A58C0586F54F75.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w2fg1ef1\CSC9C4D2476DA4948539A58C0586F54F75.TMP
Size 652B
SHA256 ed1d77fde1d1759760a0f161d974fa30620c5d571ed80405b50ddfbde8cfe87d
MD5 63d779c09c521b4aeac1afb24bce3586
SHA1 17c121333b7e178a02452a1dbc8f2557e8fdda5a
SHA512 df68758a8c09ed91bfa1e5a5c33e2860591cf4f8d1be2bc6a272c19933d55983fb1f3a199c39d14e017479fb727c9cb9fb1c261dbc051a0f5e9282be4a272e52
TLSH
T1D1F05E0A63F8020EF0F34B31BDF6936B95A9BC64DE32A3ED148003192C645109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

w2fg1ef1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w2fg1ef1\w2fg1ef1.0.cs
Size 234B
SHA256 d17a04b258a3f4d6c07a25e77ca59c310f7030062eceec328eea1f0d2047f024
MD5 b5bc6f9136dce704041d49aebb0b4fa1
SHA1 9b2966bebcbd68d70a40f85682f148d5c6bbb8bb
SHA512 e828bc3fae857240e623fd28c2524b56c8d294ac2bf45a24869dc6786a7cd2d5bd2299546a2a9b4b286f96b91e48c2d8f185a3d508808edf06a4da0e54b02c6a
TLSH
T1A2D0A734B747E6F94847090F4C83A0B97737939873E7791168EA6114CF9B8082636625
MD5 SHA1 SHA512 TLSH

Submit Download

w2fg1ef1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w2fg1ef1\w2fg1ef1.cmdline
Size 369B
SHA256 06be850b6a4293c3477218d407653f17b6f6e3dcdab9de8ea54c78998d0979c8
MD5 1b9d04975e47d2a86851fbfa2d612f88
SHA1 ef8fca211cc54fcb64f33f2c09e5ed219cd24f4d
SHA512 5cea0a63be84a66ac04c09b98210df795f894d06c6d6f9414037cc561745f22b7d5ee4dd93ad2b74b92a358122de225d0cac57be182cba3fd6d9989228cabb68
TLSH
T140E0C03A4266C27D07DD305722FDC4BCC2724B8329403FC46088840FE397004A7D1F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-19-0x000001DFFC350000-0x000001DFFC35C000-memory.dmp

Download

memory/4452-0-0x00007FFF9FFD0000-0x00007FFFA0171000-memory.dmp

Download

memory/4452-7-0x000001757AE80000-0x000001757AEA2000-memory.dmp

Download

memory/4452-24-0x000001757ACF0000-0x000001757ACF8000-memory.dmp

Download

memory/4452-28-0x00007FFF9FFD0000-0x00007FFFA0171000-memory.dmp

Download

memory/4452-27-0x0000017578F70000-0x0000017578F7C000-memory.dmp

Download

memory/4452-1-0x00007FFF9FFD0000-0x00007FFFA0171000-memory.dmp

Download

memory/4612-34-0x000002CD8D000000-0x000002CD8D00C000-memory.dmp

Download

memory/4612-37-0x000002CD8D000000-0x000002CD8D00C000-memory.dmp

Download

memory/4708-22-0x000002D4D2BB0000-0x000002D4D2BBC000-memory.dmp

Download