180be48771c410b41abb5ecf3e6f47d69daee865ac6259e9f28b5c4671b4b1e4

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JogoDeGatinho.bat
Size 835B
Sample260502-wtak2sds9x
SHA256 180be48771c410b41abb5ecf3e6f47d69daee865ac6259e9f28b5c4671b4b1e4
MD5 536829bef1c0c838844e203be405fca0
SHA1 293625554da1ac8640b134ca00cb599446d319c5
SHA512 e202e1a77dd5562c625a41cf1546e66f98f343a4e3579596fec0bc6c1da124085f163069186171daf88a810cb830262b976fa0de0137c8e5869dc57510a8f770
TLSH
T159011226BF85A1E50D67052784C3F475F235B286E34AAE8EB0DA10A485BF9446636910
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gato.png"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3624	5016	cmd.exe	81
PID 3624 wrote to memory of 3268	3624	powershell.exe	82
PID 3268 wrote to memory of 1836	3268	csc.exe	83
PID 5016 wrote to memory of 3840	5016	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JogoDeGatinho.bat"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'; [Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\gato.png', 3)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bm2qifcw\bm2qifcw.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27E6.tmp" "c:\Users\Admin\AppData\Local\Temp\bm2qifcw\CSCE9FF9BF1720451191C4D09D148946D7.TMP"
      4⤵
      PID:1836
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\m.vbs"
  2⤵
  PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

RES27E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES27E6.tmp
Size 1KB
SHA256 833914bb51293cca03fbe0030c25f27585c320e2e7650b5c28860cd5221bfdd4
MD5 559bd362a3e1602d2d72fb7eb279c666
SHA1 c85818becf99a141d545838564b0a60c68b38ee1
SHA512 c9570c8c61996adf88493ee81f28c1b7a235891cf1e06100aa7ae9395047beff93229762779cc0e875233abb708835b753defa4023fe997551f28c12595f1aff
TLSH
T13C21AB0547EC8B1EF0735731A9F6132B9274FE94EFA2679B8580422C2C81504EEB0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2px5h3vn.ju4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2px5h3vn.ju4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bm2qifcw.dll

Path C:\Users\Admin\AppData\Local\Temp\bm2qifcw\bm2qifcw.dll
Size 3KB
SHA256 835a30096f299b027d63dad1b0e64e6beddc090f4f7786e1791a7745f3326090
MD5 f593df3b78f797040c1af752b801c6fa
SHA1 174c6093b4b947fc94552da4e8fe3e83bc88036c
SHA512 257238bf29ec1c264fa340cb4bceb301fcf7d979135253d1d375431fd24093bd5911e15c93dc4f2b181d0f6b05f9df14aa060d2e69c592d1bfb353a15d744402
TLSH
T11951001663E8466BE8A70730AEF347533774F814AFB2A35909C4422CAC517682E32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

m.vbs

Path C:\Users\Admin\AppData\Local\Temp\m.vbs
Size 68B
SHA256 52e744cb25d8a3f86ece007dfc9f50ba8bfbc97c38114c6b33f40b15ffe597a2
MD5 efa06ca6bab2bb0967ea73adda0aa0d2
SHA1 7ef8e59d27aaa871005a8e6d3b3f4355630d2e1f
SHA512 0f296c99269cd67a480da4e4513a613afc5ecff5307b33a1183a06c75da649fd4891d9656712739083e0969657600fddc11a307f9faafacac7250b9e3028bcff
TLSH
T179A002D1574C7696A6C900316756E815605B6983F28A3E754B0E297C063CD9507D1C86
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE9FF9BF1720451191C4D09D148946D7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bm2qifcw\CSCE9FF9BF1720451191C4D09D148946D7.TMP
Size 652B
SHA256 915a495bcad70ace80623d5cd4e8f832b2bea7677ab1c381a6cc1189a8883c83
MD5 613c224df6565c3dd97618198a29be8f
SHA1 090d1d1cb0e19adb89b657e40b3ae768ae0d202a
SHA512 97a886f5cd174bf3ca67d14759fc40a2e359e2b9d94a76725e0c7dadf665d84c6103ebe65c16a63006cc5e705cd3a4929abc213f437368a552817ebaa8f9d0f0
TLSH
T196F05E0963F8420EF0F34B30BEF653A395A8BC64DE7293ED1484032968649109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

bm2qifcw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bm2qifcw\bm2qifcw.0.cs
Size 234B
SHA256 d17a04b258a3f4d6c07a25e77ca59c310f7030062eceec328eea1f0d2047f024
MD5 b5bc6f9136dce704041d49aebb0b4fa1
SHA1 9b2966bebcbd68d70a40f85682f148d5c6bbb8bb
SHA512 e828bc3fae857240e623fd28c2524b56c8d294ac2bf45a24869dc6786a7cd2d5bd2299546a2a9b4b286f96b91e48c2d8f185a3d508808edf06a4da0e54b02c6a
TLSH
T1A2D0A734B747E6F94847090F4C83A0B97737939873E7791168EA6114CF9B8082636625
MD5 SHA1 SHA512 TLSH

Submit Download

bm2qifcw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bm2qifcw\bm2qifcw.cmdline
Size 369B
SHA256 5664f7ad7d23e424d985e74b633056a7bd6493f7eeb72cc6cf35f116c51abbae
MD5 32b7b23f96eb018f505d43e38eac8d2f
SHA1 f2531145d4c63cbb8309d71092701a74f8bca720
SHA512 a1fb7c7324b553736c919eb29ad48e80a46a8887945cd598948404bb5cd85d246a824deb231d4fb4a0087fa35f65be57a6344e44397d77e0d07d65230b409bfb
TLSH
T1CEE0C02A4246C3FE11ED100F2969C8ECC3F20BC72A513F84904D480DD0A74583BF1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1836-19-0x00000180A3F40000-0x00000180A3F4C000-memory.dmp

Download

memory/3268-23-0x0000014725ED0000-0x0000014725EDC000-memory.dmp

Download

memory/3268-22-0x0000014725E70000-0x0000014725E78000-memory.dmp

Download

memory/3624-0-0x00000193BAFF0000-0x00000193BB000000-memory.dmp

Download

memory/3624-9-0x00000193BAFF0000-0x00000193BB000000-memory.dmp

Download

memory/3624-7-0x00000193D3340000-0x00000193D3362000-memory.dmp

Download

memory/3624-25-0x00000193D3330000-0x00000193D3338000-memory.dmp

Download

memory/3624-30-0x00000193D32E0000-0x00000193D32F2000-memory.dmp

Download

memory/3624-29-0x00000193BB020000-0x00000193BB028000-memory.dmp

Download

memory/3624-28-0x00000193BAF80000-0x00000193BAF8C000-memory.dmp

Download

memory/3624-1-0x00000193BAFF0000-0x00000193BB000000-memory.dmp

Download

memory/3840-36-0x0000025DD6680000-0x0000025DD668C000-memory.dmp

Download