acc605c29cb56de7597ae6483a317b924512cf158cc4f38cbcdd24387f9beba7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Instalar_Cliente.cmd
Size 1KB
Sample260605-t4vmvsbs41
SHA256 acc605c29cb56de7597ae6483a317b924512cf158cc4f38cbcdd24387f9beba7
MD5 7fe92e496598d7b8210d19befcca803a
SHA1 029252599587625cd38641e101ef27ec77bed523
SHA512 356d37e5109e92374290e0645d0ae57d292085e8c1b5d54bec54838d35eda9b5f3307b4cde08c4fbb32fb31a3f3cfd7308a547f8dd2248c4c2ec677307369d81
TLSH
T139412559F708F50A58D57A04C1856909B82F19C90378DE6FFFE9618AF893E208EB1445
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File created	C:\Windows\System32\gds32.dll	cmd.exe
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File created	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File created	C:\Windows\SysWOW64\gds32.dll	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\reserva.ini	cmd.exe
File opened for modification	C:\Windows\reserva.ini	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2800	powershell.exe
2332	powershell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1336	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2800	powershell.exe
2800	powershell.exe
2332	powershell.exe
2332	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4924	4712	cmd.exe	85
PID 4924 wrote to memory of 2948	4924	net.exe	86
PID 4712 wrote to memory of 3284	4712	cmd.exe	88
PID 4712 wrote to memory of 1336	4712	cmd.exe	89
PID 4712 wrote to memory of 2800	4712	cmd.exe	90
PID 4712 wrote to memory of 2332	4712	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Instalar_Cliente.cmd"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2948
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:3284
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abrir_Reserva_Nuvem.cmd

Path C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd
Size 120B
SHA256 64caa1f6e01dc0a4e4878132775544eaee4ee60093e34ab53a7c21c572dd8779
MD5 7113ad6095ae4fc804f49ec815fd8a69
SHA1 e7b3a10ceb977877d35fa271bedc555e54f07f94
SHA512 10a628f5c6c65a78128d2764c35824904b3133f412087a03859a52e131f2e2c633b203e9882f2e24895b3d2083a0e5f01e49903f0c77c282c9283fa85ee92113
TLSH
T18AB09284CF01B41309E43E00C04B2746BD0F60945334896FFFF6A015F8CBC6298ABC21
MD5 SHA1 SHA512 TLSH

Submit Download

Reserva_Nuvem.exe

Path C:\Reserva_Nuvem\Reserva_Nuvem.exe
Size 16.7MB
SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
MD5 096645bb6c298a126a963f84b5e99237
SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
TLSH
T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f20dda07a5f7008b313c68d276748dbbeb487bb4d92d75d276a1227545505723
MD5 f2c6fb40bef529df8c3ac251f459c329
SHA1 c5bacc9ba7e84b110ccf2eb92b7f9996310de9c1
SHA512 7e5b9b550d1671ee55b24332b0356c3b4f32689c89c8600f577aad0129d929d34ceaf16ade579072f4d4e674634036d712108bcee1e7311181eaccb4698503f2
TLSH
T1D9117637B39C8A21CC96153A409DAC1172B6C3C781AEDF9F7BC4D215A0BF584CB716A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_133jgihx.y0t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_133jgihx.y0t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gds32.dll

Path C:\Windows\System32\gds32.dll
Size 380KB
SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
MD5 1abd772ece0cc871696a867d1f2076d8
SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
TLSH
T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reserva.ini

Path C:\Windows\reserva.ini
Size 498B
SHA256 24a51aab453ffd1f9b8aa339a09e5782a67ba2cc084e9c926c0edabba04b6e75
MD5 7f26e0cf391fde7c777b39c6f9238e99
SHA1 eee2368387a9bb0b0382745b7e0b7a9c2de91796
SHA512 1ec7880d70ff898a57a877bf7901f297ae0912394fc9ee3f42641a76af0179649bdd7f6e5608e0a4285816d1cf424a812a091d2ac195c62ca37bc9b1ca984221
TLSH
T1C2F0E090D843A0410F07B56706243799634B158EF4F6021195D59C2B9E4E5015BD7FD3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2800-22-0x000001E2ED500000-0x000001E2ED510000-memory.dmp

Download

memory/2800-21-0x000001E2ED500000-0x000001E2ED510000-memory.dmp

Download

memory/2800-25-0x000001E2EDF30000-0x000001E2EDF52000-memory.dmp

Download