acc605c29cb56de7597ae6483a317b924512cf158cc4f38cbcdd24387f9beba7

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Instalar_Cliente.cmd
Size 1KB
Sample260605-t4vmvsbs41
SHA256 acc605c29cb56de7597ae6483a317b924512cf158cc4f38cbcdd24387f9beba7
MD5 7fe92e496598d7b8210d19befcca803a
SHA1 029252599587625cd38641e101ef27ec77bed523
SHA512 356d37e5109e92374290e0645d0ae57d292085e8c1b5d54bec54838d35eda9b5f3307b4cde08c4fbb32fb31a3f3cfd7308a547f8dd2248c4c2ec677307369d81
TLSH
T139412559F708F50A58D57A04C1856909B82F19C90378DE6FFFE9618AF893E208EB1445
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File created	C:\Windows\System32\gds32.dll	cmd.exe
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File created	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\reserva.ini	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\reserva.ini	cmd.exe
File opened for modification	C:\Windows\reserva.ini	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3740	powershell.exe
3868	powershell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3984	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3740	powershell.exe
3740	powershell.exe
3868	powershell.exe
3868	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4044	4440	cmd.exe	81
PID 4044 wrote to memory of 1588	4044	net.exe	82
PID 4440 wrote to memory of 4780	4440	cmd.exe	83
PID 4440 wrote to memory of 3984	4440	cmd.exe	84
PID 4440 wrote to memory of 3740	4440	cmd.exe	85
PID 4440 wrote to memory of 3868	4440	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Instalar_Cliente.cmd"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1588
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:4780
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abrir_Reserva_Nuvem.cmd

Path C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd
Size 120B
SHA256 64caa1f6e01dc0a4e4878132775544eaee4ee60093e34ab53a7c21c572dd8779
MD5 7113ad6095ae4fc804f49ec815fd8a69
SHA1 e7b3a10ceb977877d35fa271bedc555e54f07f94
SHA512 10a628f5c6c65a78128d2764c35824904b3133f412087a03859a52e131f2e2c633b203e9882f2e24895b3d2083a0e5f01e49903f0c77c282c9283fa85ee92113
TLSH
T18AB09284CF01B41309E43E00C04B2746BD0F60945334896FFFF6A015F8CBC6298ABC21
MD5 SHA1 SHA512 TLSH

Submit Download

Reserva_Nuvem.exe

Path C:\Reserva_Nuvem\Reserva_Nuvem.exe
Size 16.7MB
SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
MD5 096645bb6c298a126a963f84b5e99237
SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
TLSH
T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 946c491dfe10a92d01ddea1d34ec7c087198efe417bf2fb6ae89d7c29f481e1d
MD5 8b325e7ccea722ef8a306ea24820a555
SHA1 ef0cca71965fc5392f45940dcc3c0f6ae5ba832b
SHA512 2b433ea72a5fe25db2479dea10a6d60c0baa96fb1d205879f5c4fbb0bdc4e004e3eb8fabaaec95d27a41d0145acaa1e2ef83e5553a0b4b9f6758207c4761500a
TLSH
T1B9117A33B79CC135C8D9117A1089AD11B1B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ldiv14gj.dx4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldiv14gj.dx4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gds32.dll

Path C:\Windows\System32\gds32.dll
Size 380KB
SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
MD5 1abd772ece0cc871696a867d1f2076d8
SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
TLSH
T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reserva.ini

Path C:\Windows\reserva.ini
Size 498B
SHA256 24a51aab453ffd1f9b8aa339a09e5782a67ba2cc084e9c926c0edabba04b6e75
MD5 7f26e0cf391fde7c777b39c6f9238e99
SHA1 eee2368387a9bb0b0382745b7e0b7a9c2de91796
SHA512 1ec7880d70ff898a57a877bf7901f297ae0912394fc9ee3f42641a76af0179649bdd7f6e5608e0a4285816d1cf424a812a091d2ac195c62ca37bc9b1ca984221
TLSH
T1C2F0E090D843A0410F07B56706243799634B158EF4F6021195D59C2B9E4E5015BD7FD3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3740-21-0x0000028E4F110000-0x0000028E4F120000-memory.dmp

Download

memory/3740-28-0x0000028E4F0E0000-0x0000028E4F102000-memory.dmp

Download

memory/3740-29-0x0000028E4F110000-0x0000028E4F120000-memory.dmp

Download