9d6cfb7bf32e45e2367c4677004089f0a0a88878e60b35a6deb77541f5c3c314

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Verificar_GDS32.cmd
Size 1KB
Sample260605-vhsrtacy3l
SHA256 9d6cfb7bf32e45e2367c4677004089f0a0a88878e60b35a6deb77541f5c3c314
MD5 e9e8e2799231d02fd2443780e8e6a225
SHA1 54a488902a912172b01a7726c87cdc880eac1673
SHA512 8e57681ab21b966bffb1af2bf5898cd04e7874bf44ad211f876e6a7a94391ec2860cca0adafa49ce004bcb769eee39f4823feb641c223dda2e869cb52d2f31a5
TLSH
T1C12102597F09FD51AC6F530D09B5A3163E1B010F3528DCA1D69333307485CC8D6AD235
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4292	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	powershell.exe
4292	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4292	2192	cmd.exe	81
PID 4292 wrote to memory of 3336	4292	powershell.exe	82
PID 3336 wrote to memory of 5368	3336	csc.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Verificar_GDS32.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\verificar_gds32_4111.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t4ap5dek\t4ap5dek.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7589.tmp" "c:\Users\Admin\AppData\Local\Temp\t4ap5dek\CSCA2B431363E1049BD8B535068549657E.TMP"
      4⤵
      PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7589.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7589.tmp
Size 1KB
SHA256 3d52d6f208ee5706325b97d6959a1900d3f60849c7a60d65237a1a7b21d3e337
MD5 f95b81a4811db5d66f9956611725af50
SHA1 d31c4a5858078195e3e9deefca55f46d106d6558
SHA512 815c366a98f70246bbc46b73dbc82d6cf0d0042f065ac8420e8518bde95be2a397bd66c34c0c0b1786afcfb3e0778d51a3b64bc7d624a8ee99c20e139731f2e3
TLSH
T11821890953E9470BF0774B3279F6032FA228FD55AFA6935B8540422C2C51658EEA0AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n2b0yofl.5dn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2b0yofl.5dn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

t4ap5dek.dll

Path C:\Users\Admin\AppData\Local\Temp\t4ap5dek\t4ap5dek.dll
Size 3KB
SHA256 d926554d7b545ca88d651916edb5bab1c4a397abbfd1ddeaae50a2f607ac5e37
MD5 590d5fad4e62d4ab5b9a88ac19472196
SHA1 1f564cfb7ade1f020053511bc84a0dce9c7556f4
SHA512 ffd3302d3bd07624f0271402f0b96a3eb67d3d17a4b0ba417642c249767bdd1bbb8015b11472e177f5a5dda9d504cac6efd16b08fcb9ff9d4cc0f98b14f4870e
TLSH
T16A51FB1AA7E84667E4B70732AEF3435327A4F8109B72876D99C0022CAC603585E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

verificar_gds32_4111.ps1

Path C:\Users\Admin\AppData\Local\Temp\verificar_gds32_4111.ps1
Size 479B
SHA256 c03959462e9574c74e6cb22328bc5e47fe887e6ed127c21aa5cdcdee3565e0f1
MD5 63c45ff1c51252eba74b014360979c1c
SHA1 f817ed023c239900509f185fcb9a7e93fde51a71
SHA512 6331bfe1ef88a00da08e2b25a79852846f273ba8fe9f35b3c376513b930c93deaf379b780caefe724e094e04818dbbaa33ba11d7879112fd550ba913cfbd410d
TLSH
T15AF09E64DB87AD6B0A604B134C92F6C9FA53021B45294C80EF841712E88700A672BB32
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA2B431363E1049BD8B535068549657E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\t4ap5dek\CSCA2B431363E1049BD8B535068549657E.TMP
Size 652B
SHA256 1a36f6baaa02af025ac3b054cdc44d4dcbd405bec314c8a25a0c7f209e4e1558
MD5 ab89264f9629ff73af3ffa6a64fd4851
SHA1 b09c96208aa151d7358b05401517b25cece1cdfd
SHA512 2dd4ab22563b988d3c6a1019116a3d54990f96cc5e20cd8f8e7776a5ac8c98c6548291948665658db232532f16d645015b13152bc3a0171614346ef5d6f38057
TLSH
T18AF03A4963F8020AF0F74B30BEF643A392A8BC65DE3293ED2440031D2C64614D962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

t4ap5dek.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\t4ap5dek\t4ap5dek.0.cs
Size 223B
SHA256 7e93737735a2b79f96ef424a3d91ff6d0f7d9d3c5681261bf4f25cd46b28c355
MD5 4f47bd411a2f33f954c98fbd704ff1a0
SHA1 68f3bd6096bc51f1f93843404ef75301482389af
SHA512 1f7ac171ded2b5d8ec0bbfa09e7da470fdd0267ee88ccd653a8a532331b5b8ec293d7b10d830993d6d3a8e90885df33940345bad6a064a26f835d202f5a99f95
TLSH
T14ED0A728E746EF76555141134C82F4CCB763111647395C40A9D42311DC860156A74E2A
MD5 SHA1 SHA512 TLSH

Submit Download

t4ap5dek.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\t4ap5dek\t4ap5dek.cmdline
Size 369B
SHA256 d0dc43ca0973d05e926edbd591dfda57c74bb72d5bcc95b5af37c69e2609c13f
MD5 b0a4875371e08657044a8bcf896ee0a9
SHA1 27f1f257c1ef17a7c92852df46726c415b250dcd
SHA512 71290d4c447d806f3cb02b8912ecc910b6d6725c8c116ddae3a3a187203cb9a7fd5f581ba43bc1836b3a9ac72fa281f8892a234dab0892103591cd2035fed9ff
TLSH
T14CE0C02A6286C2BD22DD2047716BC7ECC37257433988BF845240440DD02F00027D1743
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4292-28-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Download

memory/4292-18-0x00000000050A0000-0x00000000050C2000-memory.dmp

Download

memory/4292-29-0x0000000005F80000-0x0000000005FCC000-memory.dmp

Download

memory/4292-15-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Download

memory/4292-31-0x0000000007890000-0x0000000007F0A000-memory.dmp

Download

memory/4292-32-0x0000000006490000-0x00000000064AA000-memory.dmp

Download

memory/4292-27-0x0000000005A00000-0x0000000005D57000-memory.dmp

Download

memory/4292-19-0x00000000058A0000-0x0000000005906000-memory.dmp

Download

memory/4292-17-0x0000000005170000-0x000000000579A000-memory.dmp

Download

memory/4292-20-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/4292-45-0x0000000006520000-0x0000000006528000-memory.dmp

Download

memory/4292-46-0x0000000007210000-0x00000000072A6000-memory.dmp

Download

memory/4292-16-0x0000000002740000-0x0000000002776000-memory.dmp

Download

memory/4292-47-0x0000000007130000-0x0000000007152000-memory.dmp

Download

memory/4292-48-0x0000000007F10000-0x00000000084B6000-memory.dmp

Download