39ec84ecc9a8010d57bfffe683c3d02b86b08cf9bacc40a0da551e66ce0e32a9

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Instalar_Cliente.cmd
Size 2KB
Sample260605-vhsrtacy3l
SHA256 39ec84ecc9a8010d57bfffe683c3d02b86b08cf9bacc40a0da551e66ce0e32a9
MD5 48c9d9ae0fa545deb7e7beae9ad8ca32
SHA1 81f5067704219582b011eb7011abfe966f7cea02
SHA512 a336b22185aacbdaeaa1c023258c6c86d4cf5550cb440fd435082acc691c38fca98fd0038755a01e0b72f8e7594528e45ecc212dbcbb917bf8c845d2e389231a
TLSH
T1E0415745E758F50A59D5BA04C1C5A809B83F19C90378D96BFFD8A18AF493E10CFB1446
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File created	C:\Windows\System32\gds32.dll	cmd.exe
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File created	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\reserva.ini	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\reserva.ini	cmd.exe
File opened for modification	C:\Windows\reserva.ini	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1368	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe
3156	powershell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2788	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1368	powershell.exe
1368	powershell.exe
3156	powershell.exe
3156	powershell.exe
2476	powershell.exe
2476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3048	2692	cmd.exe	88
PID 3048 wrote to memory of 412	3048	net.exe	89
PID 2692 wrote to memory of 1368	2692	cmd.exe	91
PID 2692 wrote to memory of 1416	2692	cmd.exe	93
PID 2692 wrote to memory of 2788	2692	cmd.exe	94
PID 2692 wrote to memory of 3156	2692	cmd.exe	95
PID 2692 wrote to memory of 2476	2692	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Instalar_Cliente.cmd"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ChildItem 'C:\Reserva_Nuvem' -File | Unblock-File -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:1416
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abrir_Reserva_Nuvem.cmd

Path C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd
Size 95B
SHA256 0ab2126fb2f006baffe843cd84e4d900ec46c6d3e2c0da6c52f8dfd3b6ae15b3
MD5 ebb7e13bc38a914ea6b68cc502394f08
SHA1 50081634017bbac9a234421d50e7fe0243107ef8
SHA512 8483b6a6786e9748184455dd90033d16e6542761f1a4fc93f6fcfd7788d04f6184c5697155e01f18a1f756fa007cebaa9b90d21b4d72260c590caa27402ed3b2
TLSH
T1BFB01240CDC3304326761C010C4353433F0ED04753059E1C3544941D584F5DE58940D2
MD5 SHA1 SHA512 TLSH

Submit Download

Reserva_Nuvem_160.exe

Path C:\Reserva_Nuvem\Reserva_Nuvem_160.exe
Size 16.7MB
SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
MD5 096645bb6c298a126a963f84b5e99237
SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
TLSH
T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ef3847aa959d119fb0406662df3fef0abc6a257ca1d4f532fdec591af56b7fb
MD5 5d8e2b06566b51d50f2fb295d277c5d9
SHA1 daf57b614adef545aad57569d62ef958b293cd14
SHA512 f77240f3e033bb1ffa3804c5bbae2022654baf7924da4a641b377cab8ed6501231a793774a2fc9d61fa35b2d95c9a74dfa38782435cd59885068c4b7e786f151
TLSH
T18421A827B3DC8A21CC86163A109D9C1172B683C7809ECF9F6FC0D600A07F598CB31294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7b8773a81d4e45cd1e8b060d309d30f67023c15429405f590a1d2864a815a92c
MD5 ae19327c9ad8d3c9e108048aa657ab32
SHA1 70cc90802547777253e62fe7bfae7464b9b8eed7
SHA512 79f2d256a627351444a4dd151e7f5dcbe5a2a865b9bc2567b2caa50b700d931adc78531f83c67468043faef930f51705bbcf6c45f05d872cd2e02d34aa9d87db
TLSH
T119117637B39CC9A1CC96163A409DAC1172B683C741AEDFDF6BC0C214E1AF994CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kyigndeg.fsc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kyigndeg.fsc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gds32.dll

Path C:\Windows\System32\gds32.dll
Size 380KB
SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
MD5 1abd772ece0cc871696a867d1f2076d8
SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
TLSH
T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reserva.ini

Path C:\Windows\reserva.ini
Size 498B
SHA256 24a51aab453ffd1f9b8aa339a09e5782a67ba2cc084e9c926c0edabba04b6e75
MD5 7f26e0cf391fde7c777b39c6f9238e99
SHA1 eee2368387a9bb0b0382745b7e0b7a9c2de91796
SHA512 1ec7880d70ff898a57a877bf7901f297ae0912394fc9ee3f42641a76af0179649bdd7f6e5608e0a4285816d1cf424a812a091d2ac195c62ca37bc9b1ca984221
TLSH
T1C2F0E090D843A0410F07B56706243799634B158EF4F6021195D59C2B9E4E5015BD7FD3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1368-12-0x000002C72AA80000-0x000002C72AA90000-memory.dmp

Download

memory/1368-14-0x000002C72CB00000-0x000002C72CB22000-memory.dmp

Download

memory/1368-13-0x000002C72AA80000-0x000002C72AA90000-memory.dmp

Download

memory/2476-60-0x000001607AE70000-0x000001607B08C000-memory.dmp

Download

memory/3156-36-0x000002EFEDBD0000-0x000002EFEDBE0000-memory.dmp

Download

memory/3156-37-0x000002EFEDBD0000-0x000002EFEDBE0000-memory.dmp

Download