cd40fc23c4882362e9898a265551f411824461ffaf552ba05b7c7c5af2f692a9

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Instalar_Cliente.cmd
Size 2KB
Sample260605-wbfpcacz8r
SHA256 cd40fc23c4882362e9898a265551f411824461ffaf552ba05b7c7c5af2f692a9
MD5 3f569b57643f1d1848c5354c68dbc5fc
SHA1 fc7acf4006d50ddc0d26507f52fc875d728a669a
SHA512 d4a7aa9ece4ab2730454186aad66f3f8b042146f270afb1f9c93bf085219234c5f0afbde68623915081e73b7735b63d6100339a370d6e985c02f9e88551890ec
TLSH
T1BF515515E768ED0B589A7A04C1D59C1EA86F1EC94338DE9BEFE491CEF443A10CFB0449
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcr71.dll	cmd.exe
File created	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File created	C:\Windows\System32\gds32.dll	cmd.exe
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File created	C:\Windows\SysWOW64\msvcr71.dll	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1976	powershell.exe
4928	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3836	powershell.exe
1996	powershell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4552	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4928	powershell.exe
4928	powershell.exe
1976	powershell.exe
1976	powershell.exe
1996	powershell.exe
1996	powershell.exe
3836	powershell.exe
3836	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1736	4812	cmd.exe	81
PID 1736 wrote to memory of 2720	1736	net.exe	82
PID 4812 wrote to memory of 4928	4812	cmd.exe	83
PID 4812 wrote to memory of 1976	4812	cmd.exe	84
PID 4812 wrote to memory of 4688	4812	cmd.exe	85
PID 4812 wrote to memory of 4552	4812	cmd.exe	86
PID 4812 wrote to memory of 1996	4812	cmd.exe	87
PID 4812 wrote to memory of 3836	4812	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Instalar_Cliente.cmd"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ChildItem -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\' -File | Unblock-File -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ChildItem 'C:\Reserva_Nuvem' -File | Unblock-File -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:4688
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Reserva_Nuvem_160.exe

Path C:\Reserva_Nuvem\Reserva_Nuvem_160.exe
Size 16.7MB
SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
MD5 096645bb6c298a126a963f84b5e99237
SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
TLSH
T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c6de1b0d420c6f20e8cfb389f692e1615aea6e4cf09c20472dd0f0b9a73eafa
MD5 0459dd327efe9b6b264891ff3d15333d
SHA1 fc69b0ff3b98efdd739bf26c1583a91eaca891a4
SHA512 70b5a0a887212e92ddf9aa44055deefbbe58a2d1ed62f7ba9ca7b558a5204e550a231c4ed261fa80d746a64a474de7cc2c153f4f807224bb43478107ff592de1
TLSH
T148217833B3ACC135C8D9117A108CAD01B2B5C3CB449ECEDB7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b9b64dbc0c0554d158ac1391f6ad1ffcbd05d872f371a2212c260237819f69ea
MD5 507b3fcfe6b8ffccb71ea0d5f9ec3fb1
SHA1 dc2327468b207e3594ed7cbdee07719dfa65653f
SHA512 1278f7a736564657ad91544f58b1835b52f59cecc78544db928323187339fd7872616a1c6fd54316a34b2947fc4b2c2e21aaeb5f739ceb8e4b5220c0e687d2c2
TLSH
T11C215633B3ACC135C8D9117A1088AD11B1B5C3CB449E8E9B6B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f5d3c064817c82403567234b39eef76a84bea1c8201b7648bdd83ce5a7ffad15
MD5 b9d6991ff53b9449c6309c88b29c8ecd
SHA1 b216bee89e62e442573322614cc9ef4670847209
SHA512 e634d699f9cf9f0c66c954058cba643e8e60bee950bf730677652c3066ce79bfa2d7b8e3de82c9d3d2e8035236fd7c756771a45da072c335611ff9d069f0c44f
TLSH
T1F0117A33B79CC135C8E9117A1089AD01B1B4C3C7049EDE8B7A84C509E57F58ADBA45E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0zx5d5fc.zkd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0zx5d5fc.zkd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gds32.dll

Path C:\Windows\System32\gds32.dll
Size 380KB
SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
MD5 1abd772ece0cc871696a867d1f2076d8
SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
TLSH
T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1976-36-0x00000225B4A10000-0x00000225B4A20000-memory.dmp

Download

memory/1976-35-0x00000225B4A10000-0x00000225B4A20000-memory.dmp

Download

memory/4928-0-0x000001CAEDA00000-0x000001CAEDA10000-memory.dmp

Download

memory/4928-2-0x000001CAED9D0000-0x000001CAED9F2000-memory.dmp

Download

memory/4928-9-0x000001CAEDA00000-0x000001CAEDA10000-memory.dmp

Download

memory/4928-1-0x000001CAEDA00000-0x000001CAEDA10000-memory.dmp

Download