dff34dba4bb36fbcb36adfa12cc4c86169a98b7d3f992bd24f1a84b745db3759

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Testar_Conexao_Reserva.cmd
Size 812B
Sample260605-wbfpcacz8r
SHA256 dff34dba4bb36fbcb36adfa12cc4c86169a98b7d3f992bd24f1a84b745db3759
MD5 ee28cde974b50f5c5d9e47f340d6f7f5
SHA1 cc73bb4c30fd99185790bb8c4e00604ea8ad8491
SHA512 ef7c2a1762e837b81cb7aa5536f2634548aa27c28cedbff6527bc950e3f5d116500fa3cde44860cfb88e59613099827f851b5fdef11d463ef5105f68d6c91b01
TLSH
T11E011EE2F7C670861DABB81BB991D1B97C3E228F1222480FE622C1366801544A771186
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4728	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5040	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4728	powershell.exe
1264	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
4728	powershell.exe
4728	powershell.exe
1264	powershell.exe
1264	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeIncreaseQuotaPrivilege	4728	powershell.exe
Token: SeSecurityPrivilege	4728	powershell.exe
Token: SeTakeOwnershipPrivilege	4728	powershell.exe
Token: SeLoadDriverPrivilege	4728	powershell.exe
Token: SeSystemProfilePrivilege	4728	powershell.exe
Token: SeSystemtimePrivilege	4728	powershell.exe
Token: SeProfSingleProcessPrivilege	4728	powershell.exe
Token: SeIncBasePriorityPrivilege	4728	powershell.exe
Token: SeCreatePagefilePrivilege	4728	powershell.exe
Token: SeBackupPrivilege	4728	powershell.exe
Token: SeRestorePrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeSystemEnvironmentPrivilege	4728	powershell.exe
Token: SeRemoteShutdownPrivilege	4728	powershell.exe
Token: SeUndockPrivilege	4728	powershell.exe
Token: SeManageVolumePrivilege	4728	powershell.exe
Token: 33	4728	powershell.exe
Token: 34	4728	powershell.exe
Token: 35	4728	powershell.exe
Token: 36	4728	powershell.exe
Token: SeIncreaseQuotaPrivilege	4728	powershell.exe
Token: SeSecurityPrivilege	4728	powershell.exe
Token: SeTakeOwnershipPrivilege	4728	powershell.exe
Token: SeLoadDriverPrivilege	4728	powershell.exe
Token: SeSystemProfilePrivilege	4728	powershell.exe
Token: SeSystemtimePrivilege	4728	powershell.exe
Token: SeProfSingleProcessPrivilege	4728	powershell.exe
Token: SeIncBasePriorityPrivilege	4728	powershell.exe
Token: SeCreatePagefilePrivilege	4728	powershell.exe
Token: SeBackupPrivilege	4728	powershell.exe
Token: SeRestorePrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeSystemEnvironmentPrivilege	4728	powershell.exe
Token: SeRemoteShutdownPrivilege	4728	powershell.exe
Token: SeUndockPrivilege	4728	powershell.exe
Token: SeManageVolumePrivilege	4728	powershell.exe
Token: 33	4728	powershell.exe
Token: 34	4728	powershell.exe
Token: 35	4728	powershell.exe
Token: 36	4728	powershell.exe
Token: SeIncreaseQuotaPrivilege	4728	powershell.exe
Token: SeSecurityPrivilege	4728	powershell.exe
Token: SeTakeOwnershipPrivilege	4728	powershell.exe
Token: SeLoadDriverPrivilege	4728	powershell.exe
Token: SeSystemProfilePrivilege	4728	powershell.exe
Token: SeSystemtimePrivilege	4728	powershell.exe
Token: SeProfSingleProcessPrivilege	4728	powershell.exe
Token: SeIncBasePriorityPrivilege	4728	powershell.exe
Token: SeCreatePagefilePrivilege	4728	powershell.exe
Token: SeBackupPrivilege	4728	powershell.exe
Token: SeRestorePrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeSystemEnvironmentPrivilege	4728	powershell.exe
Token: SeRemoteShutdownPrivilege	4728	powershell.exe
Token: SeUndockPrivilege	4728	powershell.exe
Token: SeManageVolumePrivilege	4728	powershell.exe
Token: 33	4728	powershell.exe
Token: 34	4728	powershell.exe
Token: 35	4728	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 5004	5548	cmd.exe	81
PID 5548 wrote to memory of 5040	5548	cmd.exe	82
PID 5548 wrote to memory of 4728	5548	cmd.exe	83
PID 5548 wrote to memory of 1264	5548	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Testar_Conexao_Reserva.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\system32\findstr.exe
  findstr /i "firebird 69.62.98.74" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Resolve-DnsName firebird -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Test-NetConnection 69.62.98.74 -Port 3050 -InformationLevel Detailed"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Test-NetConnection firebird -Port 3050 -InformationLevel Detailed"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a22216429b85bae12e8dc2ba4f40f1c4fba1d31c22ed8d4b7f2adf79bc20b108
MD5 a7d411b6e79b6fd55b8327f473017692
SHA1 759ee5e0299b777b66f7ca0cd1eaa83dee6c518a
SHA512 294a581a8d3741cb77ef21e9242049d9d301642f8fab3ebcd7c2cb86ebe9ac4685448845bdfa5deecfee9ee40e4f0fbeeb183a416d2882eb9560271eb3bbd06c
TLSH
T13171DD313275B0D489567F07192C19C463BF8356EA94AF4CB65C624ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 634786013cdf0f64f85b55e04241baea0975a72d171a7108158db99cf0956d18
MD5 64f32b209fe02a364cc3434524e52d2a
SHA1 5e7d0045ba6561532a36d75840b39aa209924c94
SHA512 c06082e1dd964a2b8ddb91ed5c38f0fb20fb9645e29ed6ead3444893e527a67c22ea2eaade3b55bedc148b6bc94463ef78b101f9123713268e7116f1f593635c
SSDEEP 1536:OflJnrh4iUxQYklMRbfKQ5Up2vCqMdDa5wcNG+jH0iMcMKYoe5V3CNBQkj2LOdBW:OflJnrqiUQYklMRbfKQ5Up2vCqMdDa5o
TLSH
T18E538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4234bd565e31f059eaf0d71f955deb67e590aaa31c96a551fd7b5052e34c7d26
MD5 c8be60c535e1c53910724052bd5ea041
SHA1 1f538dc8fbcb14039641eed28fbfda8e6ecf9a75
SHA512 a81130af1d13aad6bd95c0655004b67ee2e19c749b3259411bd15c8be75f767be1b004e3204a086e1c7092b9493fbf01ee5e9c3d7b9e6ae6c588efc2f827f1bc
TLSH
T14121B733B39CC6B5C9D901BBA488AD11B2B1C3C7049E8ECB7A84C518E57F599CB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 737c940dfd48782b86075d057d9737f5e80dfbc9571c6323df38e35b15b36d3a
MD5 904aa0f7a3b2471b6b6b8879b0de60bb
SHA1 61dd7234edd00a63f40bc58a5c76eab7e26db8b6
SHA512 95d17a2a6b62232597ceb3825217557f3aaf777911dd4e1c832ffa891c57014e3f02e5991aefe3ebbe09dfdb67f016a3c8c77c9a91ec7f8896d8cf5dc78e5716
TLSH
T11431D733B3ACC165C8C9217A208C9D007275C3C744DECFCB6B84C228A9BF6D9DB580A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bx5ldpuo.5em.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bx5ldpuo.5em.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4728-41-0x0000021C5F6A0000-0x0000021C5F6B0000-memory.dmp

Download

memory/4728-44-0x0000021C7B480000-0x0000021C7B4A4000-memory.dmp

Download

memory/4728-45-0x0000021C7B030000-0x0000021C7B03E000-memory.dmp

Download

memory/4728-43-0x0000021C7B480000-0x0000021C7B4AA000-memory.dmp

Download

memory/4728-40-0x0000021C5F6A0000-0x0000021C5F6B0000-memory.dmp

Download

memory/4728-39-0x0000021C7B040000-0x0000021C7B05C000-memory.dmp

Download

memory/4728-25-0x0000021C5F6A0000-0x0000021C5F6B0000-memory.dmp

Download

memory/4728-24-0x0000021C5F6A0000-0x0000021C5F6B0000-memory.dmp

Download

memory/5040-9-0x00007FF412E10000-0x00007FF412E20000-memory.dmp

Download

memory/5040-16-0x000001D02A020000-0x000001D02A03C000-memory.dmp

Download

memory/5040-0-0x000001D02A0A0000-0x000001D02A0B0000-memory.dmp

Download

memory/5040-20-0x000001D02A070000-0x000001D02A08A000-memory.dmp

Download

memory/5040-19-0x000001D02A040000-0x000001D02A050000-memory.dmp

Download

memory/5040-17-0x000001D02C320000-0x000001D02C3D3000-memory.dmp

Download

memory/5040-18-0x000001D02A010000-0x000001D02A01A000-memory.dmp

Download

memory/5040-8-0x000001D02A0A0000-0x000001D02A0B0000-memory.dmp

Download

memory/5040-7-0x000001D010420000-0x000001D010442000-memory.dmp

Download