6dfaadd27a38c7cffe6ee39e4efbc7881e02079ea620510c9b590ee420ba784c

Analysis

user interaction
yes
max time kernel
76s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WIFI-BRUTEFORCE-main/WIFIBRUTEBYARNOB.bat
Size 7KB
Sample260419-s78s8aes6p
SHA256 6dfaadd27a38c7cffe6ee39e4efbc7881e02079ea620510c9b590ee420ba784c
MD5 5674aaaf1931a026887d8451784530fc
SHA1 6eee47813c9292c4c892a6524915614d1961a6a8
SHA512 c1e432022ea1834310058236815f071da4f8a03a6e26c9692afbc717a01476144a587516b9852f0ca7fcf6b7c7c1b88108c9080350701e513caa00daadd78bae
SSDEEP 192:5Mxf8IyvcP6pE2N4SPCRPC3oPCBEaqJXso6q:5ybyvm92FPOhFXso6q
TLSH
T168F111A67C00051306E7CA73DB2885A9F661C09317111F8976AEC1BADFB17E0716F7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5748	timeout.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 4444	5380	cmd.exe	88
PID 5380 wrote to memory of 4624	5380	cmd.exe	89
PID 5380 wrote to memory of 4572	5380	cmd.exe	90
PID 5380 wrote to memory of 3380	5380	cmd.exe	91
PID 5380 wrote to memory of 5828	5380	cmd.exe	92
PID 5380 wrote to memory of 2460	5380	cmd.exe	93
PID 5380 wrote to memory of 3680	5380	cmd.exe	101
PID 5380 wrote to memory of 1132	5380	cmd.exe	102
PID 5380 wrote to memory of 4088	5380	cmd.exe	103
PID 5380 wrote to memory of 3940	5380	cmd.exe	104
PID 5380 wrote to memory of 3028	5380	cmd.exe	105
PID 5380 wrote to memory of 2040	5380	cmd.exe	106
PID 5380 wrote to memory of 1984	5380	cmd.exe	109
PID 5380 wrote to memory of 4868	5380	cmd.exe	110
PID 5380 wrote to memory of 2636	5380	cmd.exe	111
PID 5380 wrote to memory of 5748	5380	cmd.exe	112
PID 5380 wrote to memory of 1892	5380	cmd.exe	113
PID 1892 wrote to memory of 3900	1892	cmd.exe	114
PID 1892 wrote to memory of 5012	1892	cmd.exe	115
PID 5380 wrote to memory of 1472	5380	cmd.exe	116
PID 5380 wrote to memory of 3116	5380	cmd.exe	117
PID 5380 wrote to memory of 1728	5380	cmd.exe	118
PID 5380 wrote to memory of 3308	5380	cmd.exe	119
PID 5380 wrote to memory of 3192	5380	cmd.exe	120
PID 5380 wrote to memory of 5844	5380	cmd.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WIFI-BRUTEFORCE-main\WIFIBRUTEBYARNOB.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
  2⤵
  PID:4444
- C:\Windows\system32\netsh.exe
  netsh wlan show interface
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4624
- C:\Windows\system32\find.exe
  Find "connected"
  2⤵
  PID:4572
- C:\Windows\system32\findstr.exe
  findstr /v /a:0c /R "^$" "admin" nul
  2⤵
  PID:3380
- C:\Windows\system32\findstr.exe
  findstr /v /a:0e /R "^$" "@" nul
  2⤵
  PID:5828
- C:\Windows\system32\findstr.exe
  findstr /v /a:0f /R "^$" "user" nul
  2⤵
  PID:2460
- C:\Windows\system32\findstr.exe
  findstr /v /a:0c /R "^$" "admin" nul
  2⤵
  PID:3680
- C:\Windows\system32\findstr.exe
  findstr /v /a:0e /R "^$" "@" nul
  2⤵
  PID:1132
- C:\Windows\system32\findstr.exe
  findstr /v /a:0f /R "^$" "user" nul
  2⤵
  PID:4088
- C:\Windows\system32\findstr.exe
  findstr /v /a:0c /R "^$" "admin" nul
  2⤵
  PID:3940
- C:\Windows\system32\findstr.exe
  findstr /v /a:0e /R "^$" "@" nul
  2⤵
  PID:3028
- C:\Windows\system32\findstr.exe
  findstr /v /a:0f /R "^$" "user" nul
  2⤵
  PID:2040
- C:\Windows\system32\findstr.exe
  findstr /v /a:0c /R "^$" "admin" nul
  2⤵
  PID:1984
- C:\Windows\system32\findstr.exe
  findstr /v /a:0e /R "^$" "@" nul
  2⤵
  PID:4868
- C:\Windows\system32\findstr.exe
  findstr /v /a:0f /R "^$" "user" nul
  2⤵
  PID:2636
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show networks|find "SSID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3900
- - C:\Windows\system32\find.exe
    find "SSID"
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" type output.txt "
  2⤵
  PID:1472
- C:\Windows\system32\find.exe
  find "wifi1"
  2⤵
  PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type output2.txt
  2⤵
  PID:1728
- C:\Windows\system32\findstr.exe
  findstr /v /a:0c /R "^$" "admin" nul
  2⤵
  PID:3308
- C:\Windows\system32\findstr.exe
  findstr /v /a:0e /R "^$" "@" nul
  2⤵
  PID:3192
- C:\Windows\system32\findstr.exe
  findstr /v /a:0f /R "^$" "user" nul
  2⤵
  PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

admin

Path C:\Users\Admin\AppData\Local\Temp\WIFI-BRUTEFORCE-main\BRUTE-FORCE-FILES\admin
Size 3B
SHA256 3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351
MD5 df66fa563a2fafdb93cc559deb0a38c4
SHA1 e6666cf8574b0f7a9ae5bccee572f965c2aec9cb
SHA512 34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads