6e1c01fa1c4e65dad20daebe1c00c73b02a4ede6525f091314e52a8848201e1d

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sul_File_Hider.bat
Size 7KB
Sample260529-vr856aay2y
SHA256 6e1c01fa1c4e65dad20daebe1c00c73b02a4ede6525f091314e52a8848201e1d
MD5 6be49a5f277146b78b3ce8ba2d2358b5
SHA1 c1fdb70ea3f73c2e2822eb86eb33cebcd97f269b
SHA512 1b40a28679a60788a13ac6ad0861fe7986d2a5a390552acdf78f793e2fffa6f50d6efc9d92b7611f7dbb67e8c1ad4e6e2c65f8aeec5e2ad22d91f30cc7d508d1
SSDEEP 96:Z0TIDTsvGGGKtQClhtrUbT7MNMC107sPNEYIDKvUi:ZbDTsjttYwf1fPCDKb
TLSH
T17DF19465BC40AD1A1C798BB2763461F4F314C09F065D6AAE740FB0706FEC7C614AEAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4660	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2308	PING.EXE
3796	PING.EXE
1388	PING.EXE
2200	PING.EXE
4524	PING.EXE
2348	PING.EXE
4272	PING.EXE
2248	PING.EXE
2104	PING.EXE
208	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1388	PING.EXE
2200	PING.EXE
4524	PING.EXE
2348	PING.EXE
2248	PING.EXE
208	PING.EXE
3796	PING.EXE
4272	PING.EXE
2104	PING.EXE
2308	PING.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 748	3272	cmd.exe	86
PID 3272 wrote to memory of 1388	3272	cmd.exe	87
PID 3272 wrote to memory of 2200	3272	cmd.exe	92
PID 3272 wrote to memory of 4524	3272	cmd.exe	93
PID 3272 wrote to memory of 2348	3272	cmd.exe	94
PID 3272 wrote to memory of 4272	3272	cmd.exe	95
PID 3272 wrote to memory of 2248	3272	cmd.exe	98
PID 3272 wrote to memory of 2104	3272	cmd.exe	99
PID 3272 wrote to memory of 2308	3272	cmd.exe	100
PID 3272 wrote to memory of 208	3272	cmd.exe	101
PID 3272 wrote to memory of 3796	3272	cmd.exe	102
PID 3272 wrote to memory of 2076	3272	cmd.exe	103
PID 3272 wrote to memory of 4660	3272	cmd.exe	104

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4660	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sul_File_Hider.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Z "C:\Users\Admin\AppData\Local\Temp\Sul_File_Hider.bat" nul
  2⤵
  PID:748
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1388
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2200
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4524
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2348
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4272
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2248
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2104
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2308
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:208
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3796
- C:\Windows\system32\mode.com
  mode con: cols=65 lines=22
  2⤵
  PID:2076
- C:\Windows\system32\attrib.exe
  attrib +S +H "C:\Users\Admin\Contacts\FFHide"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads