427cb3f195d9a3bae9d7d06cf7779ff73f007a6ffb703c4f69ac988fa653cb5c

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
! Window Mode.bat
Size 446B
Sample260913-alhqsshq91
SHA256 427cb3f195d9a3bae9d7d06cf7779ff73f007a6ffb703c4f69ac988fa653cb5c
MD5 07c5574464b486c6a1b7c97d4d0fdf30
SHA1 33fd1e18a0ae15a6ffef5851ee652ff077a04be2
SHA512 d78be947214a19416c0cad032860712d347b108fe2b79978b08a84906ab1deca193e847597f84e1ef92ac8a1a8e975f707df7e9c4c4fc65917a4bf00a9b02025
TLSH
T118F0A7B53F6BD03A673543F15880A82250FEB0436BD72D9310296D59599918E1F35A18
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
620	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2208	PING.EXE
4168	PING.EXE
3932	PING.EXE
4720	PING.EXE
1412	PING.EXE

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
4720	PING.EXE
1412	PING.EXE
2208	PING.EXE
4168	PING.EXE
3932	PING.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 4720	620	cmd.exe	86
PID 620 wrote to memory of 1412	620	cmd.exe	87
PID 620 wrote to memory of 2208	620	cmd.exe	88
PID 620 wrote to memory of 4168	620	cmd.exe	89
PID 620 wrote to memory of 3932	620	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\! Window Mode.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 1000 localhost
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4720
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 1000 localhost
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1412
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 1000 localhost
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2208
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 1000 localhost
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4168
- C:\Windows\system32\PING.EXE
  ping -n 1 -w 1000 localhost
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads