82d8b325b7a98dec4d5187b6a3d488865e400a87d28a947b8ace056a3c2b49a0

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 15:33

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
Size

162KB
MD5

edeca307515d6ee64d790cc5d8a857a4
SHA1

2ab675ca7be2ca3ca47e2031189ad164d7d769fb
SHA256

58d5b27b3f6fa5e8cfa814a82ec53f85a54e39d9bc26bb6924b333e8a552cd67
SHA512

b2b82cab4f04e8f022ea85b7f144eec93ed23a08b7a9b9267f74bdb63e634e0bd15e35891cb37a1263af9dd11eae61377940e8a7bcee8e4ce0399d8961879f3c
SSDEEP

1536:ZW8+6b6vWkuac+4jCwjsisxsGLaNwgEMTV62m0I1zGDNSDKM0E2WYEDeFWwCIDR8:DbguAMTVFp6zGDNSOE2K6LW

Score

1^/10

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 376	2844	cmd.exe	86
PID 2844 wrote to memory of 376	2844	cmd.exe	86
PID 2844 wrote to memory of 5028	2844	cmd.exe	87
PID 2844 wrote to memory of 5028	2844	cmd.exe	87
PID 2844 wrote to memory of 684	2844	cmd.exe	88
PID 2844 wrote to memory of 684	2844	cmd.exe	88
PID 2844 wrote to memory of 2380	2844	cmd.exe	89
PID 2844 wrote to memory of 2380	2844	cmd.exe	89
PID 2844 wrote to memory of 5072	2844	cmd.exe	90
PID 2844 wrote to memory of 5072	2844	cmd.exe	90
PID 5072 wrote to memory of 804	5072	cmd.exe	91
PID 5072 wrote to memory of 804	5072	cmd.exe	91
PID 5072 wrote to memory of 896	5072	cmd.exe	92
PID 5072 wrote to memory of 896	5072	cmd.exe	92
PID 2844 wrote to memory of 4160	2844	cmd.exe	93
PID 2844 wrote to memory of 4160	2844	cmd.exe	93
PID 2844 wrote to memory of 952	2844	cmd.exe	94
PID 2844 wrote to memory of 952	2844	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System32\findstr.exe
  findstr /rxc:".*" "Online_KMS_Activation.cmd"
  2⤵
  PID:376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:5028
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:684
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:804
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd" "
  2⤵
  PID:4160
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:952