e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/All-In-One-Version/MAS_AIO.cmd
Size

425KB
MD5

d3caa81fb77f8b2e90a81c47a43565c4
SHA1

9e47d9b039d325e66a22b874e4eb2d265669c4f3
SHA256

5697fdf7c6a11b7a3d48d492976f820a0f9c1a2d49ada258c411924a4e3c816b
SHA512

1bf881e71c5ae83b764a292fbafd12d6f7fb57547f7c064f434d81f36c5391b9ca97192d9988c27af5ac36870c9f69a5a66dfce0d95c01dee7e9b77af496022b
SSDEEP

3072:HR34RE57N9H7PIu0R/iNiYCCh3MPfiavbbJuAMTVFp6zGDNSCE2K6rOuW7EOGJGo:xjXEu0R6SChAbJu9p6zGDNS0K8OuD3

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3012	sc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3012	2596	cmd.exe	30
PID 2596 wrote to memory of 3012	2596	cmd.exe	30
PID 2596 wrote to memory of 3012	2596	cmd.exe	30
PID 2596 wrote to memory of 3044	2596	cmd.exe	29
PID 2596 wrote to memory of 3044	2596	cmd.exe	29
PID 2596 wrote to memory of 3044	2596	cmd.exe	29
PID 2596 wrote to memory of 3060	2596	cmd.exe	31
PID 2596 wrote to memory of 3060	2596	cmd.exe	31
PID 2596 wrote to memory of 3060	2596	cmd.exe	31
PID 2596 wrote to memory of 1652	2596	cmd.exe	32
PID 2596 wrote to memory of 1652	2596	cmd.exe	32
PID 2596 wrote to memory of 1652	2596	cmd.exe	32
PID 2596 wrote to memory of 1208	2596	cmd.exe	33
PID 2596 wrote to memory of 1208	2596	cmd.exe	33
PID 2596 wrote to memory of 1208	2596	cmd.exe	33
PID 2596 wrote to memory of 3056	2596	cmd.exe	34
PID 2596 wrote to memory of 3056	2596	cmd.exe	34
PID 2596 wrote to memory of 3056	2596	cmd.exe	34
PID 2596 wrote to memory of 2940	2596	cmd.exe	35
PID 2596 wrote to memory of 2940	2596	cmd.exe	35
PID 2596 wrote to memory of 2940	2596	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\All-In-One-Version\MAS_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:3044
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:3012
- C:\Windows\System32\findstr.exe
  findstr /v "$" "MAS_AIO.cmd"
  2⤵
  PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
  2⤵
  PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\All-In-One-Version\MAS_AIO.cmd" "
  2⤵
  PID:3056
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2940