e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/Ohook_Activation.cmd
Size

69KB
MD5

6122bb7fb2b3b041848d2f7b2d2fc94e
SHA1

b7cd8760ff6334f4fede1e2d280140883ac73702
SHA256

732a450c02b49a9410b89a864116a951ba10d0439f9a9de2383c81e231f59c37
SHA512

41aabc8997148c0904a6c2e62d3f8bc87e1a1d1e1ca4b4dae367ed6bded00edb9d77c80c145bae05709739afee9f1926bddd875052eca6f55c8e8ff701333170
SSDEEP

768:NgPYZirxJk994J2JPH8HkkRFpnGu/eR/95pjS+C7S4lFh9z1Em8IcY/GwhT4fkJO:k3k402HbPIuWR/95pEmMdyiNeZYgT

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2812	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2924	powershell.exe
2920	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2812	2288	cmd.exe	29
PID 2288 wrote to memory of 2812	2288	cmd.exe	29
PID 2288 wrote to memory of 2812	2288	cmd.exe	29
PID 2288 wrote to memory of 2584	2288	cmd.exe	30
PID 2288 wrote to memory of 2584	2288	cmd.exe	30
PID 2288 wrote to memory of 2584	2288	cmd.exe	30
PID 2288 wrote to memory of 2600	2288	cmd.exe	31
PID 2288 wrote to memory of 2600	2288	cmd.exe	31
PID 2288 wrote to memory of 2600	2288	cmd.exe	31
PID 2288 wrote to memory of 2636	2288	cmd.exe	32
PID 2288 wrote to memory of 2636	2288	cmd.exe	32
PID 2288 wrote to memory of 2636	2288	cmd.exe	32
PID 2288 wrote to memory of 2924	2288	cmd.exe	33
PID 2288 wrote to memory of 2924	2288	cmd.exe	33
PID 2288 wrote to memory of 2924	2288	cmd.exe	33
PID 2288 wrote to memory of 2920	2288	cmd.exe	34
PID 2288 wrote to memory of 2920	2288	cmd.exe	34
PID 2288 wrote to memory of 2920	2288	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Ohook_Activation\Ohook_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2812
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2584
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Ohook_Activation.cmd"
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
62104ae7ef95f69b79b0801ff7a81589

SHA1
e1a5dec4615f83c38a3a834934591c58f8dab868

SHA256
d5e4bb950ad09d7127612364e573192f487c3c211ae6465241175d32f8b5af34

SHA512
06969179bdc50e105077d84b59d14b779293f55c11de9c3239a64e8260f6d872373e2977d7765399deefc58c87d4db60e793d023cbbf0ae45641223624244a25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\70HXBXFRMF3Y2X4WNWHS.temp

Filesize
7KB

MD5
62104ae7ef95f69b79b0801ff7a81589

SHA1
e1a5dec4615f83c38a3a834934591c58f8dab868

SHA256
d5e4bb950ad09d7127612364e573192f487c3c211ae6465241175d32f8b5af34

SHA512
06969179bdc50e105077d84b59d14b779293f55c11de9c3239a64e8260f6d872373e2977d7765399deefc58c87d4db60e793d023cbbf0ae45641223624244a25

Download Submit
memory/2920-19-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2920-18-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp

Filesize
9.6MB

Download
memory/2920-23-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp

Filesize
9.6MB

Download
memory/2920-22-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2920-21-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2920-20-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2920-15-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/2920-17-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2920-16-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp

Filesize
9.6MB

Download
memory/2924-7-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2924-4-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/2924-5-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/2924-6-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2924-8-0x0000000002934000-0x0000000002937000-memory.dmp

Filesize
12KB

Download
memory/2924-9-0x0000000002930000-0x00000000029B0000-memory.dmp

Filesize
512KB

Download