e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/Ohook_Activation.cmd
Size

69KB
MD5

6122bb7fb2b3b041848d2f7b2d2fc94e
SHA1

b7cd8760ff6334f4fede1e2d280140883ac73702
SHA256

732a450c02b49a9410b89a864116a951ba10d0439f9a9de2383c81e231f59c37
SHA512

41aabc8997148c0904a6c2e62d3f8bc87e1a1d1e1ca4b4dae367ed6bded00edb9d77c80c145bae05709739afee9f1926bddd875052eca6f55c8e8ff701333170
SSDEEP

768:NgPYZirxJk994J2JPH8HkkRFpnGu/eR/95pjS+C7S4lFh9z1Em8IcY/GwhT4fkJO:k3k402HbPIuWR/95pEmMdyiNeZYgT

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4076	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4076	5096	cmd.exe	86
PID 5096 wrote to memory of 4076	5096	cmd.exe	86
PID 5096 wrote to memory of 3112	5096	cmd.exe	87
PID 5096 wrote to memory of 3112	5096	cmd.exe	87
PID 5096 wrote to memory of 5116	5096	cmd.exe	88
PID 5096 wrote to memory of 5116	5096	cmd.exe	88
PID 5096 wrote to memory of 5032	5096	cmd.exe	89
PID 5096 wrote to memory of 5032	5096	cmd.exe	89
PID 5096 wrote to memory of 4700	5096	cmd.exe	90
PID 5096 wrote to memory of 4700	5096	cmd.exe	90
PID 5096 wrote to memory of 3140	5096	cmd.exe	91
PID 5096 wrote to memory of 3140	5096	cmd.exe	91
PID 5096 wrote to memory of 3848	5096	cmd.exe	92
PID 5096 wrote to memory of 3848	5096	cmd.exe	92
PID 3848 wrote to memory of 3904	3848	cmd.exe	93
PID 3848 wrote to memory of 3904	3848	cmd.exe	93
PID 3848 wrote to memory of 4276	3848	cmd.exe	94
PID 3848 wrote to memory of 4276	3848	cmd.exe	94
PID 5096 wrote to memory of 3800	5096	cmd.exe	95
PID 5096 wrote to memory of 3800	5096	cmd.exe	95
PID 5096 wrote to memory of 1968	5096	cmd.exe	96
PID 5096 wrote to memory of 1968	5096	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Ohook_Activation\Ohook_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4076
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:3112
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Ohook_Activation.cmd"
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:5032
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4700
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3904
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Ohook_Activation\Ohook_Activation.cmd" "
  2⤵
  PID:3800
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:1968