e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
Size

164KB
MD5

1945bbd917115976d38a472d0f986bbb
SHA1

8da5064553de2acf63c0245ca4486b63d0c2ce56
SHA256

bf6f4b7a45ee6e10b48d869f73c29bc90151ad74fc902ff6198bde039e679c01
SHA512

5fd220afb8f880e4162c1ed999f20c0e0fcf049a6550ee7faccaed0f87d95f9cc37fce7c3d75e513eec747fe24e578639b74f9d5c23ae72e0c9f762ed2c09568
SSDEEP

1536:A/W8j2b6vW5Tuac+4jCwjsisxsGLaNwgEMTV62m0I1zGDNSPKM0E2WYEDeFWwCI3:AwbJuAMTVFp6zGDNSCE2K6rT

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1680	sc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1680	2116	cmd.exe	29
PID 2116 wrote to memory of 1680	2116	cmd.exe	29
PID 2116 wrote to memory of 1680	2116	cmd.exe	29
PID 2116 wrote to memory of 2420	2116	cmd.exe	30
PID 2116 wrote to memory of 2420	2116	cmd.exe	30
PID 2116 wrote to memory of 2420	2116	cmd.exe	30
PID 2116 wrote to memory of 2424	2116	cmd.exe	31
PID 2116 wrote to memory of 2424	2116	cmd.exe	31
PID 2116 wrote to memory of 2424	2116	cmd.exe	31
PID 2116 wrote to memory of 2396	2116	cmd.exe	32
PID 2116 wrote to memory of 2396	2116	cmd.exe	32
PID 2116 wrote to memory of 2396	2116	cmd.exe	32
PID 2116 wrote to memory of 2992	2116	cmd.exe	33
PID 2116 wrote to memory of 2992	2116	cmd.exe	33
PID 2116 wrote to memory of 2992	2116	cmd.exe	33
PID 2116 wrote to memory of 1064	2116	cmd.exe	34
PID 2116 wrote to memory of 1064	2116	cmd.exe	34
PID 2116 wrote to memory of 1064	2116	cmd.exe	34
PID 2116 wrote to memory of 2224	2116	cmd.exe	35
PID 2116 wrote to memory of 2224	2116	cmd.exe	35
PID 2116 wrote to memory of 2224	2116	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:1680
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2420
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Online_KMS_Activation.cmd"
  2⤵
  PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
  2⤵
  PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd" "
  2⤵
  PID:1064
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2224