e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2023 14:21

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
Size

164KB
MD5

1945bbd917115976d38a472d0f986bbb
SHA1

8da5064553de2acf63c0245ca4486b63d0c2ce56
SHA256

bf6f4b7a45ee6e10b48d869f73c29bc90151ad74fc902ff6198bde039e679c01
SHA512

5fd220afb8f880e4162c1ed999f20c0e0fcf049a6550ee7faccaed0f87d95f9cc37fce7c3d75e513eec747fe24e578639b74f9d5c23ae72e0c9f762ed2c09568
SSDEEP

1536:A/W8j2b6vW5Tuac+4jCwjsisxsGLaNwgEMTV62m0I1zGDNSPKM0E2WYEDeFWwCI3:AwbJuAMTVFp6zGDNSCE2K6rT

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4964	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4964	3460	cmd.exe	87
PID 3460 wrote to memory of 4964	3460	cmd.exe	87
PID 3460 wrote to memory of 2972	3460	cmd.exe	88
PID 3460 wrote to memory of 2972	3460	cmd.exe	88
PID 3460 wrote to memory of 404	3460	cmd.exe	89
PID 3460 wrote to memory of 404	3460	cmd.exe	89
PID 3460 wrote to memory of 1492	3460	cmd.exe	90
PID 3460 wrote to memory of 1492	3460	cmd.exe	90
PID 3460 wrote to memory of 2740	3460	cmd.exe	91
PID 3460 wrote to memory of 2740	3460	cmd.exe	91
PID 3460 wrote to memory of 4104	3460	cmd.exe	92
PID 3460 wrote to memory of 4104	3460	cmd.exe	92
PID 3460 wrote to memory of 4552	3460	cmd.exe	93
PID 3460 wrote to memory of 4552	3460	cmd.exe	93
PID 4552 wrote to memory of 4920	4552	cmd.exe	94
PID 4552 wrote to memory of 4920	4552	cmd.exe	94
PID 4552 wrote to memory of 2468	4552	cmd.exe	95
PID 4552 wrote to memory of 2468	4552	cmd.exe	95
PID 3460 wrote to memory of 4504	3460	cmd.exe	97
PID 3460 wrote to memory of 4504	3460	cmd.exe	97
PID 3460 wrote to memory of 2596	3460	cmd.exe	96
PID 3460 wrote to memory of 2596	3460	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4964
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2972
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Online_KMS_Activation.cmd"
  2⤵
  PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1492
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:2740
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4920
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2468
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd" "
  2⤵
  PID:4504