e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Change_Edition.cmd
Size

37KB
MD5

5f480dc2aa5d68547a4a5740aa1a5339
SHA1

835505d1be2f879dba6bf3f712232ed5013beac6
SHA256

be31e962df8b24db11f6a203206e23c287ecc060f820ba40d92641fea7471273
SHA512

25e66a036b2b794077872be9692f7b9a8edf129310bdc2d2c0eeecb1c179a1176905b8d81f84e52346ed2b0bfd721487ab2317f46dd7c712973f5e93003ecca3
SSDEEP

768:XnZi42JYV4AtJ0jij9H5EiXw5iWK4u34uHfIN:Xysx6+j9H5EiXw5iWdu34u/I

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2560	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	powershell.exe
2788	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2560	2164	cmd.exe	29
PID 2164 wrote to memory of 2560	2164	cmd.exe	29
PID 2164 wrote to memory of 2560	2164	cmd.exe	29
PID 2164 wrote to memory of 2924	2164	cmd.exe	30
PID 2164 wrote to memory of 2924	2164	cmd.exe	30
PID 2164 wrote to memory of 2924	2164	cmd.exe	30
PID 2164 wrote to memory of 2800	2164	cmd.exe	31
PID 2164 wrote to memory of 2800	2164	cmd.exe	31
PID 2164 wrote to memory of 2800	2164	cmd.exe	31
PID 2164 wrote to memory of 3008	2164	cmd.exe	32
PID 2164 wrote to memory of 3008	2164	cmd.exe	32
PID 2164 wrote to memory of 3008	2164	cmd.exe	32
PID 2164 wrote to memory of 1152	2164	cmd.exe	33
PID 2164 wrote to memory of 1152	2164	cmd.exe	33
PID 2164 wrote to memory of 1152	2164	cmd.exe	33
PID 2164 wrote to memory of 2076	2164	cmd.exe	34
PID 2164 wrote to memory of 2076	2164	cmd.exe	34
PID 2164 wrote to memory of 2076	2164	cmd.exe	34
PID 2164 wrote to memory of 1984	2164	cmd.exe	35
PID 2164 wrote to memory of 1984	2164	cmd.exe	35
PID 2164 wrote to memory of 1984	2164	cmd.exe	35
PID 2164 wrote to memory of 2788	2164	cmd.exe	36
PID 2164 wrote to memory of 2788	2164	cmd.exe	36
PID 2164 wrote to memory of 2788	2164	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Change_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2924
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Edition.cmd"
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Change_Edition.cmd" "
  2⤵
  PID:1152
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7be6ca0b7bde0665c26b9f0bf7697f7f

SHA1
9ae977f2f648ed4b162020e329c2ba389eca7e4d

SHA256
71a1a6dafa0c4ba17e2d1b1460228245655775b724efb543be8ce0d55cf78760

SHA512
8f3f87b37fc7ab91cc5867b69f466232d9c1e85cc904ca524cab00c78fb7999de7cb4999f1853dd86c1e4f56520e8cbbe537d73ef7a034d122567aec7a335989

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\98T1HGFN4UJRM5R87AXC.temp

Filesize
7KB

MD5
7be6ca0b7bde0665c26b9f0bf7697f7f

SHA1
9ae977f2f648ed4b162020e329c2ba389eca7e4d

SHA256
71a1a6dafa0c4ba17e2d1b1460228245655775b724efb543be8ce0d55cf78760

SHA512
8f3f87b37fc7ab91cc5867b69f466232d9c1e85cc904ca524cab00c78fb7999de7cb4999f1853dd86c1e4f56520e8cbbe537d73ef7a034d122567aec7a335989

Download Submit
memory/1984-12-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/1984-7-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/1984-8-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/1984-9-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/1984-10-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/1984-11-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/1984-4-0x000000001B160000-0x000000001B442000-memory.dmp

Filesize
2.9MB

Download
memory/1984-6-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/1984-5-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/2788-19-0x000007FEF4AB0000-0x000007FEF544D000-memory.dmp

Filesize
9.6MB

Download
memory/2788-18-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download
memory/2788-20-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/2788-22-0x000007FEF4AB0000-0x000007FEF544D000-memory.dmp

Filesize
9.6MB

Download
memory/2788-23-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/2788-21-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/2788-24-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/2788-25-0x000007FEF4AB0000-0x000007FEF544D000-memory.dmp

Filesize
9.6MB

Download