e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Change_Edition.cmd
Size

37KB
MD5

5f480dc2aa5d68547a4a5740aa1a5339
SHA1

835505d1be2f879dba6bf3f712232ed5013beac6
SHA256

be31e962df8b24db11f6a203206e23c287ecc060f820ba40d92641fea7471273
SHA512

25e66a036b2b794077872be9692f7b9a8edf129310bdc2d2c0eeecb1c179a1176905b8d81f84e52346ed2b0bfd721487ab2317f46dd7c712973f5e93003ecca3
SSDEEP

768:XnZi42JYV4AtJ0jij9H5EiXw5iWK4u34uHfIN:Xysx6+j9H5EiXw5iWdu34u/I

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5080	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5080	4228	cmd.exe	84
PID 4228 wrote to memory of 5080	4228	cmd.exe	84
PID 4228 wrote to memory of 3404	4228	cmd.exe	86
PID 4228 wrote to memory of 3404	4228	cmd.exe	86
PID 4228 wrote to memory of 1116	4228	cmd.exe	87
PID 4228 wrote to memory of 1116	4228	cmd.exe	87
PID 4228 wrote to memory of 2708	4228	cmd.exe	89
PID 4228 wrote to memory of 2708	4228	cmd.exe	89
PID 4228 wrote to memory of 3036	4228	cmd.exe	90
PID 4228 wrote to memory of 3036	4228	cmd.exe	90
PID 4228 wrote to memory of 2432	4228	cmd.exe	91
PID 4228 wrote to memory of 2432	4228	cmd.exe	91
PID 4228 wrote to memory of 1528	4228	cmd.exe	92
PID 4228 wrote to memory of 1528	4228	cmd.exe	92
PID 1528 wrote to memory of 4744	1528	cmd.exe	93
PID 1528 wrote to memory of 4744	1528	cmd.exe	93
PID 1528 wrote to memory of 4176	1528	cmd.exe	94
PID 1528 wrote to memory of 4176	1528	cmd.exe	94
PID 4228 wrote to memory of 4604	4228	cmd.exe	95
PID 4228 wrote to memory of 4604	4228	cmd.exe	95
PID 4228 wrote to memory of 4296	4228	cmd.exe	96
PID 4228 wrote to memory of 4296	4228	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Change_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:5080
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:3404
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Edition.cmd"
  2⤵
  PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2708
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:3036
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4744
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Change_Edition.cmd" "
  2⤵
  PID:4604
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4296