e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/All-In-One-Version/MAS_AIO.cmd
Size

425KB
MD5

d3caa81fb77f8b2e90a81c47a43565c4
SHA1

9e47d9b039d325e66a22b874e4eb2d265669c4f3
SHA256

5697fdf7c6a11b7a3d48d492976f820a0f9c1a2d49ada258c411924a4e3c816b
SHA512

1bf881e71c5ae83b764a292fbafd12d6f7fb57547f7c064f434d81f36c5391b9ca97192d9988c27af5ac36870c9f69a5a66dfce0d95c01dee7e9b77af496022b
SSDEEP

3072:HR34RE57N9H7PIu0R/iNiYCCh3MPfiavbbJuAMTVFp6zGDNSCE2K6rOuW7EOGJGo:xjXEu0R6SChAbJu9p6zGDNS0K8OuD3

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1296	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1296	632	cmd.exe	86
PID 632 wrote to memory of 1296	632	cmd.exe	86
PID 632 wrote to memory of 2280	632	cmd.exe	87
PID 632 wrote to memory of 2280	632	cmd.exe	87
PID 632 wrote to memory of 4472	632	cmd.exe	88
PID 632 wrote to memory of 4472	632	cmd.exe	88
PID 632 wrote to memory of 1092	632	cmd.exe	89
PID 632 wrote to memory of 1092	632	cmd.exe	89
PID 632 wrote to memory of 4364	632	cmd.exe	91
PID 632 wrote to memory of 4364	632	cmd.exe	91
PID 632 wrote to memory of 4300	632	cmd.exe	90
PID 632 wrote to memory of 4300	632	cmd.exe	90
PID 632 wrote to memory of 872	632	cmd.exe	92
PID 632 wrote to memory of 872	632	cmd.exe	92
PID 872 wrote to memory of 2696	872	cmd.exe	93
PID 872 wrote to memory of 2696	872	cmd.exe	93
PID 872 wrote to memory of 4504	872	cmd.exe	94
PID 872 wrote to memory of 4504	872	cmd.exe	94
PID 632 wrote to memory of 4148	632	cmd.exe	95
PID 632 wrote to memory of 4148	632	cmd.exe	95
PID 632 wrote to memory of 2872	632	cmd.exe	96
PID 632 wrote to memory of 2872	632	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\All-In-One-Version\MAS_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:1296
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2280
- C:\Windows\System32\findstr.exe
  findstr /v "$" "MAS_AIO.cmd"
  2⤵
  PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1092
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4300
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:2696
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\All-In-One-Version\MAS_AIO.cmd" "
  2⤵
  PID:4148
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2872