e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Troubleshoot.cmd
Size

38KB
MD5

beac060647ef7ce4087fb790cb44d082
SHA1

e858dc008a6115735b39174dd3be4b9bff9a280d
SHA256

c7032a5efebea5ee06fed4cb58bcb67839e039cc73c97d466bbf1d318626b911
SHA512

c5f056df23e64d12330d8f1145268d292b090411de4adea40e1f59413d299fdf0bd33b24e59a6183b1746ae251d272d27ece64449dfd925a665495cd68425358
SSDEEP

768:PUZihR+nP2+DD1wA7nt79Bhl3XB+OLZrsxpjN:PZ+nPN1PBPhl3X9Y

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2276	sc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2276	2404	cmd.exe	29
PID 2404 wrote to memory of 2276	2404	cmd.exe	29
PID 2404 wrote to memory of 2276	2404	cmd.exe	29
PID 2404 wrote to memory of 2596	2404	cmd.exe	30
PID 2404 wrote to memory of 2596	2404	cmd.exe	30
PID 2404 wrote to memory of 2596	2404	cmd.exe	30
PID 2404 wrote to memory of 2808	2404	cmd.exe	31
PID 2404 wrote to memory of 2808	2404	cmd.exe	31
PID 2404 wrote to memory of 2808	2404	cmd.exe	31
PID 2404 wrote to memory of 1316	2404	cmd.exe	32
PID 2404 wrote to memory of 1316	2404	cmd.exe	32
PID 2404 wrote to memory of 1316	2404	cmd.exe	32
PID 2404 wrote to memory of 1892	2404	cmd.exe	33
PID 2404 wrote to memory of 1892	2404	cmd.exe	33
PID 2404 wrote to memory of 1892	2404	cmd.exe	33
PID 2404 wrote to memory of 2604	2404	cmd.exe	34
PID 2404 wrote to memory of 2604	2404	cmd.exe	34
PID 2404 wrote to memory of 2604	2404	cmd.exe	34
PID 2404 wrote to memory of 2376	2404	cmd.exe	35
PID 2404 wrote to memory of 2376	2404	cmd.exe	35
PID 2404 wrote to memory of 2376	2404	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Troubleshoot.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2276
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2596
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Troubleshoot.cmd"
  2⤵
  PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
  2⤵
  PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Troubleshoot.cmd" "
  2⤵
  PID:2604
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2376