e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Troubleshoot.cmd
Size

38KB
MD5

beac060647ef7ce4087fb790cb44d082
SHA1

e858dc008a6115735b39174dd3be4b9bff9a280d
SHA256

c7032a5efebea5ee06fed4cb58bcb67839e039cc73c97d466bbf1d318626b911
SHA512

c5f056df23e64d12330d8f1145268d292b090411de4adea40e1f59413d299fdf0bd33b24e59a6183b1746ae251d272d27ece64449dfd925a665495cd68425358
SSDEEP

768:PUZihR+nP2+DD1wA7nt79Bhl3XB+OLZrsxpjN:PZ+nPN1PBPhl3X9Y

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1540	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1540	1632	cmd.exe	86
PID 1632 wrote to memory of 1540	1632	cmd.exe	86
PID 1632 wrote to memory of 1528	1632	cmd.exe	87
PID 1632 wrote to memory of 1528	1632	cmd.exe	87
PID 1632 wrote to memory of 4944	1632	cmd.exe	88
PID 1632 wrote to memory of 4944	1632	cmd.exe	88
PID 1632 wrote to memory of 4864	1632	cmd.exe	89
PID 1632 wrote to memory of 4864	1632	cmd.exe	89
PID 1632 wrote to memory of 4968	1632	cmd.exe	90
PID 1632 wrote to memory of 4968	1632	cmd.exe	90
PID 1632 wrote to memory of 2716	1632	cmd.exe	91
PID 1632 wrote to memory of 2716	1632	cmd.exe	91
PID 1632 wrote to memory of 4460	1632	cmd.exe	92
PID 1632 wrote to memory of 4460	1632	cmd.exe	92
PID 4460 wrote to memory of 4472	4460	cmd.exe	93
PID 4460 wrote to memory of 4472	4460	cmd.exe	93
PID 4460 wrote to memory of 4568	4460	cmd.exe	94
PID 4460 wrote to memory of 4568	4460	cmd.exe	94
PID 1632 wrote to memory of 3860	1632	cmd.exe	95
PID 1632 wrote to memory of 3860	1632	cmd.exe	95
PID 1632 wrote to memory of 3376	1632	cmd.exe	96
PID 1632 wrote to memory of 3376	1632	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Troubleshoot.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:1540
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:1528
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Troubleshoot.cmd"
  2⤵
  PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:4864
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4968
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4472
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Troubleshoot.cmd" "
  2⤵
  PID:3860
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3376