e22b39312f274bf684df96d1a69a0132987bef5dd97ad459cfe963f261dcf4e4

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 14:21

Target

Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
Size

54KB
MD5

7ddb1766a6574fd10e29303e24272ad1
SHA1

c91185a98353e64ebd4707e26fbbffa5d4d7e7c3
SHA256

005f28b334a8f0bc0b611a616e6558127d21dfec43a163ed4536c2bb46477ef9
SHA512

756b28a6787dc2de0d0372901982d4c384a02cf5517aa944ed2cbb2cebd23c172200f9220faf725b089ea97c8f81c878cd7e602a73b8721c1f89114ebe03549f
SSDEEP

768:h2zZiOKJ5yorr997+3YWSWMxahF438mpr8Fp9lvCRdi5NEjS+C7S4jFh0z1E6yfH:oi3yg2MxMMUflsdi54Em0Iy6yP4Nm36s

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1460	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1460	5004	cmd.exe	84
PID 5004 wrote to memory of 1460	5004	cmd.exe	84
PID 5004 wrote to memory of 2448	5004	cmd.exe	85
PID 5004 wrote to memory of 2448	5004	cmd.exe	85
PID 5004 wrote to memory of 736	5004	cmd.exe	86
PID 5004 wrote to memory of 736	5004	cmd.exe	86
PID 5004 wrote to memory of 2036	5004	cmd.exe	87
PID 5004 wrote to memory of 2036	5004	cmd.exe	87
PID 5004 wrote to memory of 1348	5004	cmd.exe	88
PID 5004 wrote to memory of 1348	5004	cmd.exe	88
PID 5004 wrote to memory of 1000	5004	cmd.exe	89
PID 5004 wrote to memory of 1000	5004	cmd.exe	89
PID 5004 wrote to memory of 1748	5004	cmd.exe	91
PID 5004 wrote to memory of 1748	5004	cmd.exe	91
PID 1748 wrote to memory of 4724	1748	cmd.exe	92
PID 1748 wrote to memory of 4724	1748	cmd.exe	92
PID 1748 wrote to memory of 2412	1748	cmd.exe	93
PID 1748 wrote to memory of 2412	1748	cmd.exe	93
PID 5004 wrote to memory of 3672	5004	cmd.exe	94
PID 5004 wrote to memory of 3672	5004	cmd.exe	94
PID 5004 wrote to memory of 2968	5004	cmd.exe	95
PID 5004 wrote to memory of 2968	5004	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\HWID_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:1460
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2448
- C:\Windows\System32\findstr.exe
  findstr /v "$" "HWID_Activation.cmd"
  2⤵
  PID:736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2036
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:1348
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:1000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4724
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\HWID_Activation.cmd" "
  2⤵
  PID:3672
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2968