Overview

overview

4

Static

static

3

Microsoft-...IO.cmd

windows7-x64

4

Microsoft-...IO.cmd

windows10-2004-x64

4

Microsoft-...on.cmd

windows7-x64

4

Microsoft-...on.cmd

windows10-2004-x64

4

Microsoft-...on.cmd

windows7-x64

4

Microsoft-...on.cmd

windows10-2004-x64

4

Microsoft-...t.html

windows7-x64

1

Microsoft-...t.html

windows10-2004-x64

1

Microsoft-...at.dll

windows7-x64

1

Microsoft-...at.dll

windows10-2004-x64

1

Microsoft-...at.dll

windows7-x64

1

Microsoft-...at.dll

windows10-2004-x64

1

Microsoft-...at.cmd

windows7-x64

4

Microsoft-...at.cmd

windows10-2004-x64

4

Microsoft-...at.cmd

windows7-x64

4

Microsoft-...at.cmd

windows10-2004-x64

4

Microsoft-...on.cmd

windows7-x64

4

Microsoft-...on.cmd

windows10-2004-x64

4

Microsoft-...bs.cmd

windows7-x64

1

Microsoft-...bs.cmd

windows10-2004-x64

1

Microsoft-...mi.cmd

windows7-x64

4

Microsoft-...mi.cmd

windows10-2004-x64

4

Microsoft-...er.cmd

windows7-x64

4

Microsoft-...er.cmd

windows10-2004-x64

4

Microsoft-...ot.cmd

windows7-x64

4

Microsoft-...ot.cmd

windows10-2004-x64

4

Microsoft-...e.html

windows7-x64

1

Microsoft-...e.html

windows10-2004-x64

1

Analysis

  • max time kernel
    121s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2023 08:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Microsoft-Activation-Scripts-2.2/Microsoft-Activation-Scripts-2.2/MAS/Separate-Files-Version/Activat.dll

  • Size

    9KB

  • MD5

    8ae2553e91fcad5c9fb1b89f9dd803bd

  • SHA1

    246730f83669d3460283c2a71b00c6ad93ebc87b

  • SHA256

    e6ac83560c19ec7eb868c50ea97ea0ed5632a397a9f43c17e24e6de4a694d118

  • SHA512

    2aa075ec134bc9359904b8ca174c3d1b002c87b5e7e50773c86f6b7d3a1654907dac49f906729c90cd1653cf97c32923c89451a0d9543d8a8b3cd66f0bb29251

  • SSDEEP

    192:eRUEV7qv9X/XCXmXUgXjZo0ZfeXCXnyEJ1cNMBye+qTx1G:eR3uvy2EpS8l

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.2\Microsoft-Activation-Scripts-2.2\MAS\Separate-Files-Version\Activat.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.2\Microsoft-Activation-Scripts-2.2\MAS\Separate-Files-Version\Activat.dll,#1
      2⤵
        PID:2368

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads