3eb2ef4c8a27cf98f7c566d56f28e1145c6cfd38183b5cf386e23de60ed38297

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Microsoft-Activation-Scripts-2.2/Microsoft-Activation-Scripts-2.2/MAS/Separate-Files-Version/Change_Edition.cmd
Size

37KB
MD5

5f480dc2aa5d68547a4a5740aa1a5339
SHA1

835505d1be2f879dba6bf3f712232ed5013beac6
SHA256

be31e962df8b24db11f6a203206e23c287ecc060f820ba40d92641fea7471273
SHA512

25e66a036b2b794077872be9692f7b9a8edf129310bdc2d2c0eeecb1c179a1176905b8d81f84e52346ed2b0bfd721487ab2317f46dd7c712973f5e93003ecca3
SSDEEP

768:XnZi42JYV4AtJ0jij9H5EiXw5iWK4u34uHfIN:Xysx6+j9H5EiXw5iWdu34u/I

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2828	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2772	powershell.exe
2648	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2828	2096	cmd.exe	29
PID 2096 wrote to memory of 2828	2096	cmd.exe	29
PID 2096 wrote to memory of 2828	2096	cmd.exe	29
PID 2096 wrote to memory of 2836	2096	cmd.exe	30
PID 2096 wrote to memory of 2836	2096	cmd.exe	30
PID 2096 wrote to memory of 2836	2096	cmd.exe	30
PID 2096 wrote to memory of 2912	2096	cmd.exe	31
PID 2096 wrote to memory of 2912	2096	cmd.exe	31
PID 2096 wrote to memory of 2912	2096	cmd.exe	31
PID 2096 wrote to memory of 2920	2096	cmd.exe	32
PID 2096 wrote to memory of 2920	2096	cmd.exe	32
PID 2096 wrote to memory of 2920	2096	cmd.exe	32
PID 2096 wrote to memory of 2220	2096	cmd.exe	33
PID 2096 wrote to memory of 2220	2096	cmd.exe	33
PID 2096 wrote to memory of 2220	2096	cmd.exe	33
PID 2096 wrote to memory of 3048	2096	cmd.exe	34
PID 2096 wrote to memory of 3048	2096	cmd.exe	34
PID 2096 wrote to memory of 3048	2096	cmd.exe	34
PID 2096 wrote to memory of 2772	2096	cmd.exe	35
PID 2096 wrote to memory of 2772	2096	cmd.exe	35
PID 2096 wrote to memory of 2772	2096	cmd.exe	35
PID 2096 wrote to memory of 2648	2096	cmd.exe	36
PID 2096 wrote to memory of 2648	2096	cmd.exe	36
PID 2096 wrote to memory of 2648	2096	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.2\Microsoft-Activation-Scripts-2.2\MAS\Separate-Files-Version\Change_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2828
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2836
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Edition.cmd"
  2⤵
  PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.2\Microsoft-Activation-Scripts-2.2\MAS\Separate-Files-Version\Change_Edition.cmd" "
  2⤵
  PID:2220
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
23347829534b7ab6282f2a61835aeafb

SHA1
d5c922d9a49e47048f20de46702101042200451d

SHA256
76db1a10eb89020584184e8f30b98cb7b27b5baf094c6ac29675ed496aa2f421

SHA512
195a7211608596446f5ea4b90a053aeba9d73f66f8df57624bc60b3956302700d2ccb3f69a7fe00e4335b9fa631017cdb6e688f3cf4c917a3a8c6de615fc3ffa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\935KVAV46K8Y4IIY30CY.temp

Filesize
7KB

MD5
23347829534b7ab6282f2a61835aeafb

SHA1
d5c922d9a49e47048f20de46702101042200451d

SHA256
76db1a10eb89020584184e8f30b98cb7b27b5baf094c6ac29675ed496aa2f421

SHA512
195a7211608596446f5ea4b90a053aeba9d73f66f8df57624bc60b3956302700d2ccb3f69a7fe00e4335b9fa631017cdb6e688f3cf4c917a3a8c6de615fc3ffa

Download Submit
memory/2648-22-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2648-20-0x000007FEF5000000-0x000007FEF599D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-26-0x000007FEF5000000-0x000007FEF599D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-25-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2648-24-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2648-23-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2648-21-0x000007FEF5000000-0x000007FEF599D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-18-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2648-19-0x0000000001EA0000-0x0000000001EA8000-memory.dmp

Filesize
32KB

Download
memory/2772-11-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/2772-5-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-6-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/2772-12-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-4-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/2772-7-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2772-10-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/2772-9-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/2772-8-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download