408d69cc08e159b7f34fc7124b7ddc599a07bc2df9323fa43cf7e13369dabb55

Analysis

max time kernel
7s
max time network
8s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 13:37

Target

Windows-Activator-SyntaxServices/Microsoft-Activator/MAS/All-In-One-Version/MAS_AIO-CRC32_31F7FD1E.cmd
Size

438KB
MD5

88d518ea04598e056440635851ba61db
SHA1

22c62949a561e0172a8c1a870862cd7b64d09738
SHA256

533e16e27044e4b3373290f23ffac3863481747bca5ae9de31c3b84396dee4e0
SHA512

45af822ee9565a9962e6bcbfce93c31f15eaa39bad3bc6a97791366ec9547011c2ff933411d8b883ef54367dcc3588a1a737d63f1a528dedc1cdc98ab4aedecf
SSDEEP

3072:M/dR3S9mF2TJRMP0u+RciNiYFRd8nVFR3mP5sLtV7bJuAMTVFp6zGDNSCE2K0xOn:KAnHu+R7VLo97bJu9p6zGDNS0KgOuCV

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2768	sc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2768	2692	cmd.exe	31
PID 2692 wrote to memory of 2768	2692	cmd.exe	31
PID 2692 wrote to memory of 2768	2692	cmd.exe	31
PID 2692 wrote to memory of 2776	2692	cmd.exe	32
PID 2692 wrote to memory of 2776	2692	cmd.exe	32
PID 2692 wrote to memory of 2776	2692	cmd.exe	32
PID 2692 wrote to memory of 2740	2692	cmd.exe	33
PID 2692 wrote to memory of 2740	2692	cmd.exe	33
PID 2692 wrote to memory of 2740	2692	cmd.exe	33
PID 2692 wrote to memory of 2696	2692	cmd.exe	34
PID 2692 wrote to memory of 2696	2692	cmd.exe	34
PID 2692 wrote to memory of 2696	2692	cmd.exe	34
PID 2692 wrote to memory of 1736	2692	cmd.exe	35
PID 2692 wrote to memory of 1736	2692	cmd.exe	35
PID 2692 wrote to memory of 1736	2692	cmd.exe	35
PID 2692 wrote to memory of 2060	2692	cmd.exe	36
PID 2692 wrote to memory of 2060	2692	cmd.exe	36
PID 2692 wrote to memory of 2060	2692	cmd.exe	36
PID 2692 wrote to memory of 2652	2692	cmd.exe	37
PID 2692 wrote to memory of 2652	2692	cmd.exe	37
PID 2692 wrote to memory of 2652	2692	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Windows-Activator-SyntaxServices\Microsoft-Activator\MAS\All-In-One-Version\MAS_AIO-CRC32_31F7FD1E.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2768
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2776
- C:\Windows\System32\findstr.exe
  findstr /v "$" "MAS_AIO-CRC32_31F7FD1E.cmd"
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
  2⤵
  PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Windows-Activator-SyntaxServices\Microsoft-Activator\MAS\All-In-One-Version\MAS_AIO-CRC32_31F7FD1E.cmd" "
  2⤵
  PID:2060
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2652