408d69cc08e159b7f34fc7124b7ddc599a07bc2df9323fa43cf7e13369dabb55

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 13:37

Target

Windows-Activator-SyntaxServices/Microsoft-Activator/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
Size

106KB
MD5

80e83ad7099009ccbcd5c910340fa9a8
SHA1

fa6d44031eb733846ea6c19f07b6951bd54a0ea7
SHA256

2c968bec692b144fef41c6f3798000fcdfc5319774168ab56bf867fff3f1a9a7
SHA512

ee4adcd453d82c8219ec89839db516e7cbcaabceddf07a043659e159508c494077c49a4ccf7aef74b3e09371e25a6f32576ff80b4f1d58bd4b2600996477b703
SSDEEP

1536:CvZRkM0lbP0u+Rc95L6mZhmd4NeZYg/yXhmJI8nVT:CBRMP0u+RcHud4NiYFRd8nVT

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2260	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2948	powershell.exe
2844	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2260	2176	cmd.exe	31
PID 2176 wrote to memory of 2260	2176	cmd.exe	31
PID 2176 wrote to memory of 2260	2176	cmd.exe	31
PID 2176 wrote to memory of 2528	2176	cmd.exe	32
PID 2176 wrote to memory of 2528	2176	cmd.exe	32
PID 2176 wrote to memory of 2528	2176	cmd.exe	32
PID 2176 wrote to memory of 2360	2176	cmd.exe	33
PID 2176 wrote to memory of 2360	2176	cmd.exe	33
PID 2176 wrote to memory of 2360	2176	cmd.exe	33
PID 2176 wrote to memory of 1440	2176	cmd.exe	34
PID 2176 wrote to memory of 1440	2176	cmd.exe	34
PID 2176 wrote to memory of 1440	2176	cmd.exe	34
PID 2176 wrote to memory of 2948	2176	cmd.exe	35
PID 2176 wrote to memory of 2948	2176	cmd.exe	35
PID 2176 wrote to memory of 2948	2176	cmd.exe	35
PID 2176 wrote to memory of 2844	2176	cmd.exe	36
PID 2176 wrote to memory of 2844	2176	cmd.exe	36
PID 2176 wrote to memory of 2844	2176	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Windows-Activator-SyntaxServices\Microsoft-Activator\MAS\Separate-Files-Version\Activators\Ohook_Activation_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2260
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2528
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Ohook_Activation_AIO.cmd"
  2⤵
  PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4b55b0d61a9d07afe543d7cec17b7a38

SHA1
763aa6764c7e75a5918a5279358382c429814f38

SHA256
43edec2e6bd05a68332d6c9468c7d1b3dd1c30a8e7471fece81c6462ece01adc

SHA512
8179823322d6d956ee51e4bf02f6a56e988f07d56001d9806536174e604205c8fe8f56515a581abb36369760a695356fd15340a9ce0821bbe6213c4c2eac19a3

Download Submit
memory/2844-18-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2844-19-0x0000000002080000-0x0000000002088000-memory.dmp

Filesize
32KB

Download
memory/2948-4-0x000007FEF61BE000-0x000007FEF61BF000-memory.dmp

Filesize
4KB

Download
memory/2948-5-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2948-6-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2948-7-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-8-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-11-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-10-0x000000000294B000-0x00000000029B2000-memory.dmp

Filesize
412KB

Download
memory/2948-9-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/2948-12-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

Filesize
9.6MB

Download