408d69cc08e159b7f34fc7124b7ddc599a07bc2df9323fa43cf7e13369dabb55

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 13:37

Target

Windows-Activator-SyntaxServices/Microsoft-Activator/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
Size

165KB
MD5

bf71dce1897b7410462d3d2eb75f312b
SHA1

fce872670afd7011e449c1438986cae318176fed
SHA256

cd9f6cc414e802283f9c6fcfce92754d77ed878ef07b0a53cb633377db55af36
SHA512

20908c3527f31133a81eea23ba617f040868f4ea90d8cf5b5ca42a149e44d7d62f7f832ad9bafe627a1d798c80902c32450371c2d6f359fb1cfb8d8fc7e95da2
SSDEEP

1536:XDW88sb6vW5Tuac+4jCwjsisxsGLaNwgEMTV62m0I1zGDNSPKM0E2WYEDeFWwCyN:X/bJuAMTVFp6zGDNSCE2K0xT

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2720	sc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2720	2672	cmd.exe	31
PID 2672 wrote to memory of 2720	2672	cmd.exe	31
PID 2672 wrote to memory of 2720	2672	cmd.exe	31
PID 2672 wrote to memory of 2792	2672	cmd.exe	32
PID 2672 wrote to memory of 2792	2672	cmd.exe	32
PID 2672 wrote to memory of 2792	2672	cmd.exe	32
PID 2672 wrote to memory of 2800	2672	cmd.exe	33
PID 2672 wrote to memory of 2800	2672	cmd.exe	33
PID 2672 wrote to memory of 2800	2672	cmd.exe	33
PID 2672 wrote to memory of 2712	2672	cmd.exe	34
PID 2672 wrote to memory of 2712	2672	cmd.exe	34
PID 2672 wrote to memory of 2712	2672	cmd.exe	34
PID 2672 wrote to memory of 2684	2672	cmd.exe	35
PID 2672 wrote to memory of 2684	2672	cmd.exe	35
PID 2672 wrote to memory of 2684	2672	cmd.exe	35
PID 2672 wrote to memory of 2652	2672	cmd.exe	36
PID 2672 wrote to memory of 2652	2672	cmd.exe	36
PID 2672 wrote to memory of 2652	2672	cmd.exe	36
PID 2672 wrote to memory of 2660	2672	cmd.exe	37
PID 2672 wrote to memory of 2660	2672	cmd.exe	37
PID 2672 wrote to memory of 2660	2672	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Windows-Activator-SyntaxServices\Microsoft-Activator\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2720
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2792
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Online_KMS_Activation.cmd"
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
  2⤵
  PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Windows-Activator-SyntaxServices\Microsoft-Activator\MAS\Separate-Files-Version\Activators\Online_KMS_Activation.cmd" "
  2⤵
  PID:2652
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2660