11257ff8e758655e4f14aa8a3ecf311d06b62e88518e6d09ffedafcb5aa9af93

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 20:18

Target

Microsoft-Activation-Scripts-2.1/MAS/All-In-One-Version/MAS_AIO.cmd
Size

424KB
MD5

2ea7857263e0d07b914e9284b652c5f2
SHA1

02e31ed3742164507026dd00fe556e3330d77e90
SHA256

c4ad147b40c34a4458bd9f559587e91f099c1e822e5c122e24b1bd7368fa402c
SHA512

9966cd1a888acb501368359791f67009a7506b87842f18302510002b0578c298c850d56b4543d2c207a3dc1314f35bdca401eee3e1fb9f7235b710e5f9962be4
SSDEEP

3072:Hko3pE5TB/TPH7PIu0R/iNiYCCU3siavbbJuAMTVFp6zGDNSCE2K6rOuW7EOGJGo:3aB7Eu0R6SCU2bJu9p6zGDNS0K8OuD3

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2528	sc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2528	3032	cmd.exe	31
PID 3032 wrote to memory of 2528	3032	cmd.exe	31
PID 3032 wrote to memory of 2528	3032	cmd.exe	31
PID 3032 wrote to memory of 2564	3032	cmd.exe	32
PID 3032 wrote to memory of 2564	3032	cmd.exe	32
PID 3032 wrote to memory of 2564	3032	cmd.exe	32
PID 3032 wrote to memory of 2576	3032	cmd.exe	33
PID 3032 wrote to memory of 2576	3032	cmd.exe	33
PID 3032 wrote to memory of 2576	3032	cmd.exe	33
PID 3032 wrote to memory of 2620	3032	cmd.exe	34
PID 3032 wrote to memory of 2620	3032	cmd.exe	34
PID 3032 wrote to memory of 2620	3032	cmd.exe	34
PID 3032 wrote to memory of 2624	3032	cmd.exe	35
PID 3032 wrote to memory of 2624	3032	cmd.exe	35
PID 3032 wrote to memory of 2624	3032	cmd.exe	35
PID 3032 wrote to memory of 2636	3032	cmd.exe	36
PID 3032 wrote to memory of 2636	3032	cmd.exe	36
PID 3032 wrote to memory of 2636	3032	cmd.exe	36
PID 3032 wrote to memory of 2684	3032	cmd.exe	37
PID 3032 wrote to memory of 2684	3032	cmd.exe	37
PID 3032 wrote to memory of 2684	3032	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\All-In-One-Version\MAS_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2528
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2564
- C:\Windows\System32\findstr.exe
  findstr /v "$" "MAS_AIO.cmd"
  2⤵
  PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
  2⤵
  PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\All-In-One-Version\MAS_AIO.cmd" "
  2⤵
  PID:2636
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2684