11257ff8e758655e4f14aa8a3ecf311d06b62e88518e6d09ffedafcb5aa9af93

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 20:18

Target

Microsoft-Activation-Scripts-2.1/MAS/Separate-Files-Version/Change_Edition.cmd
Size

37KB
MD5

5f480dc2aa5d68547a4a5740aa1a5339
SHA1

835505d1be2f879dba6bf3f712232ed5013beac6
SHA256

be31e962df8b24db11f6a203206e23c287ecc060f820ba40d92641fea7471273
SHA512

25e66a036b2b794077872be9692f7b9a8edf129310bdc2d2c0eeecb1c179a1176905b8d81f84e52346ed2b0bfd721487ab2317f46dd7c712973f5e93003ecca3
SSDEEP

768:XnZi42JYV4AtJ0jij9H5EiXw5iWK4u34uHfIN:Xysx6+j9H5EiXw5iWdu34u/I

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2652	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2652	2820	cmd.exe	31
PID 2820 wrote to memory of 2652	2820	cmd.exe	31
PID 2820 wrote to memory of 2652	2820	cmd.exe	31
PID 2820 wrote to memory of 2536	2820	cmd.exe	32
PID 2820 wrote to memory of 2536	2820	cmd.exe	32
PID 2820 wrote to memory of 2536	2820	cmd.exe	32
PID 2820 wrote to memory of 2908	2820	cmd.exe	33
PID 2820 wrote to memory of 2908	2820	cmd.exe	33
PID 2820 wrote to memory of 2908	2820	cmd.exe	33
PID 2820 wrote to memory of 2644	2820	cmd.exe	34
PID 2820 wrote to memory of 2644	2820	cmd.exe	34
PID 2820 wrote to memory of 2644	2820	cmd.exe	34
PID 2820 wrote to memory of 2832	2820	cmd.exe	35
PID 2820 wrote to memory of 2832	2820	cmd.exe	35
PID 2820 wrote to memory of 2832	2820	cmd.exe	35
PID 2820 wrote to memory of 2836	2820	cmd.exe	36
PID 2820 wrote to memory of 2836	2820	cmd.exe	36
PID 2820 wrote to memory of 2836	2820	cmd.exe	36
PID 2820 wrote to memory of 2852	2820	cmd.exe	37
PID 2820 wrote to memory of 2852	2820	cmd.exe	37
PID 2820 wrote to memory of 2852	2820	cmd.exe	37
PID 2820 wrote to memory of 2532	2820	cmd.exe	38
PID 2820 wrote to memory of 2532	2820	cmd.exe	38
PID 2820 wrote to memory of 2532	2820	cmd.exe	38

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\Separate-Files-Version\Change_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2652
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2536
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Edition.cmd"
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\Separate-Files-Version\Change_Edition.cmd" "
  2⤵
  PID:2832
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4U7EZBTOSCWCDSE35ME9.temp

Filesize
7KB

MD5
2927c881b49ee88f0499c7c482bd665e

SHA1
bcbc43ded5e96b0809fc37f3d98c6032ed5975c8

SHA256
108e41995c4c2269f273c8c1499709627b9eace4dc37d69c3b07f0cd4f06da00

SHA512
c431966f15e92c95f1488b2fafba77a73f8fe331fcd7c1402295c47a0d8a14a2824fb1d55caaed2c9a8949a720ed8bc7a360b4f00a0c09cd6ca288e02ec48e46

Download Submit
memory/2532-16-0x00000000021A0000-0x00000000021A8000-memory.dmp

Filesize
32KB

Download
memory/2532-15-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2852-4-0x000007FEF573E000-0x000007FEF573F000-memory.dmp

Filesize
4KB

Download
memory/2852-5-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2852-6-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2852-8-0x0000000002A5B000-0x0000000002AC2000-memory.dmp

Filesize
412KB

Download
memory/2852-7-0x0000000002A54000-0x0000000002A57000-memory.dmp

Filesize
12KB

Download
memory/2852-9-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2852-17-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download