11257ff8e758655e4f14aa8a3ecf311d06b62e88518e6d09ffedafcb5aa9af93

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 20:18

Target

Microsoft-Activation-Scripts-2.1/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
Size

54KB
MD5

3ee8def4c8b0834689da5edfccb46d86
SHA1

058cce23c3b5b9399d7ff259028ac71a4f9054ec
SHA256

cd0d3b47d7e22ad9f108c15b5eefdad8375c0c7c89167b98aa39b024cfb058ae
SHA512

561f8ce072517d03e2e7f0c89bbd196ada037ef1bf4d1c3fa22134d20ba2850798c06b3a05629870e2afbe216025d02140f594397381ab417dad4fc35d411eb9
SSDEEP

1536:oi3yg2MxOIflsdi54Em0IyGhz/Wxms36s:oi3pE5TB/TQ

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3956	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3956	2360	cmd.exe	84
PID 2360 wrote to memory of 3956	2360	cmd.exe	84
PID 2360 wrote to memory of 4436	2360	cmd.exe	85
PID 2360 wrote to memory of 4436	2360	cmd.exe	85
PID 2360 wrote to memory of 1248	2360	cmd.exe	86
PID 2360 wrote to memory of 1248	2360	cmd.exe	86
PID 2360 wrote to memory of 2384	2360	cmd.exe	87
PID 2360 wrote to memory of 2384	2360	cmd.exe	87
PID 2360 wrote to memory of 2020	2360	cmd.exe	88
PID 2360 wrote to memory of 2020	2360	cmd.exe	88
PID 2360 wrote to memory of 1948	2360	cmd.exe	89
PID 2360 wrote to memory of 1948	2360	cmd.exe	89
PID 2360 wrote to memory of 4860	2360	cmd.exe	90
PID 2360 wrote to memory of 4860	2360	cmd.exe	90
PID 4860 wrote to memory of 2556	4860	cmd.exe	91
PID 4860 wrote to memory of 2556	4860	cmd.exe	91
PID 4860 wrote to memory of 3528	4860	cmd.exe	92
PID 4860 wrote to memory of 3528	4860	cmd.exe	92
PID 2360 wrote to memory of 2148	2360	cmd.exe	93
PID 2360 wrote to memory of 2148	2360	cmd.exe	93
PID 2360 wrote to memory of 2904	2360	cmd.exe	94
PID 2360 wrote to memory of 2904	2360	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\Separate-Files-Version\Activators\HWID_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:3956
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4436
- C:\Windows\System32\findstr.exe
  findstr /v "$" "HWID_Activation.cmd"
  2⤵
  PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2384
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:2020
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:2556
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\Separate-Files-Version\Activators\HWID_Activation.cmd" "
  2⤵
  PID:2148
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2904