11257ff8e758655e4f14aa8a3ecf311d06b62e88518e6d09ffedafcb5aa9af93

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 20:18

Target

Microsoft-Activation-Scripts-2.1/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
Size

54KB
MD5

c7dd86ca65b29d803226e7f2015dfb33
SHA1

b36327ca594af82d4556e79f534ef02c8c2a43f4
SHA256

d34d99de310658b4c6421362bc76e1a90e51e85ea74e186fd5b2e731e1d44536
SHA512

82f4012a0f759d8cdd2ea6463bfdde97ecbd159e0ea09d94e440109f50111dbee4dce6bfc87f6061a7d75f1fd7b7a10d42be76b0ec3fdf9084bedc5007959b93
SSDEEP

1536:xD83yqy0xDKGo6nNm85Yu341Em0Iy+lVTt3rA6s:xY3s/15jvg

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
816	sc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 816	2348	cmd.exe	84
PID 2348 wrote to memory of 816	2348	cmd.exe	84
PID 2348 wrote to memory of 2948	2348	cmd.exe	85
PID 2348 wrote to memory of 2948	2348	cmd.exe	85
PID 2348 wrote to memory of 4332	2348	cmd.exe	86
PID 2348 wrote to memory of 4332	2348	cmd.exe	86
PID 2348 wrote to memory of 3244	2348	cmd.exe	89
PID 2348 wrote to memory of 3244	2348	cmd.exe	89
PID 2348 wrote to memory of 740	2348	cmd.exe	90
PID 2348 wrote to memory of 740	2348	cmd.exe	90
PID 2348 wrote to memory of 3496	2348	cmd.exe	91
PID 2348 wrote to memory of 3496	2348	cmd.exe	91
PID 2348 wrote to memory of 2796	2348	cmd.exe	92
PID 2348 wrote to memory of 2796	2348	cmd.exe	92
PID 2796 wrote to memory of 3112	2796	cmd.exe	93
PID 2796 wrote to memory of 3112	2796	cmd.exe	93
PID 2796 wrote to memory of 4604	2796	cmd.exe	94
PID 2796 wrote to memory of 4604	2796	cmd.exe	94
PID 2348 wrote to memory of 2096	2348	cmd.exe	95
PID 2348 wrote to memory of 2096	2348	cmd.exe	95
PID 2348 wrote to memory of 3180	2348	cmd.exe	96
PID 2348 wrote to memory of 3180	2348	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\Separate-Files-Version\Activators\KMS38_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:816
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2948
- C:\Windows\System32\findstr.exe
  findstr /v "$" "KMS38_Activation.cmd"
  2⤵
  PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:3244
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:740
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3112
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-2.1\MAS\Separate-Files-Version\Activators\KMS38_Activation.cmd" "
  2⤵
  PID:2096
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3180