d94b1abcba24d26c5fbe114a15b53a558684d74a1accff79bbb2407be7102a89

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS_AIO.cmd
Size 744KB
Sample260518-wyafvaby3x
SHA256 d94b1abcba24d26c5fbe114a15b53a558684d74a1accff79bbb2407be7102a89
MD5 8451ca15ac617194fafd41cd3a40c555
SHA1 b86153c46b0bf48de7b45877796a57ba0f419faa
SHA512 4ef1a1a44ebc25875d58b36fa5ced11973682a2e29aa90e5d73401a126d2a1acabdaf8afa17f1abd5d364f171f5f86b554d9eeb8bde6346f07ee3d354834353d
SSDEEP 6144:J3IHfNkf5g3BcEvTGmaiE8THncQx4Oa0ykj7AuS:J3IHCEcEvTGXiEmcAXa0ykj7U
TLSH
T158F41A466D0251A601B3F379DE53814EFB2AC2638375526879ADC044BF3A309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1904	sc.exe
896	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4112	cmd.exe
1852	PING.EXE
1868	cmd.exe
1848	PING.EXE

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
1760	reg.exe
2612	reg.exe
3472	reg.exe
376	reg.exe
2944	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1848	PING.EXE
1852	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3884	powershell.exe
3884	powershell.exe
4504	powershell.exe
4504	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 896	2828	cmd.exe	88
PID 2828 wrote to memory of 2852	2828	cmd.exe	89
PID 2828 wrote to memory of 4220	2828	cmd.exe	90
PID 2828 wrote to memory of 4356	2828	cmd.exe	92
PID 2828 wrote to memory of 3684	2828	cmd.exe	93
PID 2828 wrote to memory of 4980	2828	cmd.exe	94
PID 2828 wrote to memory of 4456	2828	cmd.exe	95
PID 2828 wrote to memory of 1856	2828	cmd.exe	96
PID 2828 wrote to memory of 4004	2828	cmd.exe	97
PID 4004 wrote to memory of 4656	4004	cmd.exe	98
PID 4004 wrote to memory of 2808	4004	cmd.exe	99
PID 2828 wrote to memory of 4384	2828	cmd.exe	100
PID 2828 wrote to memory of 4404	2828	cmd.exe	101
PID 2828 wrote to memory of 3496	2828	cmd.exe	102
PID 2828 wrote to memory of 3844	2828	cmd.exe	104
PID 3844 wrote to memory of 3884	3844	cmd.exe	105
PID 2828 wrote to memory of 876	2828	cmd.exe	106
PID 876 wrote to memory of 844	876	cmd.exe	107
PID 2828 wrote to memory of 3472	2828	cmd.exe	108
PID 2828 wrote to memory of 5016	2828	cmd.exe	109
PID 2828 wrote to memory of 376	2828	cmd.exe	110
PID 2828 wrote to memory of 3176	2828	cmd.exe	111
PID 2828 wrote to memory of 2944	2828	cmd.exe	112
PID 3176 wrote to memory of 1904	3176	cmd.exe	115
PID 3176 wrote to memory of 2860	3176	cmd.exe	116
PID 3176 wrote to memory of 4688	3176	cmd.exe	117
PID 3176 wrote to memory of 420	3176	cmd.exe	118
PID 3176 wrote to memory of 5036	3176	cmd.exe	119
PID 3176 wrote to memory of 3996	3176	cmd.exe	120
PID 3176 wrote to memory of 4680	3176	cmd.exe	121
PID 3176 wrote to memory of 920	3176	cmd.exe	122
PID 3176 wrote to memory of 2984	3176	cmd.exe	123
PID 3176 wrote to memory of 2996	3176	cmd.exe	124
PID 3176 wrote to memory of 212	3176	cmd.exe	125
PID 212 wrote to memory of 3500	212	cmd.exe	126
PID 212 wrote to memory of 4572	212	cmd.exe	127
PID 3176 wrote to memory of 4784	3176	cmd.exe	128
PID 3176 wrote to memory of 2340	3176	cmd.exe	129
PID 3176 wrote to memory of 3508	3176	cmd.exe	130
PID 3176 wrote to memory of 2448	3176	cmd.exe	131
PID 2448 wrote to memory of 4504	2448	cmd.exe	132
PID 3176 wrote to memory of 3252	3176	cmd.exe	133
PID 3252 wrote to memory of 1772	3252	cmd.exe	134
PID 3176 wrote to memory of 1868	3176	cmd.exe	135
PID 1868 wrote to memory of 1848	1868	cmd.exe	136
PID 3176 wrote to memory of 4112	3176	cmd.exe	137
PID 4112 wrote to memory of 1852	4112	cmd.exe	138
PID 3176 wrote to memory of 3516	3176	cmd.exe	139
PID 3176 wrote to memory of 2268	3176	cmd.exe	140
PID 3176 wrote to memory of 5112	3176	cmd.exe	141
PID 3176 wrote to memory of 1784	3176	cmd.exe	142
PID 3176 wrote to memory of 2068	3176	cmd.exe	143
PID 2068 wrote to memory of 5020	2068	cmd.exe	144
PID 3176 wrote to memory of 3208	3176	cmd.exe	145
PID 3176 wrote to memory of 1760	3176	cmd.exe	146
PID 3176 wrote to memory of 2452	3176	cmd.exe	147
PID 3176 wrote to memory of 2612	3176	cmd.exe	148
PID 3176 wrote to memory of 1800	3176	cmd.exe	149
PID 3176 wrote to memory of 720	3176	cmd.exe	150

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:896
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2852
- C:\Windows\System32\findstr.exe
  findstr /v "$" "MAS_AIO.cmd"
  2⤵
  PID:4220
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:4356
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:3684
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4980
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:4456
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:1856
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4656
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2808
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
  2⤵
  PID:4384
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4404
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:3496
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:844
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:3472
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:5016
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:376
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" -qedit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:1904
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:2860
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "MAS_AIO.cmd"
    3⤵
    PID:4688
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:420
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:5036
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    PID:3996
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:4680
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:920
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:2984
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:2996
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:3500
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4572
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
    3⤵
    PID:4784
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2340
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3508
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4504
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:1772
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\System32\PING.EXE
      ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1848
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck311.activated.win
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\System32\PING.EXE
      ping -n 1 updatecheck311.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1852
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:3516
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:2268
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:5112
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:1784
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:5020
- - C:\Windows\System32\mode.com
    mode 76, 34
    3⤵
    PID:3208
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:1760
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:2452
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:2612
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:1800
- - C:\Windows\System32\choice.exe
    choice /C:12345678EH0 /N
    3⤵
    PID:720
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
TLSH
T1A351EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 895426e2412990c6cb0a7a77eb6d0ca6457a5117e461d8b1cb4aa9598cb044be
MD5 68001c4324761f7bf273172fd629f63d
SHA1 123cef48a181a7062371a6a6fd787e2967173053
SHA512 4b0b9e0dc998036da2b3208eb3ea36a4bedbb029b99e644bb0714a7614a8239f213765d1c9a5661c1764c1625ed16ca743269ced2e45339948fb09217089c007
TLSH
T136112223F38C8921CC96163A509DAC5572B586DB81AFDFAF7BC0C214A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4ervljjj.wrr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ervljjj.wrr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3884-6-0x00000250A9E50000-0x00000250A9E72000-memory.dmp

Download

memory/3884-10-0x00000250A9E80000-0x00000250A9FCE000-memory.dmp

Download