d4b0229ea3a7fdb124962ed4bd0516aa9f019fe38dfd6d5d4217087bc55d5d4a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Target
MAS_Remake_GUI 1.0/MAS_Tools/Change_Office_Edition.cmd
Size 56KB
Sample260702-e46mssbx7z
SHA256 d4b0229ea3a7fdb124962ed4bd0516aa9f019fe38dfd6d5d4217087bc55d5d4a
MD5 ff31b0e6055d2e621e3c4b55d5c01ddc
SHA1 7f1d144411a564972766f371e166ce32c07466a1
SHA512 f52a184b304795eed80e2c83c4416c3374babb025d80e259ad4e1600ca0ee5a914237bbe73d95e0a680910a40315c8cd5b2e334af32c0ad2eae8dee0a16791d4
SSDEEP 1536:A1/Da/O2y/t/k/g/I7p/S/LuXr7/N/0/D225:A1/+/k/t/k/g/I7p/S/LuXr7/N/0/D75
TLSH
T14943F857B94360A602A732B9D5A7914EF76DC2A3C32197DC386EC088B716354B0FDB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4368	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4368	4392	cmd.exe	89
PID 4392 wrote to memory of 4704	4392	cmd.exe	90
PID 4392 wrote to memory of 904	4392	cmd.exe	91
PID 4392 wrote to memory of 2624	4392	cmd.exe	92
PID 4392 wrote to memory of 4156	4392	cmd.exe	93
PID 4392 wrote to memory of 4352	4392	cmd.exe	94
PID 4392 wrote to memory of 4796	4392	cmd.exe	95
PID 4392 wrote to memory of 2360	4392	cmd.exe	96
PID 4392 wrote to memory of 3400	4392	cmd.exe	97
PID 3400 wrote to memory of 2732	3400	cmd.exe	98
PID 3400 wrote to memory of 5388	3400	cmd.exe	99
PID 4392 wrote to memory of 1944	4392	cmd.exe	100
PID 4392 wrote to memory of 2432	4392	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Change_Office_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4704
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Office_Edition.cmd"
  2⤵
  PID:904
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:2624
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4156
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4352
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:4796
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:2360
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:2732
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:5388
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Change_Office_Edition.cmd" "
  2⤵
  PID:1944
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2432