b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Target
MAS_Remake_GUI 1.0/MAS_Tools/Change_Windows_Edition.cmd
Size 48KB
Sample260702-e46mssbx7z
SHA256 b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc
MD5 c9564c66946269e6d4277a407e27a40a
SHA1 137e4729174dbd26fd21046a22c52610f2304b7e
SHA512 6a07b2d9e713220f303e4d7d391021fb84c7c14a3f2f838f8a14c248a03a2ca02aabb6c266606394b6014be377713a6119d4e4e6911522df759e10f534acf25e
SSDEEP 1536:4y/Da/fp21d1/BX/rA/cz0ykWk2a+Rnu341/H:4y/+/8d1/BX/rA/cz0ykHO5hH
TLSH
T1BE233C87750251A402F33275A56B828AF72EC1F3A720974C795DC0A4776B355F0BBEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1368	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1368	4732	cmd.exe	90
PID 4732 wrote to memory of 4264	4732	cmd.exe	91
PID 4732 wrote to memory of 4384	4732	cmd.exe	92
PID 4732 wrote to memory of 4836	4732	cmd.exe	93
PID 4732 wrote to memory of 6664	4732	cmd.exe	94
PID 4732 wrote to memory of 1512	4732	cmd.exe	95
PID 4732 wrote to memory of 3700	4732	cmd.exe	96
PID 4732 wrote to memory of 3692	4732	cmd.exe	97
PID 4732 wrote to memory of 7064	4732	cmd.exe	98
PID 7064 wrote to memory of 904	7064	cmd.exe	99
PID 7064 wrote to memory of 7056	7064	cmd.exe	100
PID 4732 wrote to memory of 4076	4732	cmd.exe	101
PID 4732 wrote to memory of 4668	4732	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Change_Windows_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:1368
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4264
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Windows_Edition.cmd"
  2⤵
  PID:4384
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:4836
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:6664
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:1512
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:3700
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:3692
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7064
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:904
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:7056
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Change_Windows_Edition.cmd" "
  2⤵
  PID:4076
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4668