c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS_Remake_GUI 1.0/MAS_Tools/Check_Activation_Status.cmd
Size 47KB
Sample260702-e46mssbx7z
SHA256 c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db
MD5 27a52fac266ce18ba89ec46fb811a5b3
SHA1 81bdc69384058a3245629295d934ecf8f5821a80
SHA512 0f36930728aa4e8a4c6af412f2fd7ef6caeb993098ac160efb75796cb8ea2405d554c6f71e2d567a01d803aaedf5549c57feda7f9de7a780f7faeb7223744edd
SSDEEP 384:TM51DLGNV1caT1UwZoio081ReKVwlfaNodso0XTf9rcKbVKQKUKypLw8wcH3L+rg:TMO1c2o9eyPvpnga+BnJbYTf4Jxm
TLSH
T11923D905FD1B926B57C733926E72C68D6C7482EB06FE54A878CCC884F124F6893F9589
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2916	powershell.exe
2916	powershell.exe
1828	powershell.exe
1828	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 5388	3104	cmd.exe	89
PID 3104 wrote to memory of 896	3104	cmd.exe	90
PID 5388 wrote to memory of 2916	5388	cmd.exe	91
PID 3104 wrote to memory of 1828	3104	cmd.exe	92
PID 3104 wrote to memory of 848	3104	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Check_Activation_Status.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\System32\cmd.exe
  cmd /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$ExecutionContext.SessionState.LanguageMode""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$ExecutionContext.SessionState.LanguageMode"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\Windows\System32\find.exe
  find /i "FullLanguage"
  2⤵
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Check_Activation_Status.cmd') -split ':sppmgr\:.*';. ([scriptblock]::Create($f[1]))"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System32\choice.exe
  choice /c 0 /n
  2⤵
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

memory/1828-20-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-22-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-28-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-26-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-25-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-24-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-23-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-11-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-12-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-18-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-16-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-17-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-21-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/1828-19-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/2916-0-0x00007FFB9525F000-0x00007FFB95260000-memory.dmp

Download

memory/2916-1-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/2916-4-0x00000269F0B70000-0x00000269F0B92000-memory.dmp

Download

memory/2916-10-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/2916-9-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/2916-7-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/2916-6-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download

memory/2916-5-0x00007FFB950D0000-0x00007FFB95A74000-memory.dmp

Download