8149efb071552f848ff87429118e9ad0bb9ff7ce0aa4bb428a83fad852e6d539

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Target
MAS_Remake_GUI 1.0/MAS_Tools/Extract_OEM_Folder.cmd
Size 24KB
Sample260702-e46mssbx7z
SHA256 8149efb071552f848ff87429118e9ad0bb9ff7ce0aa4bb428a83fad852e6d539
MD5 84a79cc9a3d8fe4fc15e5c4c38dfec9b
SHA1 ccb04c232de8465796ebed6c916d57836bd73410
SHA512 3954402b5b210a75d0a57ed7808fc655343e61b6ae08594d0f6a6375868572713a119268957ce030f0a8754b3aa00e419364f1beb26395d7f6f0a600ae12776d
SSDEEP 384:cbJk0Z3PBFwnJcT/BFLGIk0SCHx3kbbxtUYgv1cwY:cJZfBFwnJcT/BFrk6zv1cwY
TLSH
T1AAB295D72906A06281B737BB4A37914EF72DC1A3D310FACDB49D4478B31A38DD4A91AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2456	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 6728 wrote to memory of 2456	6728	cmd.exe	90
PID 6728 wrote to memory of 2816	6728	cmd.exe	91
PID 6728 wrote to memory of 6400	6728	cmd.exe	92
PID 6728 wrote to memory of 2672	6728	cmd.exe	93
PID 6728 wrote to memory of 1276	6728	cmd.exe	94
PID 6728 wrote to memory of 2292	6728	cmd.exe	95
PID 6728 wrote to memory of 2760	6728	cmd.exe	96
PID 6728 wrote to memory of 6024	6728	cmd.exe	97
PID 6728 wrote to memory of 1284	6728	cmd.exe	98
PID 1284 wrote to memory of 4776	1284	cmd.exe	99
PID 1284 wrote to memory of 4852	1284	cmd.exe	100
PID 6728 wrote to memory of 3708	6728	cmd.exe	101
PID 6728 wrote to memory of 5628	6728	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Extract_OEM_Folder.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:6728
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2456
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2816
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Extract_OEM_Folder.cmd"
  2⤵
  PID:6400
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:2672
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:1276
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2292
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:2760
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:6024
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4776
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4852
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Extract_OEM_Folder.cmd" "
  2⤵
  PID:3708
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:5628