d26c015cd129f5b1a84abe9b846a0eeb7ed20f2a03e38129e46efcb526b6f298

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Target
MAS_Remake_GUI 1.0/MAS_Tools/HWID_Activation.cmd
Size 81KB
Sample260702-e46mssbx7z
SHA256 d26c015cd129f5b1a84abe9b846a0eeb7ed20f2a03e38129e46efcb526b6f298
MD5 7aaf569550c8d0e767da30e007c52033
SHA1 67c2ecce036f9cf914719bccdc7ae5d06cdc6f77
SHA512 ff0468f8a961feb85298a34f7f2cc3fad326e2d94010d84a70aa810b161412effb2009dfc1c72a68115d28f8237bd25742db013d5c52c61362c619aa3346388d
SSDEEP 1536:jD/Da/u3y/DaKPPQVhEE6Zt/flC2nq7Df+lirvGHIxGrS2ciUf6s:jD/+/X/P/g3m3HIpL
TLSH
T10C832B07B50260A602B333B86E675686E31EC6A39371A35C796DC088774A74DF1FB79C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5712	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 5712	5124	cmd.exe	91
PID 5124 wrote to memory of 3632	5124	cmd.exe	92
PID 5124 wrote to memory of 912	5124	cmd.exe	93
PID 5124 wrote to memory of 2272	5124	cmd.exe	94
PID 5124 wrote to memory of 1072	5124	cmd.exe	95
PID 5124 wrote to memory of 1612	5124	cmd.exe	96
PID 5124 wrote to memory of 2440	5124	cmd.exe	97
PID 5124 wrote to memory of 4800	5124	cmd.exe	98
PID 5124 wrote to memory of 5884	5124	cmd.exe	99
PID 5884 wrote to memory of 3120	5884	cmd.exe	100
PID 5884 wrote to memory of 3372	5884	cmd.exe	101
PID 5124 wrote to memory of 1056	5124	cmd.exe	102
PID 5124 wrote to memory of 5004	5124	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\HWID_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:5712
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:3632
- C:\Windows\System32\findstr.exe
  findstr /v "$" "HWID_Activation.cmd"
  2⤵
  PID:912
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:2272
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:1072
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:2440
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:4800
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3120
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:3372
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\HWID_Activation.cmd" "
  2⤵
  PID:1056
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:5004