048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Target
MAS_Remake_GUI 1.0/MAS_Tools/Ohook_Activation_AIO.cmd
Size 164KB
Sample260702-e46mssbx7z
SHA256 048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f
MD5 7ce4bf0a57da78880586f2b2ca4241e1
SHA1 cf6f2167505d20f1aed056def4323b6897085df8
SHA512 e6b37d443099b9aed26b91b56ccaf4b24adad7566cb644bab4b15b1b04ee7f0fd54167b7eaefc29069584e7a4de4a1e96edd63e65dd01e9ec7147b03a08e4c79
SSDEEP 3072:Rk/j/0ZU/QN5Gfew3HIpZv2xcG1MZgnnwT:RfNO3ICT5Q
TLSH
T105F32A476E42A1F602B3F379AA57958EE32DC693C330A29D396ED094774630670FE24D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
860	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 860	6068	cmd.exe	89
PID 6068 wrote to memory of 2988	6068	cmd.exe	90
PID 6068 wrote to memory of 1428	6068	cmd.exe	91
PID 6068 wrote to memory of 1796	6068	cmd.exe	92
PID 6068 wrote to memory of 984	6068	cmd.exe	93
PID 6068 wrote to memory of 5096	6068	cmd.exe	94
PID 6068 wrote to memory of 1560	6068	cmd.exe	95
PID 6068 wrote to memory of 1168	6068	cmd.exe	96
PID 6068 wrote to memory of 6064	6068	cmd.exe	97
PID 6064 wrote to memory of 1328	6064	cmd.exe	98
PID 6064 wrote to memory of 4152	6064	cmd.exe	99
PID 6068 wrote to memory of 5480	6068	cmd.exe	100
PID 6068 wrote to memory of 2884	6068	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Ohook_Activation_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:860
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2988
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Ohook_Activation_AIO.cmd"
  2⤵
  PID:1428
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:1796
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:984
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:5096
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:1560
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:1168
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:1328
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4152
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Ohook_Activation_AIO.cmd" "
  2⤵
  PID:5480
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2884