d60586cb7ee632117205d1735a90bb7116f6b7c649541754c8aa27251370df3e

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Target
MAS_Remake_GUI 1.0/MAS_Tools/Online_KMS_Activation.cmd
Size 172KB
Sample260702-e46mssbx7z
SHA256 d60586cb7ee632117205d1735a90bb7116f6b7c649541754c8aa27251370df3e
MD5 62dd3ff0aa686180844e6ee204c56907
SHA1 53c5437f5039362f17d33abdbbefcbea445d16d7
SHA512 c3293d3131aea6dc8722ac12799525d3bb9efcadd16cc49c9b33763d4b8d286c9864f587ae4b5c7b243872b5ac9061f1dfddc39d25d3a2f87e7c949dc4b83ec6
SSDEEP 3072:mJe/j/q/Y/FmUGgDM20e3HIpvGGjYcnck:mmmW3ILnck
TLSH
T15B044A47A54260E602F323BDAA569187F72EC2A34331E2AC356EC484BB5631B71F775C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5072	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 5072	2772	cmd.exe	89
PID 2772 wrote to memory of 2456	2772	cmd.exe	90
PID 2772 wrote to memory of 4864	2772	cmd.exe	91
PID 2772 wrote to memory of 3356	2772	cmd.exe	92
PID 2772 wrote to memory of 2588	2772	cmd.exe	93
PID 2772 wrote to memory of 4128	2772	cmd.exe	94
PID 2772 wrote to memory of 1316	2772	cmd.exe	95
PID 2772 wrote to memory of 5736	2772	cmd.exe	96
PID 2772 wrote to memory of 1972	2772	cmd.exe	97
PID 1972 wrote to memory of 4320	1972	cmd.exe	98
PID 1972 wrote to memory of 2816	1972	cmd.exe	99
PID 2772 wrote to memory of 2744	2772	cmd.exe	100
PID 2772 wrote to memory of 3268	2772	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Online_KMS_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:5072
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2456
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Online_KMS_Activation.cmd"
  2⤵
  PID:4864
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:3356
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:2588
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4128
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:1316
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:5736
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4320
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2816
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\Online_KMS_Activation.cmd" "
  2⤵
  PID:2744
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3268