67ef13f25ca36b5f366bc43c5b219cd69d90967e5c9e34182e3accf1d142fc76

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 04:30

Target
MAS_Remake_GUI 1.0/MAS_Tools/TSforge_Activation.cmd
Size 359KB
Sample260702-e46mssbx7z
SHA256 67ef13f25ca36b5f366bc43c5b219cd69d90967e5c9e34182e3accf1d142fc76
MD5 37ff5581828b14a6f39c2e876c9adbfd
SHA1 7c1b3513ff9bf791d4f6db1965a9256f1a07c573
SHA512 cd8b2b4bd9c85177b293cc01dbad15354ca2753bb9e49489a90c57d83e2670ec85e627b197208939680f332de349ca3ef98f76a0eb56cfc93923dfcda2408515
SSDEEP 3072:vz/b/5/x/x/52env0yf3/nNq/Q/8/O/3/UGs3m3HIpJZl0FcExVTGX2THiwPr8ri:FF/J3I2cEvTGmaiE0
TLSH
T149741945A913A5A705B33379DF42804AFB27C33303755369BAADC104AF7A309A2B5F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5900	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 5900	5652	cmd.exe	90
PID 5652 wrote to memory of 6060	5652	cmd.exe	91
PID 5652 wrote to memory of 5284	5652	cmd.exe	92
PID 5652 wrote to memory of 4584	5652	cmd.exe	93
PID 5652 wrote to memory of 4484	5652	cmd.exe	94
PID 5652 wrote to memory of 6888	5652	cmd.exe	95
PID 5652 wrote to memory of 932	5652	cmd.exe	96
PID 5652 wrote to memory of 6856	5652	cmd.exe	97
PID 5652 wrote to memory of 6916	5652	cmd.exe	98
PID 6916 wrote to memory of 3064	6916	cmd.exe	99
PID 6916 wrote to memory of 5804	6916	cmd.exe	100
PID 5652 wrote to memory of 5928	5652	cmd.exe	101
PID 5652 wrote to memory of 5972	5652	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\TSforge_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:5900
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:6060
- C:\Windows\System32\findstr.exe
  findstr /v "$" "TSforge_Activation.cmd"
  2⤵
  PID:5284
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:4584
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4484
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:6888
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:932
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:6856
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6916
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3064
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:5804
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_Remake_GUI 1.0\MAS_Tools\TSforge_Activation.cmd" "
  2⤵
  PID:5928
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:5972