b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 11:43

Target
MAS/Separate-Files-Version/Change_Windows_Edition.cmd
Size 48KB
Sample260702-nvtrbag191
SHA256 b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc
MD5 c9564c66946269e6d4277a407e27a40a
SHA1 137e4729174dbd26fd21046a22c52610f2304b7e
SHA512 6a07b2d9e713220f303e4d7d391021fb84c7c14a3f2f838f8a14c248a03a2ca02aabb6c266606394b6014be377713a6119d4e4e6911522df759e10f534acf25e
SSDEEP 1536:4y/Da/fp21d1/BX/rA/cz0ykWk2a+Rnu341/H:4y/+/8d1/BX/rA/cz0ykHO5hH
TLSH
T1BE233C87750251A402F33275A56B828AF72EC1F3A720974C795DC0A4776B355F0BBEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2448	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2448	2672	cmd.exe	86
PID 2672 wrote to memory of 4744	2672	cmd.exe	87
PID 2672 wrote to memory of 4704	2672	cmd.exe	88
PID 2672 wrote to memory of 4752	2672	cmd.exe	89
PID 2672 wrote to memory of 4808	2672	cmd.exe	90
PID 2672 wrote to memory of 2704	2672	cmd.exe	91
PID 2672 wrote to memory of 2616	2672	cmd.exe	92
PID 2672 wrote to memory of 3828	2672	cmd.exe	93
PID 2672 wrote to memory of 2632	2672	cmd.exe	94
PID 2632 wrote to memory of 3576	2632	cmd.exe	95
PID 2632 wrote to memory of 2520	2632	cmd.exe	96
PID 2672 wrote to memory of 4128	2672	cmd.exe	97
PID 2672 wrote to memory of 2656	2672	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Change_Windows_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:2448
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4744
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Windows_Edition.cmd"
  2⤵
  PID:4704
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:4752
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4808
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2704
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:2616
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:3828
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3576
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2520
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Change_Windows_Edition.cmd" "
  2⤵
  PID:4128
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2656