b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:43

Target
MAS/Separate-Files-Version/Change_Windows_Edition.cmd
Size 48KB
Sample260702-nvtrbag191
SHA256 b15844902198d6ed5dd26b29043b2a131582dac9afa0fc14034491fd71bf00dc
MD5 c9564c66946269e6d4277a407e27a40a
SHA1 137e4729174dbd26fd21046a22c52610f2304b7e
SHA512 6a07b2d9e713220f303e4d7d391021fb84c7c14a3f2f838f8a14c248a03a2ca02aabb6c266606394b6014be377713a6119d4e4e6911522df759e10f534acf25e
SSDEEP 1536:4y/Da/fp21d1/BX/rA/cz0ykWk2a+Rnu341/H:4y/+/8d1/BX/rA/cz0ykHO5hH
TLSH
T1BE233C87750251A402F33275A56B828AF72EC1F3A720974C795DC0A4776B355F0BBEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4460	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4460	4616	cmd.exe	89
PID 4616 wrote to memory of 3932	4616	cmd.exe	90
PID 4616 wrote to memory of 2040	4616	cmd.exe	91
PID 4616 wrote to memory of 3524	4616	cmd.exe	92
PID 4616 wrote to memory of 5888	4616	cmd.exe	93
PID 4616 wrote to memory of 2956	4616	cmd.exe	94
PID 4616 wrote to memory of 2188	4616	cmd.exe	95
PID 4616 wrote to memory of 900	4616	cmd.exe	96
PID 4616 wrote to memory of 5988	4616	cmd.exe	97
PID 5988 wrote to memory of 4872	5988	cmd.exe	98
PID 5988 wrote to memory of 5520	5988	cmd.exe	99
PID 4616 wrote to memory of 700	4616	cmd.exe	100
PID 4616 wrote to memory of 5768	4616	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Change_Windows_Edition.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4460
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:3932
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Change_Windows_Edition.cmd"
  2⤵
  PID:2040
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:3524
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:5888
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2956
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:2188
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:900
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4872
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:5520
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Change_Windows_Edition.cmd" "
  2⤵
  PID:700
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:5768