c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS/Separate-Files-Version/Check_Activation_Status.cmd
Size 47KB
Sample260702-nvtrbag191
SHA256 c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db
MD5 27a52fac266ce18ba89ec46fb811a5b3
SHA1 81bdc69384058a3245629295d934ecf8f5821a80
SHA512 0f36930728aa4e8a4c6af412f2fd7ef6caeb993098ac160efb75796cb8ea2405d554c6f71e2d567a01d803aaedf5549c57feda7f9de7a780f7faeb7223744edd
SSDEEP 384:TM51DLGNV1caT1UwZoio081ReKVwlfaNodso0XTf9rcKbVKQKUKypLw8wcH3L+rg:TMO1c2o9eyPvpnga+BnJbYTf4Jxm
TLSH
T11923D905FD1B926B57C733926E72C68D6C7482EB06FE54A878CCC884F124F6893F9589
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3788	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4276	powershell.exe
4276	powershell.exe
3788	powershell.exe
3788	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 2268	3752	cmd.exe	89
PID 3752 wrote to memory of 4456	3752	cmd.exe	90
PID 2268 wrote to memory of 4276	2268	cmd.exe	91
PID 3752 wrote to memory of 3788	3752	cmd.exe	92
PID 3752 wrote to memory of 4896	3752	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Check_Activation_Status.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\System32\cmd.exe
  cmd /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$ExecutionContext.SessionState.LanguageMode""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$ExecutionContext.SessionState.LanguageMode"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\System32\find.exe
  find /i "FullLanguage"
  2⤵
  PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Check_Activation_Status.cmd') -split ':sppmgr\:.*';. ([scriptblock]::Create($f[1]))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3788
- C:\Windows\System32\choice.exe
  choice /c 0 /n
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 efe6de17c06ab84e960b58509c345bed4c553314d88ad7f0620d7b1e94b8ae91
MD5 d42703676942bf54e56f49ce1f7f6f44
SHA1 5a8f8d23510198c8568a7ffede815da46804c95b
SHA512 7ea6ba3f7d4638472768f8728c39b6e40d73e46540d4fe09c9895830ea2fd83a11bf302c7caeb2dc0eec3318145269dd31f85d053bfd83442c1c5c63b9d9fcf1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_u43zarcr.nk4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u43zarcr.nk4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3788-14-0x000002482CA00000-0x000002482CA10000-memory.dmp

Download

memory/3788-13-0x000002482CA00000-0x000002482CA10000-memory.dmp

Download

memory/4276-0-0x000002B221070000-0x000002B221080000-memory.dmp

Download

memory/4276-1-0x000002B221070000-0x000002B221080000-memory.dmp

Download

memory/4276-7-0x000002B220FD0000-0x000002B220FF2000-memory.dmp

Download