c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db

Analysis

max time kernel
147s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS/Separate-Files-Version/Check_Activation_Status.cmd
Size 47KB
Sample260702-nvtrbag191
SHA256 c9a1688c7ac1409483e279c418f7b8b12d2cc7b232c65b38f0656e2cd741b4db
MD5 27a52fac266ce18ba89ec46fb811a5b3
SHA1 81bdc69384058a3245629295d934ecf8f5821a80
SHA512 0f36930728aa4e8a4c6af412f2fd7ef6caeb993098ac160efb75796cb8ea2405d554c6f71e2d567a01d803aaedf5549c57feda7f9de7a780f7faeb7223744edd
SSDEEP 384:TM51DLGNV1caT1UwZoio081ReKVwlfaNodso0XTf9rcKbVKQKUKypLw8wcH3L+rg:TMO1c2o9eyPvpnga+BnJbYTf4Jxm
TLSH
T11923D905FD1B926B57C733926E72C68D6C7482EB06FE54A878CCC884F124F6893F9589
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5748	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3180	powershell.exe
3180	powershell.exe
5748	powershell.exe
5748	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	5748	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5820 wrote to memory of 2544	5820	cmd.exe	89
PID 5820 wrote to memory of 2388	5820	cmd.exe	90
PID 2544 wrote to memory of 3180	2544	cmd.exe	91
PID 5820 wrote to memory of 5748	5820	cmd.exe	92
PID 5820 wrote to memory of 2880	5820	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Check_Activation_Status.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Windows\System32\cmd.exe
  cmd /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$ExecutionContext.SessionState.LanguageMode""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$ExecutionContext.SessionState.LanguageMode"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- C:\Windows\System32\find.exe
  find /i "FullLanguage"
  2⤵
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Check_Activation_Status.cmd') -split ':sppmgr\:.*';. ([scriptblock]::Create($f[1]))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5748
- C:\Windows\System32\choice.exe
  choice /c 0 /n
  2⤵
  PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

memory/3180-4-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/3180-3-0x00000241DACC0000-0x00000241DACE2000-memory.dmp

Download

memory/3180-5-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/3180-6-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/3180-8-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/3180-0-0x00007FFF7524F000-0x00007FFF75250000-memory.dmp

Download

memory/5748-15-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-13-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-14-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-11-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-16-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-17-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-18-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-19-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-20-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-21-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-22-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-25-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download

memory/5748-24-0x00007FFF750C0000-0x00007FFF75A64000-memory.dmp

Download