a09a38473df2583c9fafc0bf17b8ed5ba98eafafb24d0316b97f7f8a9f7469ff

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:43

Target
MAS/Separate-Files-Version/Troubleshoot.cmd
Size 58KB
Sample260702-nvtrbag191
SHA256 a09a38473df2583c9fafc0bf17b8ed5ba98eafafb24d0316b97f7f8a9f7469ff
MD5 b5ca3be590257bfbb68da669d3aa76b5
SHA1 a769c27c0b1b575c549624e4687dc94f95cc0363
SHA512 9b5e6cc9873bcc0b721c19d9e55e5dec01eb415d8879793a350c8da80579399c0dbf418410e0846932477b77dc5a8ced7be3ed0a8d72e128526e4a3d3afa2529
SSDEEP 768:cJriBFcnNI/rBFXk6MOgXL9DlVhIQ++iW3AaPhPa01SAuXmPGnI1jzsWpjE50tnf:Au/ca/bMOgbHkQHiW3AC/te0v2G
TLSH
T13343E813B60190B182F233B9DE37964EB71EC157D324AA8C759EC158775538AE0BA3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5112	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5112	4264	cmd.exe	89
PID 4264 wrote to memory of 4744	4264	cmd.exe	90
PID 4264 wrote to memory of 1424	4264	cmd.exe	91
PID 4264 wrote to memory of 796	4264	cmd.exe	92
PID 4264 wrote to memory of 2364	4264	cmd.exe	93
PID 4264 wrote to memory of 3260	4264	cmd.exe	94
PID 4264 wrote to memory of 5276	4264	cmd.exe	95
PID 4264 wrote to memory of 3172	4264	cmd.exe	96
PID 4264 wrote to memory of 3120	4264	cmd.exe	97
PID 3120 wrote to memory of 6028	3120	cmd.exe	98
PID 3120 wrote to memory of 916	3120	cmd.exe	99
PID 4264 wrote to memory of 4928	4264	cmd.exe	100
PID 4264 wrote to memory of 4804	4264	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Troubleshoot.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:5112
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4744
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Troubleshoot.cmd"
  2⤵
  PID:1424
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:796
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:2364
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:3260
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:5276
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:3172
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:6028
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:916
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Troubleshoot.cmd" "
  2⤵
  PID:4928
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4804