048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 11:43

Target
MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
Size 164KB
Sample260702-nvtrbag191
SHA256 048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f
MD5 7ce4bf0a57da78880586f2b2ca4241e1
SHA1 cf6f2167505d20f1aed056def4323b6897085df8
SHA512 e6b37d443099b9aed26b91b56ccaf4b24adad7566cb644bab4b15b1b04ee7f0fd54167b7eaefc29069584e7a4de4a1e96edd63e65dd01e9ec7147b03a08e4c79
SSDEEP 3072:Rk/j/0ZU/QN5Gfew3HIpZv2xcG1MZgnnwT:RfNO3ICT5Q
TLSH
T105F32A476E42A1F602B3F379AA57958EE32DC693C330A29D396ED094774630670FE24D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4344	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4344	3192	cmd.exe	87
PID 3192 wrote to memory of 3916	3192	cmd.exe	88
PID 3192 wrote to memory of 2308	3192	cmd.exe	89
PID 3192 wrote to memory of 1264	3192	cmd.exe	90
PID 3192 wrote to memory of 4696	3192	cmd.exe	91
PID 3192 wrote to memory of 2268	3192	cmd.exe	92
PID 3192 wrote to memory of 4180	3192	cmd.exe	93
PID 3192 wrote to memory of 2760	3192	cmd.exe	94
PID 3192 wrote to memory of 4576	3192	cmd.exe	95
PID 4576 wrote to memory of 1176	4576	cmd.exe	96
PID 4576 wrote to memory of 3340	4576	cmd.exe	97
PID 3192 wrote to memory of 1160	3192	cmd.exe	98
PID 3192 wrote to memory of 2856	3192	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Activators\Ohook_Activation_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4344
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:3916
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Ohook_Activation_AIO.cmd"
  2⤵
  PID:2308
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:1264
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4696
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2268
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:4180
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:2760
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:1176
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:3340
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Activators\Ohook_Activation_AIO.cmd" "
  2⤵
  PID:1160
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2856