048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:43

Target
MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
Size 164KB
Sample260702-nvtrbag191
SHA256 048402b1a27af2b08da22c800595502f019ba297a48e157ec0b987608191f59f
MD5 7ce4bf0a57da78880586f2b2ca4241e1
SHA1 cf6f2167505d20f1aed056def4323b6897085df8
SHA512 e6b37d443099b9aed26b91b56ccaf4b24adad7566cb644bab4b15b1b04ee7f0fd54167b7eaefc29069584e7a4de4a1e96edd63e65dd01e9ec7147b03a08e4c79
SSDEEP 3072:Rk/j/0ZU/QN5Gfew3HIpZv2xcG1MZgnnwT:RfNO3ICT5Q
TLSH
T105F32A476E42A1F602B3F379AA57958EE32DC693C330A29D396ED094774630670FE24D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6020	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 6020	4424	cmd.exe	89
PID 4424 wrote to memory of 5744	4424	cmd.exe	90
PID 4424 wrote to memory of 1048	4424	cmd.exe	91
PID 4424 wrote to memory of 2316	4424	cmd.exe	92
PID 4424 wrote to memory of 4136	4424	cmd.exe	93
PID 4424 wrote to memory of 3360	4424	cmd.exe	94
PID 4424 wrote to memory of 5624	4424	cmd.exe	95
PID 4424 wrote to memory of 3624	4424	cmd.exe	96
PID 4424 wrote to memory of 3572	4424	cmd.exe	97
PID 3572 wrote to memory of 2776	3572	cmd.exe	98
PID 3572 wrote to memory of 4972	3572	cmd.exe	99
PID 4424 wrote to memory of 5024	4424	cmd.exe	100
PID 4424 wrote to memory of 3456	4424	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Activators\Ohook_Activation_AIO.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:6020
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:5744
- C:\Windows\System32\findstr.exe
  findstr /v "$" "Ohook_Activation_AIO.cmd"
  2⤵
  PID:1048
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:2316
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4136
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:3360
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:5624
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:3624
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:2776
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4972
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Activators\Ohook_Activation_AIO.cmd" "
  2⤵
  PID:5024
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3456