67ef13f25ca36b5f366bc43c5b219cd69d90967e5c9e34182e3accf1d142fc76

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 11:43

Target
MAS/Separate-Files-Version/Activators/TSforge_Activation.cmd
Size 359KB
Sample260702-nvtrbag191
SHA256 67ef13f25ca36b5f366bc43c5b219cd69d90967e5c9e34182e3accf1d142fc76
MD5 37ff5581828b14a6f39c2e876c9adbfd
SHA1 7c1b3513ff9bf791d4f6db1965a9256f1a07c573
SHA512 cd8b2b4bd9c85177b293cc01dbad15354ca2753bb9e49489a90c57d83e2670ec85e627b197208939680f332de349ca3ef98f76a0eb56cfc93923dfcda2408515
SSDEEP 3072:vz/b/5/x/x/52env0yf3/nNq/Q/8/O/3/UGs3m3HIpJZl0FcExVTGX2THiwPr8ri:FF/J3I2cEvTGmaiE0
TLSH
T149741945A913A5A705B33379DF42804AFB27C33303755369BAADC104AF7A309A2B5F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
824	sc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 824	1156	cmd.exe	86
PID 1156 wrote to memory of 4504	1156	cmd.exe	87
PID 1156 wrote to memory of 4908	1156	cmd.exe	88
PID 1156 wrote to memory of 732	1156	cmd.exe	89
PID 1156 wrote to memory of 1640	1156	cmd.exe	90
PID 1156 wrote to memory of 1524	1156	cmd.exe	91
PID 1156 wrote to memory of 4120	1156	cmd.exe	92
PID 1156 wrote to memory of 1100	1156	cmd.exe	93
PID 1156 wrote to memory of 1620	1156	cmd.exe	94
PID 1620 wrote to memory of 644	1620	cmd.exe	95
PID 1620 wrote to memory of 2116	1620	cmd.exe	96
PID 1156 wrote to memory of 2380	1156	cmd.exe	97
PID 1156 wrote to memory of 1500	1156	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Activators\TSforge_Activation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:824
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4504
- C:\Windows\System32\findstr.exe
  findstr /v "$" "TSforge_Activation.cmd"
  2⤵
  PID:4908
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:732
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:1640
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:1524
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:4120
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:1100
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:644
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2116
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS\Separate-Files-Version\Activators\TSforge_Activation.cmd" "
  2⤵
  PID:2380
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:1500