Overview

overview

8

Static

static

1

MAS_AIO.cmd

windows10-2004-x64

4

MAS_AIO.cmd

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MAS_AIO.cmd
  • Size 744KB
  • Sample260706-wtk2saez7l
  • SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Modifies registry key 1 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Windows\System32\sc.exe
      sc query Null
      2⤵
      • Launches sc.exe
      PID:3640
    • C:\Windows\System32\find.exe
      find /i "RUNNING"
      2⤵
        PID:5416
      • C:\Windows\System32\findstr.exe
        findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
        2⤵
          PID:5980
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c ver
          2⤵
            PID:1772
          • C:\Windows\System32\reg.exe
            reg query "HKCU\Console" /v ForceV2
            2⤵
              PID:1388
            • C:\Windows\System32\find.exe
              find /i "0x0"
              2⤵
                PID:5728
              • C:\Windows\System32\cmd.exe
                C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
                2⤵
                  PID:4504
                • C:\Windows\System32\find.exe
                  find /i "ARM64"
                  2⤵
                    PID:3340
                  • C:\Windows\System32\cmd.exe
                    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1996
                    • C:\Windows\System32\cmd.exe
                      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
                      3⤵
                        PID:824
                      • C:\Windows\System32\cmd.exe
                        cmd
                        3⤵
                          PID:2340
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
                        2⤵
                          PID:4440
                        • C:\Windows\System32\find.exe
                          find /i "C:\Users\Admin\AppData\Local\Temp"
                          2⤵
                            PID:3304
                          • C:\Windows\System32\fltMC.exe
                            fltmc
                            2⤵
                              PID:2272
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1128
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5008
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c mode con
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1640
                              • C:\Windows\System32\mode.com
                                mode con
                                3⤵
                                  PID:2908
                              • C:\Windows\System32\reg.exe
                                reg query HKCU\Console /v QuickEdit
                                2⤵
                                • Modifies registry key
                                PID:4912
                              • C:\Windows\System32\find.exe
                                find /i "0x0"
                                2⤵
                                  PID:464
                                • C:\Windows\System32\reg.exe
                                  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
                                  2⤵
                                  • Modifies registry key
                                  PID:1568
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" -qedit"
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5448
                                  • C:\Windows\System32\sc.exe
                                    sc query Null
                                    3⤵
                                    • Launches sc.exe
                                    PID:1824
                                  • C:\Windows\System32\find.exe
                                    find /i "RUNNING"
                                    3⤵
                                      PID:2504
                                    • C:\Windows\System32\findstr.exe
                                      findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
                                      3⤵
                                        PID:3552
                                      • C:\Windows\System32\cmd.exe
                                        C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
                                        3⤵
                                          PID:2924
                                        • C:\Windows\System32\find.exe
                                          find /i "/"
                                          3⤵
                                            PID:5052
                                          • C:\Windows\System32\cmd.exe
                                            C:\Windows\System32\cmd.exe /c ver
                                            3⤵
                                              PID:4388
                                            • C:\Windows\System32\reg.exe
                                              reg query "HKCU\Console" /v ForceV2
                                              3⤵
                                                PID:996
                                              • C:\Windows\System32\find.exe
                                                find /i "0x0"
                                                3⤵
                                                  PID:2292
                                                • C:\Windows\System32\cmd.exe
                                                  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
                                                  3⤵
                                                    PID:2232
                                                  • C:\Windows\System32\find.exe
                                                    find /i "ARM64"
                                                    3⤵
                                                      PID:712
                                                    • C:\Windows\System32\cmd.exe
                                                      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3524
                                                      • C:\Windows\System32\cmd.exe
                                                        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
                                                        4⤵
                                                          PID:1648
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd
                                                          4⤵
                                                            PID:5616
                                                        • C:\Windows\System32\cmd.exe
                                                          C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
                                                          3⤵
                                                            PID:3120
                                                          • C:\Windows\System32\find.exe
                                                            find /i "C:\Users\Admin\AppData\Local\Temp"
                                                            3⤵
                                                              PID:1488
                                                            • C:\Windows\System32\fltMC.exe
                                                              fltmc
                                                              3⤵
                                                                PID:4676
                                                              • C:\Windows\System32\cmd.exe
                                                                C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1636
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
                                                                  4⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4812
                                                              • C:\Windows\System32\cmd.exe
                                                                C:\Windows\System32\cmd.exe /c mode con
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5004
                                                                • C:\Windows\System32\mode.com
                                                                  mode con
                                                                  4⤵
                                                                    PID:2256
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
                                                                  3⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5912
                                                                  • C:\Windows\System32\PING.EXE
                                                                    ping -n 1 activated.win
                                                                    4⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    • Runs ping.exe
                                                                    PID:2648
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
                                                                  3⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5928
                                                                  • C:\Windows\System32\PING.EXE
                                                                    ping -n 1 updatecheck312.activated.win
                                                                    4⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    • Runs ping.exe
                                                                    PID:5220
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
                                                                  3⤵
                                                                    PID:2732
                                                                  • C:\Windows\System32\find.exe
                                                                    find /i "/S"
                                                                    3⤵
                                                                      PID:2084
                                                                    • C:\Windows\System32\cmd.exe
                                                                      C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
                                                                      3⤵
                                                                        PID:2448
                                                                      • C:\Windows\System32\find.exe
                                                                        find /i "/"
                                                                        3⤵
                                                                          PID:2164
                                                                        • C:\Windows\System32\cmd.exe
                                                                          C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
                                                                          3⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4740
                                                                          • C:\Windows\System32\reg.exe
                                                                            reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
                                                                            4⤵
                                                                              PID:4104
                                                                          • C:\Windows\System32\mode.com
                                                                            mode 76, 34
                                                                            3⤵
                                                                              PID:1600
                                                                            • C:\Windows\System32\reg.exe
                                                                              reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
                                                                              3⤵
                                                                              • Modifies registry key
                                                                              PID:4708
                                                                            • C:\Windows\System32\find.exe
                                                                              find /i "O365"
                                                                              3⤵
                                                                                PID:3692
                                                                              • C:\Windows\System32\reg.exe
                                                                                reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:5556
                                                                              • C:\Windows\System32\find.exe
                                                                                find /i "O365"
                                                                                3⤵
                                                                                  PID:4760
                                                                                • C:\Windows\System32\choice.exe
                                                                                  choice /C:12345678EH0 /N
                                                                                  3⤵
                                                                                    PID:3032
                                                                                • C:\Windows\System32\reg.exe
                                                                                  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
                                                                                  2⤵
                                                                                  • Modifies registry key
                                                                                  PID:4480
                                                                              • C:\Windows\system32\sihost.exe
                                                                                sihost.exe
                                                                                1⤵
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2408
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                  2⤵
                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                  • Enumerates connected drives
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:5016
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1532
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1424

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    StartupProfileData-NonInteractive
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    • Size 952B
                                                                                    • SHA256 0989be8b16552ed61c3b22fa0e58713680c4c6d4e6dd8c5792398b953440d596
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    prep_Activatable Class_Hermes_perf.cache
                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                    • Size 599B
                                                                                    • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    memory/1532-26-0x000001D803B90000-0x000001D803BB0000-memory.dmp
                                                                                    Download

                                                                                    memory/1532-55-0x000001E01D630000-0x000001E01D650000-memory.dmp
                                                                                    Download

                                                                                    memory/1532-21-0x000001D813D70000-0x000001D813E70000-memory.dmp
                                                                                    Download

                                                                                    memory/1532-20-0x000001D803B70000-0x000001D803B90000-memory.dmp
                                                                                    Download

                                                                                    memory/1532-10-0x000001D8001E0000-0x000001D8002E0000-memory.dmp
                                                                                    Download

                                                                                    memory/1532-11-0x000001D8001E0000-0x000001D8002E0000-memory.dmp
                                                                                    Download

                                                                                    memory/5008-0-0x000001C8CBEB0000-0x000001C8CBED2000-memory.dmp
                                                                                    Download

                                                                                    memory/5016-203-0x000000000DC90000-0x000000000DDFC000-memory.dmp
                                                                                    Download

                                                                                    memory/5016-204-0x0000000005BB0000-0x0000000005BF4000-memory.dmp
                                                                                    Download