3463dac23a542bb6e3b8e689b282495bd0f791a7a256d3cfd69d45242a1c5469

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
Size 24KB
Sample260727-sqs2fahj21
SHA256 3463dac23a542bb6e3b8e689b282495bd0f791a7a256d3cfd69d45242a1c5469
MD5 12e214d9068a74a7eb9175ce4066c046
SHA1 cc236253c59e5f454304aa4845604ae1cd8e2227
SHA512 afc6f28371246cfe6aa16f0c1d7d6723c338dab38bafe05e4d7688fec20e5782732c6549bfd9ab043e29fb7fdbea9f0a314efbcb66228de3f8e3ad8a3775dadc
SSDEEP 384:DeJsOd3PBFhbnJcT/BFLGIS0SCHx3kbbxtUYnv1cwY:DSdfBFRnJcT/BFrS66v1cwY
TLSH
T1A0B2A4D72D06A06281B737BB4A37914EF72DC1A3D310BACDB49D4478B34A38DD4A91AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4420	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1128	cmd.exe
2784	cmd.exe
2304	cmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4420	1128	cmd.exe	87
PID 1128 wrote to memory of 4960	1128	cmd.exe	88
PID 1128 wrote to memory of 3528	1128	cmd.exe	89
PID 1128 wrote to memory of 2784	1128	cmd.exe	90
PID 1128 wrote to memory of 5068	1128	cmd.exe	91
PID 1128 wrote to memory of 5052	1128	cmd.exe	92
PID 1128 wrote to memory of 672	1128	cmd.exe	93
PID 1128 wrote to memory of 4060	1128	cmd.exe	94
PID 1128 wrote to memory of 2304	1128	cmd.exe	95
PID 2304 wrote to memory of 4412	2304	cmd.exe	96
PID 2304 wrote to memory of 4392	2304	cmd.exe	97
PID 1128 wrote to memory of 4736	1128	cmd.exe	98
PID 1128 wrote to memory of 2892	1128	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Extract_OEM_Folder.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4420
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4960
- C:\Windows\System32\findstr.exe
  findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Extract_OEM_Folder.cmd"
  2⤵
  PID:3528
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:2784
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:5068
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:5052
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:672
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:4060
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4412
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4392
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Extract_OEM_Folder.cmd" "
  2⤵
  PID:4736
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads