850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS_AIO.cmd
Size 744KB
Sample260818-taygnavfre
SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
MD5 8e0a0b48ad0289d647e55d802170d795
SHA1 6adced8154ebaa02e06efcb85715d2663c731bd0
SHA512 58edc773d275dec130cc5ede3c55edc5680f52e1b7ca4d78b349323f6d64b565ba052366b59ff4a94640fb49d14c2ec490dc69946bac9f921cb82bb62bffe563
SSDEEP 6144:g3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Auj:g3IuuhcEvTGGOEmcAXz0ykw7x
TLSH
T192F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution

Malware Config

Signatures

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5900	sc.exe
4412	sc.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5288	cmd.exe
2248	cmd.exe
1464	cmd.exe
4128	cmd.exe
5164	cmd.exe
2260	cmd.exe
5264	cmd.exe
2876	cmd.exe
2784	cmd.exe
5516	cmd.exe
1420	cmd.exe
4072	cmd.exe
3076	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5452	PING.EXE
2784	cmd.exe
5516	cmd.exe
5668	PING.EXE

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
2580	reg.exe
4452	reg.exe
1924	reg.exe
3872	reg.exe
4376	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5452	PING.EXE
5668	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4648	powershell.exe
4648	powershell.exe
1520	powershell.exe
1520	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 5900	4072	cmd.exe	89
PID 4072 wrote to memory of 1020	4072	cmd.exe	90
PID 4072 wrote to memory of 5376	4072	cmd.exe	91
PID 4072 wrote to memory of 3076	4072	cmd.exe	93
PID 4072 wrote to memory of 5760	4072	cmd.exe	94
PID 4072 wrote to memory of 5656	4072	cmd.exe	95
PID 4072 wrote to memory of 2888	4072	cmd.exe	96
PID 4072 wrote to memory of 2484	4072	cmd.exe	97
PID 4072 wrote to memory of 5288	4072	cmd.exe	98
PID 5288 wrote to memory of 3728	5288	cmd.exe	99
PID 5288 wrote to memory of 2324	5288	cmd.exe	100
PID 4072 wrote to memory of 5432	4072	cmd.exe	101
PID 4072 wrote to memory of 6116	4072	cmd.exe	102
PID 4072 wrote to memory of 6068	4072	cmd.exe	103
PID 4072 wrote to memory of 2248	4072	cmd.exe	104
PID 2248 wrote to memory of 4648	2248	cmd.exe	105
PID 4072 wrote to memory of 5264	4072	cmd.exe	106
PID 5264 wrote to memory of 3824	5264	cmd.exe	107
PID 4072 wrote to memory of 2580	4072	cmd.exe	108
PID 4072 wrote to memory of 5688	4072	cmd.exe	109
PID 4072 wrote to memory of 4452	4072	cmd.exe	110
PID 4072 wrote to memory of 2876	4072	cmd.exe	111
PID 4072 wrote to memory of 1924	4072	cmd.exe	112
PID 2876 wrote to memory of 4412	2876	cmd.exe	115
PID 2876 wrote to memory of 2252	2876	cmd.exe	116
PID 2876 wrote to memory of 5888	2876	cmd.exe	117
PID 2876 wrote to memory of 2752	2876	cmd.exe	118
PID 2876 wrote to memory of 1136	2876	cmd.exe	119
PID 2876 wrote to memory of 1464	2876	cmd.exe	120
PID 2876 wrote to memory of 6016	2876	cmd.exe	121
PID 2876 wrote to memory of 408	2876	cmd.exe	122
PID 2876 wrote to memory of 124	2876	cmd.exe	123
PID 2876 wrote to memory of 240	2876	cmd.exe	124
PID 2876 wrote to memory of 4128	2876	cmd.exe	125
PID 4128 wrote to memory of 4368	4128	cmd.exe	126
PID 4128 wrote to memory of 3296	4128	cmd.exe	127
PID 2876 wrote to memory of 1460	2876	cmd.exe	128
PID 2876 wrote to memory of 5072	2876	cmd.exe	129
PID 2876 wrote to memory of 3528	2876	cmd.exe	130
PID 2876 wrote to memory of 5164	2876	cmd.exe	131
PID 5164 wrote to memory of 1520	5164	cmd.exe	132
PID 2876 wrote to memory of 2260	2876	cmd.exe	133
PID 2260 wrote to memory of 1280	2260	cmd.exe	134
PID 2876 wrote to memory of 2784	2876	cmd.exe	135
PID 2784 wrote to memory of 5452	2784	cmd.exe	136
PID 2876 wrote to memory of 5516	2876	cmd.exe	137
PID 5516 wrote to memory of 5668	5516	cmd.exe	138
PID 2876 wrote to memory of 4440	2876	cmd.exe	139
PID 2876 wrote to memory of 5848	2876	cmd.exe	140
PID 2876 wrote to memory of 4944	2876	cmd.exe	141
PID 2876 wrote to memory of 4480	2876	cmd.exe	142
PID 2876 wrote to memory of 1420	2876	cmd.exe	143
PID 1420 wrote to memory of 3404	1420	cmd.exe	144
PID 2876 wrote to memory of 1904	2876	cmd.exe	145
PID 2876 wrote to memory of 3872	2876	cmd.exe	146
PID 2876 wrote to memory of 4680	2876	cmd.exe	147
PID 2876 wrote to memory of 4376	2876	cmd.exe	148
PID 2876 wrote to memory of 4432	2876	cmd.exe	149
PID 2876 wrote to memory of 2776	2876	cmd.exe	150

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:5900
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:1020
- C:\Windows\System32\findstr.exe
  findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
  2⤵
  PID:5376
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3076
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:5760
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:5656
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:2888
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:2484
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3728
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2324
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
  2⤵
  PID:5432
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:6116
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:6068
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:3824
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:2580
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:5688
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4452
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:4412
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:2252
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
    3⤵
    PID:5888
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:2752
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:1136
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:1464
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:6016
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:408
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:124
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:240
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:4368
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:3296
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
    3⤵
    PID:1460
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:5072
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3528
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1520
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:1280
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\System32\PING.EXE
      ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5452
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Windows\System32\PING.EXE
      ping -n 1 updatecheck312.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5668
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:4440
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:5848
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:4944
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:4480
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:3404
- - C:\Windows\System32\mode.com
    mode 76, 34
    3⤵
    PID:1904
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:3872
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:4680
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:4376
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:4432
- - C:\Windows\System32\choice.exe
    choice /C:12345678EH0 /N
    3⤵
    PID:2776
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4648-0-0x0000028BFF850000-0x0000028BFF872000-memory.dmp

Download