15c8aee0beddebe3eae3d666de68737fa9aa5b211540cbaa83ff03f0011f5224

Analysis

user interaction
yes
max time kernel
122s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windows_activation_.exe
Size 2.0MB
Sample260823-zsys2azgnc
SHA256 15c8aee0beddebe3eae3d666de68737fa9aa5b211540cbaa83ff03f0011f5224
MD5 b4a32a8cb456c434429658fb4d440a71
SHA1 9634db91736a90b52f391ed958e30c39207ac58e
SHA512 f0908ba0d49680ddb333ee8589ea16d236ab2a2114d6d99b7edbdb920e8d3740bedc6d556f4cefdfda46d3377a1813f9b87f4fa42af9064a90d001e15ec7ce44
SSDEEP 12288:mu/va+3zyqxan5rDyUq8Gvu5LVtlhLNzDhTLaniXh3kYBIeKuowv6Y8o:Dva+an5rDyUq8GveLLTLNzpa0k01ao
TLSH
T1CAA55006E7B610CDECB6DD3994522229B8713E95473897FFD245BA0A0B31BE4A93D703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
2804	takeown.exe
2796	icacls.exe
5324	icacls.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2804	takeown.exe
2796	icacls.exe
5324	icacls.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2936	powershell.exe
2828	powershell.exe
1536	powershell.exe
248	powershell.exe
4292	powershell.exe
2684	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
1828	WScript.exe
4860	WScript.exe
2824	WScript.exe
1304	cscript.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\IME\permissions.bat	Windows_activation_.exe
File created	C:\Windows\IME\reset.bat	Windows_activation_.exe
File created	C:\Windows\IME\activator.bat	Windows_activation_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
108	cmd.exe
2388	cmd.exe
5260	cmd.exe
4440	cmd.exe
2456	cmd.exe
2696	cmd.exe
204	cmd.exe
4412	cmd.exe
5032	cmd.exe
1220	cmd.exe
3360	cmd.exe
2536	cmd.exe
5796	cmd.exe
3156	cmd.exe
2500	cmd.exe
3468	cmd.exe
1540	cmd.exe
3516	cmd.exe
6124	cmd.exe
1576	cmd.exe
5232	cmd.exe
5432	cmd.exe
3460	cmd.exe
4112	cmd.exe
5836	cmd.exe
820	cmd.exe
5700	cmd.exe
1772	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5548	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
248	powershell.exe
248	powershell.exe
4292	powershell.exe
4292	powershell.exe
2684	powershell.exe
2684	powershell.exe
2936	powershell.exe
2936	powershell.exe
2828	powershell.exe
2828	powershell.exe
1536	powershell.exe
1536	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2804	takeown.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeBackupPrivilege	2828	powershell.exe
Token: SeBackupPrivilege	2828	powershell.exe
Token: SeRestorePrivilege	2828	powershell.exe
Token: SeSecurityPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 5260	4928	Windows_activation_.exe	90
PID 4928 wrote to memory of 3360	4928	Windows_activation_.exe	91
PID 4928 wrote to memory of 4440	4928	Windows_activation_.exe	92
PID 4928 wrote to memory of 3460	4928	Windows_activation_.exe	93
PID 4928 wrote to memory of 2456	4928	Windows_activation_.exe	94
PID 4928 wrote to memory of 4112	4928	Windows_activation_.exe	95
PID 4928 wrote to memory of 2500	4928	Windows_activation_.exe	96
PID 4928 wrote to memory of 2536	4928	Windows_activation_.exe	97
PID 4928 wrote to memory of 5836	4928	Windows_activation_.exe	98
PID 4928 wrote to memory of 820	4928	Windows_activation_.exe	99
PID 4928 wrote to memory of 3468	4928	Windows_activation_.exe	100
PID 4928 wrote to memory of 5700	4928	Windows_activation_.exe	101
PID 4928 wrote to memory of 2696	4928	Windows_activation_.exe	103
PID 4928 wrote to memory of 1772	4928	Windows_activation_.exe	104
PID 4928 wrote to memory of 5796	4928	Windows_activation_.exe	105
PID 4928 wrote to memory of 1540	4928	Windows_activation_.exe	106
PID 1540 wrote to memory of 2804	1540	cmd.exe	107
PID 1540 wrote to memory of 2796	1540	cmd.exe	108
PID 1540 wrote to memory of 5324	1540	cmd.exe	109
PID 4928 wrote to memory of 3516	4928	Windows_activation_.exe	110
PID 4928 wrote to memory of 204	4928	Windows_activation_.exe	111
PID 4928 wrote to memory of 108	4928	Windows_activation_.exe	112
PID 108 wrote to memory of 248	108	cmd.exe	113
PID 4928 wrote to memory of 6124	4928	Windows_activation_.exe	114
PID 6124 wrote to memory of 4292	6124	cmd.exe	115
PID 4928 wrote to memory of 2388	4928	Windows_activation_.exe	116
PID 2388 wrote to memory of 2684	2388	cmd.exe	117
PID 4928 wrote to memory of 4412	4928	Windows_activation_.exe	118
PID 4412 wrote to memory of 2936	4412	cmd.exe	119
PID 4928 wrote to memory of 1576	4928	Windows_activation_.exe	120
PID 1576 wrote to memory of 2828	1576	cmd.exe	121
PID 4928 wrote to memory of 5032	4928	Windows_activation_.exe	122
PID 5032 wrote to memory of 1536	5032	cmd.exe	123
PID 4928 wrote to memory of 1220	4928	Windows_activation_.exe	124
PID 4928 wrote to memory of 3156	4928	Windows_activation_.exe	125
PID 3156 wrote to memory of 5788	3156	cmd.exe	126
PID 5788 wrote to memory of 4920	5788	net.exe	127
PID 3156 wrote to memory of 2956	3156	cmd.exe	131
PID 2956 wrote to memory of 4676	2956	net.exe	132
PID 3156 wrote to memory of 1304	3156	cmd.exe	133
PID 4928 wrote to memory of 5232	4928	Windows_activation_.exe	136
PID 4928 wrote to memory of 5432	4928	Windows_activation_.exe	137
PID 5432 wrote to memory of 1828	5432	cmd.exe	138
PID 5432 wrote to memory of 4860	5432	cmd.exe	139
PID 5432 wrote to memory of 2824	5432	cmd.exe	140
PID 5432 wrote to memory of 5548	5432	cmd.exe	141

C:\Users\Admin\AppData\Local\Temp\Windows_activation_.exe
"C:\Users\Admin\AppData\Local\Temp\Windows_activation_.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Windows Activation Fix
  2⤵
  - Executes a command shell one-liner
  PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0b
  2⤵
  - Executes a command shell one-liner
  PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  - Executes a command shell one-liner
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo This tool will fix your Windows Activation
  2⤵
  - Executes a command shell one-liner
  PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  - Executes a command shell one-liner
  PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  - Executes a command shell one-liner
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  - Executes a command shell one-liner
  PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Made by HakerMan
  2⤵
  - Executes a command shell one-liner
  PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  - Executes a command shell one-liner
  PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  - Executes a command shell one-liner
  PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  - Executes a command shell one-liner
  PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Starting...
  2⤵
  - Executes a command shell one-liner
  PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %windir%\IME\permissions.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\takeown.exe
    takeown /F C:\Windows\System32\sppsvc.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32 /grant administrators:F /T
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2796
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\spp /grant administrators:F /T
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Applying permissions...
  2⤵
  - Executes a command shell one-liner
  PID:204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl '%windir%\System32'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path '%windir%\System32' -AclObject $acl
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'C:\Windows\System32'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'C:\Windows\System32' -AclObject $acl
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl '%windir%\System32\spp'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path '%windir%\System32\spp' -AclObject $acl
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'C:\Windows\System32\spp'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'C:\Windows\System32\spp' -AclObject $acl
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %windir%\IME\reset.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\system32\net.exe
    net stop sppsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sppsvc
      4⤵
      PID:4920
- - C:\Windows\system32\net.exe
    net start sppsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start sppsvc
      4⤵
      PID:4676
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs /rilc
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %windir%\IME\activator.bat
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" //B /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1828
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" //B /skms kms8.msguides.com
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" //B /ato
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2824
- - C:\Windows\system32\timeout.exe
    timeout /T 3 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:5548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact