63cdca888106a10300d9a5cccf87846bb38b1e72846960d0d8fc6399860855f1

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS_AIO.cmd
Size 428KB
Sample260830-2bsxkattbv
SHA256 63cdca888106a10300d9a5cccf87846bb38b1e72846960d0d8fc6399860855f1
MD5 a3d8f86f818054d97bf0b0e30fdfe5e1
SHA1 c5c8ac535fef1ca20811738096d6e21fdc716913
SHA512 87f203dc129e1bc7726e875b391c2e49f74416e3fb4ffbe5208d0982803613cc18e30c28c343c57deac5ed757eca2181f48804ebc8934cc7e46727e9c799f380
SSDEEP 3072:DHuhi3wRTH+RD5ReZNiYFRd8nV2oajKWLtVIXFudpH7GDfSCE2K1C/Z71OGJGOER:y+D5R0VLQwIXFudpH7GDfS0K1C/Y
TLSH
T1A79417433D0250A141B3F3B9DA27918FF72DC593C321E6ACB56EC464BB6A38661FD648
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution

Malware Config

Signatures

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4464	sc.exe
4980	sc.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4444	cmd.exe
3728	cmd.exe
5248	cmd.exe
5508	cmd.exe
5732	cmd.exe
1980	cmd.exe
1492	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
5792	reg.exe
3004	reg.exe
2204	reg.exe
5720	reg.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4464	4444	cmd.exe	90
PID 4444 wrote to memory of 5328	4444	cmd.exe	91
PID 4444 wrote to memory of 4968	4444	cmd.exe	92
PID 4444 wrote to memory of 3728	4444	cmd.exe	93
PID 4444 wrote to memory of 4512	4444	cmd.exe	94
PID 4444 wrote to memory of 256	4444	cmd.exe	95
PID 4444 wrote to memory of 5248	4444	cmd.exe	96
PID 5248 wrote to memory of 5232	5248	cmd.exe	97
PID 5248 wrote to memory of 3448	5248	cmd.exe	98
PID 4444 wrote to memory of 2800	4444	cmd.exe	99
PID 4444 wrote to memory of 1564	4444	cmd.exe	100
PID 4444 wrote to memory of 3776	4444	cmd.exe	101
PID 4444 wrote to memory of 5792	4444	cmd.exe	102
PID 4444 wrote to memory of 3176	4444	cmd.exe	103
PID 4444 wrote to memory of 3004	4444	cmd.exe	104
PID 4444 wrote to memory of 5508	4444	cmd.exe	105
PID 5508 wrote to memory of 2204	5508	cmd.exe	107
PID 5508 wrote to memory of 4980	5508	cmd.exe	108
PID 5508 wrote to memory of 4808	5508	cmd.exe	109
PID 5508 wrote to memory of 3792	5508	cmd.exe	110
PID 5508 wrote to memory of 2880	5508	cmd.exe	111
PID 5508 wrote to memory of 5776	5508	cmd.exe	112
PID 5508 wrote to memory of 5732	5508	cmd.exe	113
PID 5508 wrote to memory of 3344	5508	cmd.exe	114
PID 5508 wrote to memory of 4292	5508	cmd.exe	115
PID 5508 wrote to memory of 1980	5508	cmd.exe	116
PID 1980 wrote to memory of 2560	1980	cmd.exe	117
PID 1980 wrote to memory of 4424	1980	cmd.exe	118
PID 5508 wrote to memory of 3504	5508	cmd.exe	119
PID 5508 wrote to memory of 4824	5508	cmd.exe	120
PID 5508 wrote to memory of 3952	5508	cmd.exe	121
PID 5508 wrote to memory of 5720	5508	cmd.exe	122
PID 5508 wrote to memory of 3704	5508	cmd.exe	123
PID 5508 wrote to memory of 3724	5508	cmd.exe	124
PID 5508 wrote to memory of 4520	5508	cmd.exe	125
PID 5508 wrote to memory of 632	5508	cmd.exe	126
PID 5508 wrote to memory of 4844	5508	cmd.exe	127
PID 5508 wrote to memory of 1492	5508	cmd.exe	128
PID 1492 wrote to memory of 1440	1492	cmd.exe	129
PID 5508 wrote to memory of 1164	5508	cmd.exe	130
PID 5508 wrote to memory of 5332	5508	cmd.exe	131

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4464
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:5328
- C:\Windows\System32\findstr.exe
  findstr /v "$" "MAS_AIO.cmd"
  2⤵
  PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3728
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4512
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:5232
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
  2⤵
  PID:2800
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:1564
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:3776
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:5792
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:3176
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d "0" /f
  2⤵
  - Modifies registry key
  PID:3004
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d "1" /f
    3⤵
    - Modifies registry key
    PID:2204
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:4980
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4808
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "MAS_AIO.cmd"
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:2880
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5732
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:3344
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:2560
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
    3⤵
    PID:3504
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4824
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3952
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:5720
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:3724
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:632
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:1440
- - C:\Windows\System32\mode.com
    mode 76, 30
    3⤵
    PID:1164
- - C:\Windows\System32\choice.exe
    choice /C:123456780 /N
    3⤵
    PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads