850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS_AIO.cmd
Size 744KB
Sample260831-h2chqaep3s
SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
MD5 8e0a0b48ad0289d647e55d802170d795
SHA1 6adced8154ebaa02e06efcb85715d2663c731bd0
SHA512 58edc773d275dec130cc5ede3c55edc5680f52e1b7ca4d78b349323f6d64b565ba052366b59ff4a94640fb49d14c2ec490dc69946bac9f921cb82bb62bffe563
SSDEEP 6144:g3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Auj:g3IuuhcEvTGGOEmcAXz0ykw7x
TLSH
T192F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution

Malware Config

Signatures

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6016	sc.exe
3112	sc.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4544	cmd.exe
4396	cmd.exe
3780	cmd.exe
4380	cmd.exe
4708	cmd.exe
2492	cmd.exe
5408	cmd.exe
5176	cmd.exe
4528	cmd.exe
2180	cmd.exe
4100	cmd.exe
5764	cmd.exe
5880	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2492	cmd.exe
3992	PING.EXE
5408	cmd.exe
1824	PING.EXE

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
1784	reg.exe
972	reg.exe
3572	reg.exe
3444	reg.exe
5584	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3992	PING.EXE
1824	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3932	powershell.exe
3932	powershell.exe
2744	powershell.exe
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 6016	4544	cmd.exe	90
PID 4544 wrote to memory of 5784	4544	cmd.exe	91
PID 4544 wrote to memory of 1064	4544	cmd.exe	92
PID 4544 wrote to memory of 4396	4544	cmd.exe	93
PID 4544 wrote to memory of 6052	4544	cmd.exe	94
PID 4544 wrote to memory of 3220	4544	cmd.exe	95
PID 4544 wrote to memory of 4976	4544	cmd.exe	96
PID 4544 wrote to memory of 396	4544	cmd.exe	97
PID 4544 wrote to memory of 3780	4544	cmd.exe	98
PID 3780 wrote to memory of 3984	3780	cmd.exe	99
PID 3780 wrote to memory of 3324	3780	cmd.exe	100
PID 4544 wrote to memory of 5612	4544	cmd.exe	101
PID 4544 wrote to memory of 4120	4544	cmd.exe	102
PID 4544 wrote to memory of 4704	4544	cmd.exe	103
PID 4544 wrote to memory of 4528	4544	cmd.exe	104
PID 4528 wrote to memory of 3932	4528	cmd.exe	105
PID 4544 wrote to memory of 4380	4544	cmd.exe	106
PID 4380 wrote to memory of 6036	4380	cmd.exe	107
PID 4544 wrote to memory of 1784	4544	cmd.exe	108
PID 4544 wrote to memory of 2344	4544	cmd.exe	109
PID 4544 wrote to memory of 972	4544	cmd.exe	110
PID 4544 wrote to memory of 4708	4544	cmd.exe	111
PID 4544 wrote to memory of 3572	4544	cmd.exe	112
PID 4708 wrote to memory of 3112	4708	cmd.exe	115
PID 4708 wrote to memory of 4316	4708	cmd.exe	116
PID 4708 wrote to memory of 4160	4708	cmd.exe	117
PID 4708 wrote to memory of 5760	4708	cmd.exe	118
PID 4708 wrote to memory of 2268	4708	cmd.exe	119
PID 4708 wrote to memory of 2180	4708	cmd.exe	120
PID 4708 wrote to memory of 4252	4708	cmd.exe	121
PID 4708 wrote to memory of 1048	4708	cmd.exe	122
PID 4708 wrote to memory of 3448	4708	cmd.exe	123
PID 4708 wrote to memory of 3288	4708	cmd.exe	124
PID 4708 wrote to memory of 4100	4708	cmd.exe	125
PID 4100 wrote to memory of 1604	4100	cmd.exe	126
PID 4100 wrote to memory of 1692	4100	cmd.exe	127
PID 4708 wrote to memory of 2920	4708	cmd.exe	128
PID 4708 wrote to memory of 784	4708	cmd.exe	129
PID 4708 wrote to memory of 3084	4708	cmd.exe	130
PID 4708 wrote to memory of 5764	4708	cmd.exe	131
PID 5764 wrote to memory of 2744	5764	cmd.exe	132
PID 4708 wrote to memory of 5880	4708	cmd.exe	133
PID 5880 wrote to memory of 4888	5880	cmd.exe	134
PID 4708 wrote to memory of 2492	4708	cmd.exe	135
PID 2492 wrote to memory of 3992	2492	cmd.exe	136
PID 4708 wrote to memory of 5408	4708	cmd.exe	137
PID 5408 wrote to memory of 1824	5408	cmd.exe	138
PID 4708 wrote to memory of 2708	4708	cmd.exe	139
PID 4708 wrote to memory of 1296	4708	cmd.exe	140
PID 4708 wrote to memory of 2932	4708	cmd.exe	141
PID 4708 wrote to memory of 4412	4708	cmd.exe	142
PID 4708 wrote to memory of 5176	4708	cmd.exe	143
PID 5176 wrote to memory of 4584	5176	cmd.exe	144
PID 4708 wrote to memory of 4476	4708	cmd.exe	145
PID 4708 wrote to memory of 3444	4708	cmd.exe	146
PID 4708 wrote to memory of 1684	4708	cmd.exe	147
PID 4708 wrote to memory of 5584	4708	cmd.exe	148
PID 4708 wrote to memory of 2592	4708	cmd.exe	149
PID 4708 wrote to memory of 2388	4708	cmd.exe	150

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:6016
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:5784
- C:\Windows\System32\findstr.exe
  findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
  2⤵
  PID:1064
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4396
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:6052
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:3220
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:4976
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:396
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:3984
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:3324
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
  2⤵
  PID:5612
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4120
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:4704
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:6036
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:1784
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2344
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:972
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:3112
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4316
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
    3⤵
    PID:4160
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:5760
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:2268
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:2180
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:4252
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:1048
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:3448
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:3288
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:1604
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:1692
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
    3⤵
    PID:2920
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:784
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3084
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2744
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:4888
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\System32\PING.EXE
      ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3992
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\System32\PING.EXE
      ping -n 1 updatecheck312.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1824
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:2708
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:1296
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:2932
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:4412
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:4584
- - C:\Windows\System32\mode.com
    mode 76, 34
    3⤵
    PID:4476
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:3444
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:1684
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:5584
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:2592
- - C:\Windows\System32\choice.exe
    choice /C:12345678EH0 /N
    3⤵
    PID:2388
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 0989be8b16552ed61c3b22fa0e58713680c4c6d4e6dd8c5792398b953440d596
MD5 bf5c406537eee81450c2ebcc45cb7dcc
SHA1 3273c2a3744bfa85aa6cd46012d1be9c85e69a52
SHA512 0173c86b081df883f9dcd32df4e4a9293266613912018a6a45910ac5d0663a793dd7b4794374c7171b6f06dc8d018da0b37d3664f770297a0d0cf01aac3c673a
TLSH
T125114433F3CC8624DC59403650CEA91136B687CB409ECE6B7B84D154A42F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3932-2-0x000002487D920000-0x000002487D942000-memory.dmp

Download