850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa

Analysis

user interaction
yes
max time kernel
289s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS_AIO.cmd
Size 744KB
Sample261001-sbv79aee64
SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
MD5 8e0a0b48ad0289d647e55d802170d795
SHA1 6adced8154ebaa02e06efcb85715d2663c731bd0
SHA512 58edc773d275dec130cc5ede3c55edc5680f52e1b7ca4d78b349323f6d64b565ba052366b59ff4a94640fb49d14c2ec490dc69946bac9f921cb82bb62bffe563
SSDEEP 6144:g3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Auj:g3IuuhcEvTGGOEmcAXz0ykw7x
TLSH
T192F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5148	powershell.exe
252	powershell.exe
1972	powershell.exe

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3436	sc.exe
1068	sc.exe
2792	sc.exe
4572	sc.exe
4196	sc.exe
1648	sc.exe
5708	sc.exe
2964	sc.exe
2696	sc.exe
3668	sc.exe
3520	sc.exe
4168	sc.exe
6076	sc.exe
992	sc.exe
2004	sc.exe
4480	sc.exe
1340	sc.exe
2440	sc.exe
3332	sc.exe
2680	sc.exe
1608	sc.exe
5688	sc.exe
2084	sc.exe
1152	sc.exe
4712	sc.exe
832	sc.exe
4984	sc.exe
1892	sc.exe
4804	sc.exe
5760	sc.exe
2044	sc.exe
5304	sc.exe
3536	sc.exe
3364	sc.exe
2160	sc.exe
1328	sc.exe
5612	sc.exe

Executes a command shell one-liner 1 TTPs 31 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe
6064	cmd.exe
3928	cmd.exe
5056	cmd.exe
2916	cmd.exe
480	cmd.exe
5748	cmd.exe
4528	cmd.exe
2876	cmd.exe
4588	cmd.exe
2624	cmd.exe
3700	cmd.exe
5396	cmd.exe
1208	cmd.exe
4548	cmd.exe
1752	cmd.exe
4140	cmd.exe
988	cmd.exe
6048	cmd.exe
2384	cmd.exe
2548	cmd.exe
5096	cmd.exe
4328	cmd.exe
3620	cmd.exe
4240	cmd.exe
6108	cmd.exe
4756	cmd.exe
4496	cmd.exe
5884	cmd.exe
1188	cmd.exe
4244	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5396	cmd.exe
5840	PING.EXE
4416	PING.EXE
988	cmd.exe
4244	cmd.exe
1292	PING.EXE

Modifies registry key 1 TTPs 53 IoCs

Modify Registry

T1112

pid	Process
5680	reg.exe
1244	reg.exe
4276	reg.exe
4340	reg.exe
1296	reg.exe
5164	reg.exe
4012	reg.exe
3964	reg.exe
5564	reg.exe
3800	reg.exe
5620	reg.exe
484	reg.exe
1864	reg.exe
5208	reg.exe
1136	reg.exe
876	reg.exe
440	reg.exe
1128	reg.exe
3756	reg.exe
3564	reg.exe
3968	reg.exe
1936	reg.exe
3732	reg.exe
4192	reg.exe
3036	reg.exe
6084	reg.exe
2804	reg.exe
1800	reg.exe
1196	reg.exe
2900	reg.exe
2600	reg.exe
3644	reg.exe
3848	reg.exe
4028	reg.exe
2576	reg.exe
4236	reg.exe
2332	reg.exe
3456	reg.exe
3384	reg.exe
5936	reg.exe
4016	reg.exe
3960	reg.exe
3124	reg.exe
4604	reg.exe
5712	reg.exe
4668	reg.exe
3996	reg.exe
5852	reg.exe
4760	reg.exe
3132	reg.exe
3068	reg.exe
5200	reg.exe
5472	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5840	PING.EXE
4416	PING.EXE
1292	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1948	powershell.exe
1948	powershell.exe
4420	powershell.exe
4420	powershell.exe
4320	WMIC.exe
4320	WMIC.exe
4320	WMIC.exe
4320	WMIC.exe
3768	powershell.exe
3768	powershell.exe
4420	WMIC.exe
4420	WMIC.exe
4420	WMIC.exe
4420	WMIC.exe
5016	powershell.exe
5016	powershell.exe
5148	powershell.exe
5148	powershell.exe
624	powershell.exe
624	powershell.exe
1972	powershell.exe
1972	powershell.exe
3912	WMIC.exe
3912	WMIC.exe
3912	WMIC.exe
3912	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeIncreaseQuotaPrivilege	4320	WMIC.exe
Token: SeSecurityPrivilege	4320	WMIC.exe
Token: SeTakeOwnershipPrivilege	4320	WMIC.exe
Token: SeLoadDriverPrivilege	4320	WMIC.exe
Token: SeSystemProfilePrivilege	4320	WMIC.exe
Token: SeSystemtimePrivilege	4320	WMIC.exe
Token: SeProfSingleProcessPrivilege	4320	WMIC.exe
Token: SeIncBasePriorityPrivilege	4320	WMIC.exe
Token: SeCreatePagefilePrivilege	4320	WMIC.exe
Token: SeBackupPrivilege	4320	WMIC.exe
Token: SeRestorePrivilege	4320	WMIC.exe
Token: SeShutdownPrivilege	4320	WMIC.exe
Token: SeDebugPrivilege	4320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4320	WMIC.exe
Token: SeRemoteShutdownPrivilege	4320	WMIC.exe
Token: SeUndockPrivilege	4320	WMIC.exe
Token: SeManageVolumePrivilege	4320	WMIC.exe
Token: 33	4320	WMIC.exe
Token: 34	4320	WMIC.exe
Token: 35	4320	WMIC.exe
Token: 36	4320	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4320	WMIC.exe
Token: SeSecurityPrivilege	4320	WMIC.exe
Token: SeTakeOwnershipPrivilege	4320	WMIC.exe
Token: SeLoadDriverPrivilege	4320	WMIC.exe
Token: SeSystemProfilePrivilege	4320	WMIC.exe
Token: SeSystemtimePrivilege	4320	WMIC.exe
Token: SeProfSingleProcessPrivilege	4320	WMIC.exe
Token: SeIncBasePriorityPrivilege	4320	WMIC.exe
Token: SeCreatePagefilePrivilege	4320	WMIC.exe
Token: SeBackupPrivilege	4320	WMIC.exe
Token: SeRestorePrivilege	4320	WMIC.exe
Token: SeShutdownPrivilege	4320	WMIC.exe
Token: SeDebugPrivilege	4320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4320	WMIC.exe
Token: SeRemoteShutdownPrivilege	4320	WMIC.exe
Token: SeUndockPrivilege	4320	WMIC.exe
Token: SeManageVolumePrivilege	4320	WMIC.exe
Token: 33	4320	WMIC.exe
Token: 34	4320	WMIC.exe
Token: 35	4320	WMIC.exe
Token: 36	4320	WMIC.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeIncreaseQuotaPrivilege	4420	WMIC.exe
Token: SeSecurityPrivilege	4420	WMIC.exe
Token: SeTakeOwnershipPrivilege	4420	WMIC.exe
Token: SeLoadDriverPrivilege	4420	WMIC.exe
Token: SeSystemProfilePrivilege	4420	WMIC.exe
Token: SeSystemtimePrivilege	4420	WMIC.exe
Token: SeProfSingleProcessPrivilege	4420	WMIC.exe
Token: SeIncBasePriorityPrivilege	4420	WMIC.exe
Token: SeCreatePagefilePrivilege	4420	WMIC.exe
Token: SeBackupPrivilege	4420	WMIC.exe
Token: SeRestorePrivilege	4420	WMIC.exe
Token: SeShutdownPrivilege	4420	WMIC.exe
Token: SeDebugPrivilege	4420	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4420	WMIC.exe
Token: SeRemoteShutdownPrivilege	4420	WMIC.exe
Token: SeUndockPrivilege	4420	WMIC.exe
Token: SeManageVolumePrivilege	4420	WMIC.exe
Token: 33	4420	WMIC.exe
Token: 34	4420	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1648	4496	cmd.exe	90
PID 4496 wrote to memory of 4772	4496	cmd.exe	91
PID 4496 wrote to memory of 4188	4496	cmd.exe	92
PID 4496 wrote to memory of 4588	4496	cmd.exe	93
PID 4496 wrote to memory of 4764	4496	cmd.exe	94
PID 4496 wrote to memory of 1100	4496	cmd.exe	95
PID 4496 wrote to memory of 1968	4496	cmd.exe	96
PID 4496 wrote to memory of 476	4496	cmd.exe	97
PID 4496 wrote to memory of 2624	4496	cmd.exe	98
PID 2624 wrote to memory of 6132	2624	cmd.exe	99
PID 2624 wrote to memory of 1768	2624	cmd.exe	100
PID 4496 wrote to memory of 2784	4496	cmd.exe	101
PID 4496 wrote to memory of 1088	4496	cmd.exe	102
PID 4496 wrote to memory of 4308	4496	cmd.exe	103
PID 4496 wrote to memory of 3928	4496	cmd.exe	104
PID 3928 wrote to memory of 1948	3928	cmd.exe	105
PID 4496 wrote to memory of 4240	4496	cmd.exe	106
PID 4240 wrote to memory of 3208	4240	cmd.exe	107
PID 4496 wrote to memory of 5680	4496	cmd.exe	108
PID 4496 wrote to memory of 5752	4496	cmd.exe	109
PID 4496 wrote to memory of 1244	4496	cmd.exe	110
PID 4496 wrote to memory of 3700	4496	cmd.exe	111
PID 4496 wrote to memory of 6084	4496	cmd.exe	112
PID 3700 wrote to memory of 2160	3700	cmd.exe	115
PID 3700 wrote to memory of 4652	3700	cmd.exe	116
PID 3700 wrote to memory of 108	3700	cmd.exe	117
PID 3700 wrote to memory of 264	3700	cmd.exe	118
PID 3700 wrote to memory of 256	3700	cmd.exe	119
PID 3700 wrote to memory of 5056	3700	cmd.exe	120
PID 3700 wrote to memory of 1036	3700	cmd.exe	121
PID 3700 wrote to memory of 2496	3700	cmd.exe	122
PID 3700 wrote to memory of 1448	3700	cmd.exe	123
PID 3700 wrote to memory of 4524	3700	cmd.exe	124
PID 3700 wrote to memory of 1752	3700	cmd.exe	125
PID 1752 wrote to memory of 6056	1752	cmd.exe	126
PID 1752 wrote to memory of 4176	1752	cmd.exe	127
PID 3700 wrote to memory of 3708	3700	cmd.exe	128
PID 3700 wrote to memory of 2152	3700	cmd.exe	129
PID 3700 wrote to memory of 1788	3700	cmd.exe	130
PID 3700 wrote to memory of 2916	3700	cmd.exe	131
PID 2916 wrote to memory of 4420	2916	cmd.exe	132
PID 3700 wrote to memory of 2548	3700	cmd.exe	133
PID 2548 wrote to memory of 6040	2548	cmd.exe	134
PID 3700 wrote to memory of 5396	3700	cmd.exe	135
PID 5396 wrote to memory of 5840	5396	cmd.exe	136
PID 3700 wrote to memory of 988	3700	cmd.exe	137
PID 988 wrote to memory of 4416	988	cmd.exe	138
PID 3700 wrote to memory of 1812	3700	cmd.exe	139
PID 3700 wrote to memory of 6012	3700	cmd.exe	140
PID 3700 wrote to memory of 3916	3700	cmd.exe	141
PID 3700 wrote to memory of 3484	3700	cmd.exe	142
PID 3700 wrote to memory of 4140	3700	cmd.exe	143
PID 4140 wrote to memory of 3252	4140	cmd.exe	144
PID 3700 wrote to memory of 932	3700	cmd.exe	145
PID 3700 wrote to memory of 3132	3700	cmd.exe	146
PID 3700 wrote to memory of 2944	3700	cmd.exe	147
PID 3700 wrote to memory of 4276	3700	cmd.exe	148
PID 3700 wrote to memory of 4680	3700	cmd.exe	149
PID 3700 wrote to memory of 5544	3700	cmd.exe	150
PID 3700 wrote to memory of 2452	3700	cmd.exe	152
PID 3700 wrote to memory of 3208	3700	cmd.exe	153
PID 3700 wrote to memory of 3608	3700	cmd.exe	154
PID 3700 wrote to memory of 5752	3700	cmd.exe	155
PID 3700 wrote to memory of 2584	3700	cmd.exe	156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:1648
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4772
- C:\Windows\System32\findstr.exe
  findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
  2⤵
  PID:4188
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4588
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4764
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:1100
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:1968
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:476
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:6132
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:1768
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
  2⤵
  PID:2784
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:1088
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:4308
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:3208
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:5680
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:5752
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1244
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:2160
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4652
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
    3⤵
    PID:108
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:264
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:256
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5056
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:1036
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:2496
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:1448
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:4524
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:6056
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4176
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
    3⤵
    PID:3708
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2152
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:1788
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:6040
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\Windows\System32\PING.EXE
      ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5840
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\System32\PING.EXE
      ping -n 1 updatecheck312.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4416
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:1812
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:6012
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:3916
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:3484
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:3252
- - C:\Windows\System32\mode.com
    mode 76, 34
    3⤵
    PID:932
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:3132
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:2944
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:4276
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:4680
- - C:\Windows\System32\choice.exe
    choice /C:12345678EH0 /N
    3⤵
    PID:5544
- - C:\Windows\System32\mode.com
    mode 110, 34
    3⤵
    PID:2452
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:3208
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:3608
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5752
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:2584
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:3348
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4144
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:1328
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:5232
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:4736
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    - Executes a command shell one-liner
    PID:5096
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4320
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:3204
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
    3⤵
    - Executes a command shell one-liner
    PID:6048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3768
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2384
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
      4⤵
      PID:5636
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:5016
- - C:\Windows\System32\find.exe
    find /i "Subscription_is_activated"
    3⤵
    PID:5404
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:5148
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "
    3⤵
    PID:4800
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:1140
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:1972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3912
- - C:\Windows\System32\findstr.exe
    findstr /i "Windows"
    3⤵
    PID:200
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    - Executes a command shell one-liner
    PID:1188
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:1928
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:6108
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4244
  - - C:\Windows\System32\PING.EXE
      ping -n 1 l.root-servers.net
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1292
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:3136
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:5864
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:384
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4636
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5916
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4396
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:2044
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:724
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:1544
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:2440
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
    3⤵
    PID:2352
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
    3⤵
    - Executes a command shell one-liner
    PID:5748
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      PID:6112
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:4984
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:3332
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
    3⤵
    - Modifies registry key
    PID:4604
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
    3⤵
    - Modifies registry key
    PID:2804
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
    3⤵
    - Modifies registry key
    PID:3068
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
    3⤵
    - Modifies registry key
    PID:4236
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
    3⤵
    - Modifies registry key
    PID:1800
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
    3⤵
    - Modifies registry key
    PID:440
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
    3⤵
    - Modifies registry key
    PID:5200
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
    3⤵
    - Modifies registry key
    PID:2332
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:2680
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:6076
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:3036
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
    3⤵
    - Modifies registry key
    PID:1196
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
    3⤵
    - Modifies registry key
    PID:3732
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
    3⤵
    - Modifies registry key
    PID:4760
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:4340
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
    3⤵
    - Modifies registry key
    PID:1128
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
    3⤵
    - Modifies registry key
    PID:5564
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
    3⤵
    - Modifies registry key
    PID:1296
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:1892
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:4804
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:3756
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
    3⤵
    - Modifies registry key
    PID:4192
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
    3⤵
    - Modifies registry key
    PID:2600
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
    3⤵
    - Modifies registry key
    PID:3564
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:5164
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
    3⤵
    - Modifies registry key
    PID:3456
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
    3⤵
    - Modifies registry key
    PID:3800
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
    3⤵
    - Modifies registry key
    PID:3384
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:5708
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:992
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
    3⤵
    - Modifies registry key
    PID:3644
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
    3⤵
    - Modifies registry key
    PID:2900
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
    3⤵
    - Modifies registry key
    PID:5620
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
    3⤵
    - Modifies registry key
    PID:5712
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
    3⤵
    - Modifies registry key
    PID:5936
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
    3⤵
    - Modifies registry key
    PID:484
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
    3⤵
    - Modifies registry key
    PID:1864
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
    3⤵
    - Modifies registry key
    PID:3848
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:1608
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:5304
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
    3⤵
    - Modifies registry key
    PID:4668
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
    3⤵
    - Modifies registry key
    PID:4028
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
    3⤵
    - Modifies registry key
    PID:4012
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
    3⤵
    - Modifies registry key
    PID:4016
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
    3⤵
    - Modifies registry key
    PID:3996
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
    3⤵
    - Modifies registry key
    PID:3968
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
    3⤵
    - Modifies registry key
    PID:3964
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
    3⤵
    - Modifies registry key
    PID:3960
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:3436
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:3364
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
    3⤵
    - Modifies registry key
    PID:3124
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
    3⤵
    - Modifies registry key
    PID:5208
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
    3⤵
    - Modifies registry key
    PID:1936
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
    3⤵
    - Modifies registry key
    PID:1136
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
    3⤵
    - Modifies registry key
    PID:5472
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
    3⤵
    - Modifies registry key
    PID:5852
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
    3⤵
    - Modifies registry key
    PID:2576
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
    3⤵
    - Modifies registry key
    PID:876
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:5688
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:2964
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:2696
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:3668
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:3520
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:2084
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:1152
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5696
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:4196
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:4712
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4212
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:2004
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:1068
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:632
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:2792
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:4168
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5684
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:5760
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:4480
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4372
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:4572
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:1340
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:1384
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:5612
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    PID:3052
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:2780
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService get Version
    3⤵
    PID:1028
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    - Executes a command shell one-liner
    PID:4528
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
    3⤵
    PID:5672
- - C:\Windows\System32\findstr.exe
    findstr /i "0x800410 0x800440 0x80131501"
    3⤵
    PID:5432
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
    3⤵
    PID:3852
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4548
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
      4⤵
      PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    PID:5328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:252
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:1476
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
    3⤵
    PID:824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
    3⤵
    PID:4176
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      PID:3056
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
    3⤵
    PID:4828
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
    3⤵
    PID:1984
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
      4⤵
      PID:4908
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:2460
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
      4⤵
      PID:2972
- - C:\Windows\System32\sc.exe
    sc query wlms
    3⤵
    - Launches sc.exe
    PID:3536
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
    3⤵
    PID:1352
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
    3⤵
    PID:2000
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
    3⤵
    PID:3452
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
    3⤵
    PID:3372
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:6064
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
      4⤵
      PID:4960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
    3⤵
    PID:3788
- - C:\Windows\System32\findstr.exe
    findstr /i "KMS_"
    3⤵
    PID:1600
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
      4⤵
      PID:4820
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "
    3⤵
    PID:3160
- - C:\Windows\System32\find.exe
    find /i "Ready"
    3⤵
    PID:5040
- - C:\Windows\System32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
    3⤵
    PID:5824
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
    3⤵
    PID:1172
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
    3⤵
    PID:2408
- - C:\Windows\System32\findstr.exe
    findstr /i "Removed Not Found"
    3⤵
    PID:2420
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
      4⤵
      PID:4068
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 299d7afe-0eac-400f-b6c7-da11a8b2a756 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 5a85300a-bfce-474f-ac07-a30983e3fb90 60b3ec1b-9545-4921-821f-311b129dd6f6 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 d4f9b41f-205c-405e-8e08-3d16e88e02be d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ec95c5fa-85de-463d-a6c4-aa9a1cd2ce12 f6e29426-a256-4316-88bf-cc5b0f95ec0c " "
    3⤵
    PID:5972
- - C:\Windows\System32\find.exe
    find /i "ed655016-a9e8-4434-95d9-4345352c2552"
    3⤵
    PID:1892
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 299d7afe-0eac-400f-b6c7-da11a8b2a756 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 5a85300a-bfce-474f-ac07-a30983e3fb90 60b3ec1b-9545-4921-821f-311b129dd6f6 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 d4f9b41f-205c-405e-8e08-3d16e88e02be d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ec95c5fa-85de-463d-a6c4-aa9a1cd2ce12 f6e29426-a256-4316-88bf-cc5b0f95ec0c " "
    3⤵
    PID:3756
- - C:\Windows\System32\find.exe
    find /i "6c4de1b8-24bb-4c17-9a77-7b939414c298"
    3⤵
    PID:2104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="CGK42-GYN6Y-VD22B-BX98W-J8JXD"
    3⤵
    PID:4704
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    - Executes a command shell one-liner
    PID:4756
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
    3⤵
    PID:3560
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:6084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery