cd415ea59f8f56f93e5ad2e5742e3b0c96ce8916b1745f79f36c8c442b4fecfd

General

Target
Activar Windows.bat
Size 1KB
Sample260504-bykllaex4n
SHA256 cd415ea59f8f56f93e5ad2e5742e3b0c96ce8916b1745f79f36c8c442b4fecfd
MD5 8e6150a4d3cb8af14d302102ca26bf38
SHA1 1618b6fdeccd909aae3b1789fe7d917d705c02bf
SHA512 f3ab57ea7a0270fb23890c6f909cd9e579923811fa3e45e42897b5a24293ec5556c148d50729f27516d3950f29491239432831caa2f86fd37d4906d107e69f91
TLSH
T1D1113A1C154B8E21316698A0D3653165E657B397587485D0F0E272809DAC3C9DEA6EBC
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware discovery persistence spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klhk\Parameters	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab	DeviceCensus.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache	DeviceCensus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DeviceCensus.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	DeviceCensus.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	DeviceCensus.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1480	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2188	control.exe
Token: SeCreatePagefilePrivilege	2188	control.exe
Token: SeShutdownPrivilege	1480	explorer.exe
Token: SeCreatePagefilePrivilege	1480	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1480	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 4080	2872	cmd.exe	86
PID 2872 wrote to memory of 2760	2872	cmd.exe	87
PID 2872 wrote to memory of 5060	2872	cmd.exe	96
PID 2872 wrote to memory of 5672	2872	cmd.exe	98
PID 2872 wrote to memory of 452	2872	cmd.exe	99
PID 2872 wrote to memory of 3800	2872	cmd.exe	100
PID 2872 wrote to memory of 5744	2872	cmd.exe	103
PID 2872 wrote to memory of 4936	2872	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Activar Windows.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4080
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /rilc
  2⤵
  PID:2760
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /upk
  2⤵
  PID:5060
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /ckms
  2⤵
  PID:5672
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /cpky
  2⤵
  PID:452
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
  2⤵
  PID:3800
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms.digiboy.ir
  2⤵
  PID:5744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
  2⤵
  PID:4936

C:\Windows\system32\DeviceCensus.exe
C:\Windows\system32\DeviceCensus.exe
1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:3640

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" SYSTEM
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1480