cd415ea59f8f56f93e5ad2e5742e3b0c96ce8916b1745f79f36c8c442b4fecfd

Analysis

user interaction
yes
max time kernel
98s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Activar Windows.bat
Size 1KB
Sample260504-bykllaex4n
SHA256 cd415ea59f8f56f93e5ad2e5742e3b0c96ce8916b1745f79f36c8c442b4fecfd
MD5 8e6150a4d3cb8af14d302102ca26bf38
SHA1 1618b6fdeccd909aae3b1789fe7d917d705c02bf
SHA512 f3ab57ea7a0270fb23890c6f909cd9e579923811fa3e45e42897b5a24293ec5556c148d50729f27516d3950f29491239432831caa2f86fd37d4906d107e69f91
TLSH
T1D1113A1C154B8E21316698A0D3653165E657B397587485D0F0E272809DAC3C9DEA6EBC
MD5 SHA1 SHA512 TLSH

Score

5^/10

persistence

Malware Config

Signatures

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val	DeviceCensus.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache	DeviceCensus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DeviceCensus.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	DeviceCensus.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeShutdownPrivilege	5240	svchost.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe
Token: SeRestorePrivilege	4276	DeviceCensus.exe
Token: SeBackupPrivilege	4276	DeviceCensus.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 5264	1324	cmd.exe	80
PID 1324 wrote to memory of 4772	1324	cmd.exe	81
PID 1324 wrote to memory of 5044	1324	cmd.exe	83
PID 1324 wrote to memory of 2980	1324	cmd.exe	85
PID 1324 wrote to memory of 1508	1324	cmd.exe	86
PID 1324 wrote to memory of 1676	1324	cmd.exe	87
PID 1324 wrote to memory of 708	1324	cmd.exe	89
PID 1324 wrote to memory of 4972	1324	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Activar Windows.bat"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:5264
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /rilc
  2⤵
  PID:4772
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /upk
  2⤵
  PID:5044
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /ckms
  2⤵
  PID:2980
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /cpky
  2⤵
  PID:1508
- C:\Windows\system32\cscript.exe
  cscript.exe C:\Windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
  2⤵
  PID:1676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms.digiboy.ir
  2⤵
  PID:708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
  2⤵
  PID:4972

C:\Windows\system32\DeviceCensus.exe
C:\Windows\system32\DeviceCensus.exe
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/708-6-0x0000028C210B0000-0x0000028C210BC000-memory.dmp

Download

memory/1508-4-0x000002490CCD0000-0x000002490CCDC000-memory.dmp

Download

memory/1676-5-0x00000250C1400000-0x00000250C140C000-memory.dmp

Download

memory/2980-3-0x0000021CADBB0000-0x0000021CADBBC000-memory.dmp

Download

memory/4276-10-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-16-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-12-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-13-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-15-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-9-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-8-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-14-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-18-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4276-17-0x00000205D6AB0000-0x00000205D6AB1000-memory.dmp

Download

memory/4772-0-0x0000022DD6E80000-0x0000022DD6E8C000-memory.dmp

Download

memory/4772-1-0x0000022DD6E80000-0x0000022DD6E8C000-memory.dmp

Download

memory/4972-7-0x000002094C1D0000-0x000002094C1DC000-memory.dmp

Download

memory/5044-2-0x00000188F68C0000-0x00000188F68CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads