f90a874fd6f5040b3aeb4b22f4271b062ea7157d28f050de566b35f11775a6b1

Analysis

user interaction
yes
max time kernel
44s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/08/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kaspersky_trial_reset.bat
Size 3KB
Sample260831-afhtlsvsgs
SHA256 f90a874fd6f5040b3aeb4b22f4271b062ea7157d28f050de566b35f11775a6b1
MD5 e0e238b50ce8073306b9e480a79da32c
SHA1 523f4938243b199686a58dda8ad20e379d941cc5
SHA512 9b8038f174b184c5888032a046439d3508a5046c53da025ca7ce6193a1655f7d6caa125a13c0725a3938e8ee959d4e393b61fa18bafb0c8f545bb60cf8856c8b
TLSH
T12761F4162A2612AECD93103DCAB8D541627940B124C34905ECD7A3B46252CFF66BE3FF
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 39 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\UseKSN	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_kis	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\ActivationCode_kfa	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_kav	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\UseKSN = "1"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\ShowActivateTrialOption = "1"	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings\Ins_InitMode	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\ShowActivateTrialOption	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings\EnableSelfProtection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_kav	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\LicStrg	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\ActivationCode_kfa	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_kis	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings\Kaspersky_ID	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings\Ins_InitMode = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_pure	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_saas	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\LicCache	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_saas	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\LicensingActivationErrorStorageLogic	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings\EnableSelfProtection = "1"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment\TrialActCode_pure	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings\Kaspersky_ID	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\UPAO	reg.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
664	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2880	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
588	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5996	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2580	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2880	powershell.exe
2880	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	664	tasklist.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 5856	588	cmd.exe	81
PID 588 wrote to memory of 2880	588	cmd.exe	82
PID 588 wrote to memory of 5996	588	cmd.exe	83
PID 588 wrote to memory of 664	588	cmd.exe	84
PID 588 wrote to memory of 2116	588	cmd.exe	85
PID 588 wrote to memory of 2584	588	cmd.exe	87
PID 588 wrote to memory of 4676	588	cmd.exe	88
PID 588 wrote to memory of 2580	588	cmd.exe	89
PID 588 wrote to memory of 5720	588	cmd.exe	90
PID 588 wrote to memory of 4052	588	cmd.exe	91
PID 588 wrote to memory of 784	588	cmd.exe	92
PID 588 wrote to memory of 4436	588	cmd.exe	93
PID 588 wrote to memory of 3564	588	cmd.exe	94
PID 588 wrote to memory of 3764	588	cmd.exe	95
PID 588 wrote to memory of 3936	588	cmd.exe	96
PID 588 wrote to memory of 2644	588	cmd.exe	97
PID 588 wrote to memory of 3360	588	cmd.exe	98
PID 588 wrote to memory of 4404	588	cmd.exe	99
PID 588 wrote to memory of 488	588	cmd.exe	100
PID 588 wrote to memory of 868	588	cmd.exe	101
PID 588 wrote to memory of 2860	588	cmd.exe	102
PID 588 wrote to memory of 2904	588	cmd.exe	103
PID 588 wrote to memory of 2064	588	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kaspersky_trial_reset.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\system32\fsutil.exe
  fsutil dirty query C:
  2⤵
  PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powerShell -Command "Write-Host 'My github -> https://github.com/daboynb' -ForegroundColor Green; exit"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\system32\timeout.exe
  timeout 04
  2⤵
  - Delays execution with timeout.exe
  PID:5996
- C:\Windows\system32\tasklist.exe
  tasklist /nh /fi "imagename eq avp.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\system32\find.exe
  find /i "avp.exe"
  2⤵
  PID:2116
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings /v EnableSelfProtection
  2⤵
  - Checks for any installed AV software in registry
  PID:2584
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg delete HKLM\SOFTWARE\Microsoft\SystemCertificates\SPC /f
  2⤵
  - Modifies registry key
  PID:2580
- C:\Windows\system32\reg.exe
  reg delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\LicCache /f
  2⤵
  - Checks for any installed AV software in registry
  PID:5720
- C:\Windows\system32\reg.exe
  reg delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\LicensingActivationErrorStorageLogic /f
  2⤵
  - Checks for any installed AV software in registry
  PID:4052
- C:\Windows\system32\reg.exe
  reg delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data\UPAO /f
  2⤵
  - Checks for any installed AV software in registry
  PID:784
- C:\Windows\system32\reg.exe
  reg delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\LicStrg /f
  2⤵
  - Checks for any installed AV software in registry
  PID:4436
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\Data /v UseKSN /f /t REG_DWORD /d 1
  2⤵
  - Checks for any installed AV software in registry
  PID:3564
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment /v ShowActivateTrialOption /f /t REG_SZ /d "1"
  2⤵
  - Checks for any installed AV software in registry
  PID:3764
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings /v Ins_InitMode /f /t REG_DWORD /d 1
  2⤵
  - Checks for any installed AV software in registry
  PID:3936
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings /v EnableSelfProtection /f /t REG_DWORD /d 1
  2⤵
  - Checks for any installed AV software in registry
  PID:2644
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment /v ActivationCode_kfa /f /t REG_SZ /d ""
  2⤵
  - Checks for any installed AV software in registry
  PID:3360
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment /v TrialActCode_kav /f /t REG_SZ /d ""
  2⤵
  - Checks for any installed AV software in registry
  PID:4404
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment /v TrialActCode_kis /f /t REG_SZ /d ""
  2⤵
  - Checks for any installed AV software in registry
  PID:488
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment /v TrialActCode_pure /f /t REG_SZ /d ""
  2⤵
  - Checks for any installed AV software in registry
  PID:868
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\environment /v TrialActCode_saas /f /t REG_SZ /d ""
  2⤵
  - Checks for any installed AV software in registry
  PID:2860
- C:\Windows\system32\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.3\settings /v Kaspersky_ID /f /t REG_SZ /d ""
  2⤵
  - Checks for any installed AV software in registry
  PID:2904
- C:\Windows\system32\choice.exe
  choice /c yn /m "Reboot now?"
  2⤵
  PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Software Discovery

T1518

Security Software Discovery

T1518.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_xdtc5vx1.uzk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdtc5vx1.uzk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2880-0-0x000001624FD3A000-0x000001624FD3B000-memory.dmp

Download

memory/2880-6-0x0000016268450000-0x0000016268472000-memory.dmp

Download

memory/2880-8-0x000001624F570000-0x0000016250032000-memory.dmp

Download

memory/2880-9-0x000001624F570000-0x0000016250032000-memory.dmp

Download

memory/2880-10-0x000001624F570000-0x0000016250032000-memory.dmp

Download

memory/2880-13-0x000001624F570000-0x0000016250032000-memory.dmp

Download