a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16

General

Target

a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
Size

707KB
MD5

f0cdde5d3dbd39b15970de7d8b65c4d3
SHA1

ee7fe92c7d68b3f43f64a78cd220ca270ef2d89c
SHA256

a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16
SHA512

27978d5e010f36f1612de868ed53c4fc063aa6407b0eae2cec41569a3f219492fbe52e0d011fe6f04f95c3b1d50a2de6ac35a753d3d0a4939d7d5845fb824ccb
SSDEEP

6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1O8avnh:6uaTmkZJ+naie5OTamgEoKxLW10h

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta"	reg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\.Hunt2	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Hunt2	reg.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
Token: SeRestorePrivilege	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
Token: SeBackupPrivilege	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
Token: SeTakeOwnershipPrivilege	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
Token: SeAuditPrivilege	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
Token: SeSecurityPrivilege	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
Token: SeIncBasePriorityPrivilege	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4220	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	91
PID 3920 wrote to memory of 4220	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	91
PID 3920 wrote to memory of 3452	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	92
PID 3920 wrote to memory of 3452	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	92
PID 3920 wrote to memory of 740	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	94
PID 3920 wrote to memory of 740	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	94
PID 3920 wrote to memory of 4796	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	97
PID 3920 wrote to memory of 4796	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	97
PID 3920 wrote to memory of 488	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	100
PID 3920 wrote to memory of 488	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	100
PID 4220 wrote to memory of 4556	4220	cmd.exe	99
PID 4220 wrote to memory of 4556	4220	cmd.exe	99
PID 488 wrote to memory of 3836	488	cmd.exe	105
PID 488 wrote to memory of 3836	488	cmd.exe	105
PID 4796 wrote to memory of 3844	4796	cmd.exe	104
PID 4796 wrote to memory of 3844	4796	cmd.exe	104
PID 740 wrote to memory of 2384	740	cmd.exe	103
PID 740 wrote to memory of 2384	740	cmd.exe	103
PID 3452 wrote to memory of 5072	3452	cmd.exe	102
PID 3452 wrote to memory of 5072	3452	cmd.exe	102
PID 3920 wrote to memory of 1796	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	107
PID 3920 wrote to memory of 1796	3920	a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe	107

C:\Users\Admin\AppData\Local\Temp\a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe
"C:\Users\Admin\AppData\Local\Temp\a45cebb05b221e05c88f56f1caebd3fd606acf63372e3dbf78f393b820a36d16.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
    3⤵
    - Modifies registry class
    PID:4556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
    3⤵
    - Modifies registry class
    PID:5072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
    3⤵
    - Modifies registry class
    PID:2384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
    3⤵
    - Modifies registry class
    PID:3844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
    3⤵
    - Adds Run key to start application
    PID:3836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  PID:1796