Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,C:\BlackSuitBoot\svc.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,C:\BlackSuitBoot\svc.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsdefendersvc
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\BlackSuit] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\BlackSuit] 'ImagePath' = '"C:\BlackSuitBoot\svc.exe"'
Creates the following services
- 'BlackSuit' C:\BlackSuitBoot\svc.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Recovery Environment (WinRE)
Modifies file system
Creates the following files
- C:\blacksuitboot\svc.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\svc.exe
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\ose.exe.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\osetup.dll.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pidgenx.dll.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.blacksuit
- C:\blacksuitboot\bg.mp4
- C:\blacksuitboot\video.log
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.dll.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.exe.blacksuit
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.blacksuit
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.blacksuit
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.blacksuit
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.blacksuit
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.blacksuit
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab.blacksuit
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.blacksuit
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.blacksuit
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publr.cab.blacksuit
- C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.blacksuit
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.msi.blacksuit
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.blacksuit
- C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.blacksuit
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.blacksuit
- C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.msi.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.cab.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.blacksuit
- C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\inflr.cab.blacksuit
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.msi.blacksuit
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.blacksuit
- C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.cab.blacksuit
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.msi.blacksuit
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml.blacksuit
- C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.msi.blacksuit
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.blacksuit
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab.blacksuit
- C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovelr.cab.blacksuit
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.msi.blacksuit
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.blacksuit
- C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.cab.blacksuit
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.msi.blacksuit
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.xml.blacksuit
- C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.cab.blacksuit
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.msi.blacksuit
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.xml.blacksuit
- C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\branding.xml.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officelr.cab.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.msi.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.msi.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\offsetlr.cab.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\osetupui.dll.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.chm.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\shellui.mst.blacksuit
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.msi.blacksuit
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.xml.blacksuit
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.msi.blacksuit
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.xml.blacksuit
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\owow64lr.cab.blacksuit
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.msi.blacksuit
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.blacksuit
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\acclr.cab.blacksuit
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.blacksuit
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.msi.blacksuit
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.blacksuit
- C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.cab.blacksuit
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.msi.blacksuit
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.xml.blacksuit
- C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\setup.xml.blacksuit
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.blacksuit
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020060.msp.blacksuit
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.blacksuit
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.blacksuit
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.blacksuit
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.blacksuit
- %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.blacksuit
- %ALLUSERSPROFILE%\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caaa8cff_8cf7b530-613e-439b-a8c5-ccfc0e745400.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\telemetry.asm-windowsdefault.json.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.allow.json.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.app.json.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.privacy.json.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.tracing.json.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\eventstore.db.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\parse.dat.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\eventstore.db.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\eventstore.db.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_45_22.etl.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_5_7.etl.blacksuit
- %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_6_21.etl.blacksuit
- %ALLUSERSPROFILE%\microsoft\identitycrl\int\wlidsvcconfig.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\identitycrl\production\wlidsvcconfig.xml.blacksuit
- %ALLUSERSPROFILE%\microsoft\mf\active.grl.blacksuit
- %ALLUSERSPROFILE%\microsoft\mf\pending.grl.blacksuit
- %ALLUSERSPROFILE%\microsoft\network\downloader\edb.chk.blacksuit
- %ALLUSERSPROFILE%\microsoft\network\downloader\edb.log.blacksuit
- %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00001.jrs.blacksuit
- %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00002.jrs.blacksuit
- %ALLUSERSPROFILE%\microsoft\network\downloader\edbtmp.log.blacksuit
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.db.blacksuit
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.jfm.blacksuit
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edb.jcp.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edb.jtx.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edb00004.jtx.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edb00005.jtx.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edbres00001.jrs.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edbres00002.jrs.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edbtmp.jtx.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.crwl.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.gthr.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.000.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.002.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.002.blacksuit
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.jfm.blacksuit
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.chk.blacksuit
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.log.blacksuit
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb00002.log.blacksuit
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00001.jrs.blacksuit
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00002.jrs.blacksuit
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbtmp.log.blacksuit
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.jfm.blacksuit
- %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.blacksuit
- %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate.xsd.blacksuit
- %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013.xsd.blacksuit
- %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013a.xsd.blacksuit
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.blacksuit
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.blacksuit
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.blacksuit
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol.blacksuit
Sets the 'hidden' attribute to the following files
- C:\blacksuitboot\svc.exe
Deletes the following system files
- C:\recovery\windowsre\reagent.xml
- C:\recovery\windowsre\winre.wim
Deletes following files that it created itself
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\svc.exe
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '<SYSTEM32>\attrib.exe' +h +s C:\BlackSuitBoot\svc.exe
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d <SYSTEM32>\userinit.exe,C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d explorer.exe,C:\BlackSuitBoot\svc.exe /f
- '<SYSTEM32>\sc.exe' create BlackSuit binPath= \"C:\BlackSuitBoot\svc.exe\" start= auto obj= LocalSystem
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BlackSuit /t REG_SZ /d Service /f
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BlackSuit /t REG_SZ /d Service /f
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsDefenderSvc /tr C:\BlackSuitBoot\svc.exe /sc onlogon /rl highest /f
- '<SYSTEM32>\wbem\wmic.exe' bios get serialnumber
