Overview

overview

10

Static

static

8

5954558d43...e5.exe

windows7_x64

10

5954558d43...e5.exe

windows10_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    23s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    30/08/2021, 08:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5.exe

  • Size

    764KB

  • MD5

    e3798c3bea835b99e994956acf3b942c

  • SHA1

    ca247833b60a6043c6361e5772e1e6acf848de5d

  • SHA256

    5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5

  • SHA512

    be4cf342680d5f7ca50ce9228ad75f6deb2e14958395b2f0f754e90f1be8af6bae79753b74263eacf85df77680900a2245135dc15a093142be612c3d255b09f5

Score
10/10
hiveransomwarespywarestealer

Malware Config

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5.exe
    "C:\Users\Admin\AppData\Local\Temp\5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c hive.bat >NUL 2>NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1696
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:852
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
          PID:376
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1896
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1924
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:984
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:960
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:948
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1048
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1748
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:832
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1536
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1888
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1252
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:904
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:784
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:680
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1324
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:2008
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1372
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:580
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1496
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
            PID:1648
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1692
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:316
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1584
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:840
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:440
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1800
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1920
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1316
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:376
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1896
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1808
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1972
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1600
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
              PID:1296
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:1052
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
                PID:1528
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                  PID:1652
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1500
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:268
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1968
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1412
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1148
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:2004
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:2000
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1632
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:884
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                    PID:372
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:276
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:972
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                      PID:1696
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                        PID:1012
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • Delays execution with timeout.exe
                        PID:1568
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                          PID:852
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:1688
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:376
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:532
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                            PID:1968
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                              PID:924
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                                PID:1148
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:1324
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:1480
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:580
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:2000
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                  PID:556
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:1648
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:884
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:372
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:316
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:1240
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:972
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:840
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:1564
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:1012
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:1800
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:336
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:852
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c shadow.bat >NUL 2>NUL
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1508
                                    • C:\Windows\SysWOW64\vssadmin.exe
                                      vssadmin.exe delete shadows /all /quiet
                                      3⤵
                                      • Interacts with shadow copies
                                      PID:752
                                • C:\Windows\system32\vssvc.exe
                                  C:\Windows\system32\vssvc.exe
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:600

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads