Overview

overview

10

Static

static

20a2250d93...42.exe

windows7_x64

10

20a2250d93...42.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20a2250d93226c25246b32f6dabbe7a876c60843e487c8e7aed76dd0aba23042

  • Size

    3.3MB

  • Sample

    211122-m5tnmaacg3

  • MD5

    0ab044581b75da84b0e929590638095e

  • SHA1

    1e907df240eadb3d27d145d50da9025d524728fd

  • SHA256

    20a2250d93226c25246b32f6dabbe7a876c60843e487c8e7aed76dd0aba23042

  • SHA512

    168120b07437e3e6664128f0e23f6792b714d3ffa41131f7027099c0a5bd2dc0b538dd53fedb4cfadbcb9ea07ebae75c67b0e8bd2c6054aa991a3bdf8e42dbb7

Score
10/10
hiveevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\7-Zip\etrU_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: hyYeLBF36G1U Password: sx77BJWt3JYh7xCtfZ2w To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.mhkwl files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

    • Target

      20a2250d93226c25246b32f6dabbe7a876c60843e487c8e7aed76dd0aba23042

    • Size

      3.3MB

    • MD5

      0ab044581b75da84b0e929590638095e

    • SHA1

      1e907df240eadb3d27d145d50da9025d524728fd

    • SHA256

      20a2250d93226c25246b32f6dabbe7a876c60843e487c8e7aed76dd0aba23042

    • SHA512

      168120b07437e3e6664128f0e23f6792b714d3ffa41131f7027099c0a5bd2dc0b538dd53fedb4cfadbcb9ea07ebae75c67b0e8bd2c6054aa991a3bdf8e42dbb7

    Score
    10/10
    hiveevasionransomwarespywarestealertrojan

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

2
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Indicator Removal on Host

1
T1070

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3
T1490

Tasks