Overview

overview

10

Static

static

7987a02005...2f.exe

windows7_x64

10

7987a02005...2f.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7987a020052048ad0ec8855c08df2f47c89922f.exe
  • Size 4.0MB
  • Sample220217-mdnnascagn
  • SHA256 eba2f0afd491ee595cd6908494e9e2a2115ed71c053c6d7b94970f1985830ada
  • MD5 SHA1 SHA512
Score
10/10
hiveevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\C3QW_HOW_TO_DECRYPT.txt

  • hive

Ransom Note
  • Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: 5h75oWVkgnm1 Password: Q42jbQXhTPrpn4ZgwL65 To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.qmam4 files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

  • http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

    • Target
      7987a020052048ad0ec8855c08df2f47c89922f.exe
    • Size 4.0MB
    • SHA256 eba2f0afd491ee595cd6908494e9e2a2115ed71c053c6d7b94970f1985830ada
    • MD5 SHA1 SHA512
    Score
    10/10
    hiveevasionransomwarespywarestealertrojan

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks