hive | aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153

Analysis

max time kernel
129s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
14-04-2022 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153.exe
Size

1.8MB
MD5

0c18bc83e838deec24af20d139b411d7
SHA1

00e5e0e05a18bd01498f247145ae591a654e07f4
SHA256

aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153
SHA512

1d12ac5b2d4917c77964ad9464a334d9340d708e15c1a0ef467b95e1766ed96a9d5927e529d690c580917d6b776c9d9fedcce772f667188645d714b8445a25c7

Score

10^/10

hive ransomware spyware stealer

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: abc Password: abc To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

Detects Rust x86 variant of Hive Ransomware 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000021e41-125.dat	hive_rust_x86
behavioral2/files/0x0007000000021e41-126.dat	hive_rust_x86

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 1 IoCs

pid	Process
3440	abc.2041320234.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	abc.2041320234.exe
File opened (read-only)	\??\G:	abc.2041320234.exe
File opened (read-only)	\??\M:	abc.2041320234.exe
File opened (read-only)	\??\B:	abc.2041320234.exe
File opened (read-only)	\??\H:	abc.2041320234.exe
File opened (read-only)	\??\L:	abc.2041320234.exe
File opened (read-only)	\??\P:	abc.2041320234.exe
File opened (read-only)	\??\S:	abc.2041320234.exe
File opened (read-only)	\??\T:	abc.2041320234.exe
File opened (read-only)	\??\W:	abc.2041320234.exe
File opened (read-only)	\??\X:	abc.2041320234.exe
File opened (read-only)	\??\A:	abc.2041320234.exe
File opened (read-only)	\??\I:	abc.2041320234.exe
File opened (read-only)	\??\J:	abc.2041320234.exe
File opened (read-only)	\??\Q:	abc.2041320234.exe
File opened (read-only)	\??\R:	abc.2041320234.exe
File opened (read-only)	\??\U:	abc.2041320234.exe
File opened (read-only)	\??\V:	abc.2041320234.exe
File opened (read-only)	\??\Z:	abc.2041320234.exe
File opened (read-only)	\??\F:	abc.2041320234.exe
File opened (read-only)	\??\K:	abc.2041320234.exe
File opened (read-only)	\??\N:	abc.2041320234.exe
File opened (read-only)	\??\O:	abc.2041320234.exe
File opened (read-only)	\??\Y:	abc.2041320234.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
8628	notepad.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3440	abc.2041320234.exe
3440	abc.2041320234.exe
3440	abc.2041320234.exe
3440	abc.2041320234.exe
3440	abc.2041320234.exe
3440	abc.2041320234.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	abc.2041320234.exe
Token: SeIncreaseQuotaPrivilege	8656	wmic.exe
Token: SeSecurityPrivilege	8656	wmic.exe
Token: SeTakeOwnershipPrivilege	8656	wmic.exe
Token: SeLoadDriverPrivilege	8656	wmic.exe
Token: SeSystemProfilePrivilege	8656	wmic.exe
Token: SeSystemtimePrivilege	8656	wmic.exe
Token: SeProfSingleProcessPrivilege	8656	wmic.exe
Token: SeIncBasePriorityPrivilege	8656	wmic.exe
Token: SeCreatePagefilePrivilege	8656	wmic.exe
Token: SeBackupPrivilege	8656	wmic.exe
Token: SeRestorePrivilege	8656	wmic.exe
Token: SeShutdownPrivilege	8656	wmic.exe
Token: SeDebugPrivilege	8656	wmic.exe
Token: SeSystemEnvironmentPrivilege	8656	wmic.exe
Token: SeRemoteShutdownPrivilege	8656	wmic.exe
Token: SeUndockPrivilege	8656	wmic.exe
Token: SeManageVolumePrivilege	8656	wmic.exe
Token: 33	8656	wmic.exe
Token: 34	8656	wmic.exe
Token: 35	8656	wmic.exe
Token: 36	8656	wmic.exe
Token: SeIncreaseQuotaPrivilege	8656	wmic.exe
Token: SeSecurityPrivilege	8656	wmic.exe
Token: SeTakeOwnershipPrivilege	8656	wmic.exe
Token: SeLoadDriverPrivilege	8656	wmic.exe
Token: SeSystemProfilePrivilege	8656	wmic.exe
Token: SeSystemtimePrivilege	8656	wmic.exe
Token: SeProfSingleProcessPrivilege	8656	wmic.exe
Token: SeIncBasePriorityPrivilege	8656	wmic.exe
Token: SeCreatePagefilePrivilege	8656	wmic.exe
Token: SeBackupPrivilege	8656	wmic.exe
Token: SeRestorePrivilege	8656	wmic.exe
Token: SeShutdownPrivilege	8656	wmic.exe
Token: SeDebugPrivilege	8656	wmic.exe
Token: SeSystemEnvironmentPrivilege	8656	wmic.exe
Token: SeRemoteShutdownPrivilege	8656	wmic.exe
Token: SeUndockPrivilege	8656	wmic.exe
Token: SeManageVolumePrivilege	8656	wmic.exe
Token: 33	8656	wmic.exe
Token: 34	8656	wmic.exe
Token: 35	8656	wmic.exe
Token: 36	8656	wmic.exe
Token: SeBackupPrivilege	4944	vssvc.exe
Token: SeRestorePrivilege	4944	vssvc.exe
Token: SeAuditPrivilege	4944	vssvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3440	3164	aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153.exe	82
PID 3164 wrote to memory of 3440	3164	aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153.exe	82
PID 3164 wrote to memory of 3440	3164	aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153.exe	82
PID 3440 wrote to memory of 8628	3440	abc.2041320234.exe	83
PID 3440 wrote to memory of 8628	3440	abc.2041320234.exe	83
PID 3440 wrote to memory of 8628	3440	abc.2041320234.exe	83
PID 3440 wrote to memory of 8656	3440	abc.2041320234.exe	84
PID 3440 wrote to memory of 8656	3440	abc.2041320234.exe	84
PID 3440 wrote to memory of 8656	3440	abc.2041320234.exe	84

C:\Users\Admin\AppData\Local\Temp\aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153.exe
"C:\Users\Admin\AppData\Local\Temp\aa78798172e873d88f42bf8bb5853aecfb74a3bf8980540f6be66f800bf1f153.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\abc.2041320234.exe
  C:\Users\Admin\AppData\Local\Temp\abc.2041320234.exe -u abc:abc
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\HOW_TO_DECRYPT.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:8628
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    "C:\Windows\System32\Wbem\wmic.exe" shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
0214bcaca4b3d3ef139ea5bd3045f52a

SHA1
201d5dc7bf0fd927807c36da52977d21ec0fce58

SHA256
68e36460c5deff70f47732af87120db943c048ae7bcbaade336a84950d7d831a

SHA512
4a033de9b1d5fed4d8579f648d953cd5a968efc14ed52ab3f74d407e3a3efc03b04986255f0dd34d87860001c245bda7437b9a27de289e7edd7e82d260dd049f

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc.2041320234.exe

Filesize
416KB

MD5
23f82ce9f5f8e02614b31cc0810e0d5f

SHA1
0bbde5e6b3aefc33014ec3c1f1e61d8664a33a75

SHA256
206de75058a7dfa0b96784965baab63a137f2e89a97e623842e7d0bb3f12c2fc

SHA512
1231dc5046cb609b5cf2240a95cb728842048609a93d3034984948f9fe99ed54c508e154f3f7516f9b15a8244ec49574dc6d6ad4a95daa8ed6bcf8e4fbf4f52d

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc.2041320234.exe

Filesize
416KB

MD5
23f82ce9f5f8e02614b31cc0810e0d5f

SHA1
0bbde5e6b3aefc33014ec3c1f1e61d8664a33a75

SHA256
206de75058a7dfa0b96784965baab63a137f2e89a97e623842e7d0bb3f12c2fc

SHA512
1231dc5046cb609b5cf2240a95cb728842048609a93d3034984948f9fe99ed54c508e154f3f7516f9b15a8244ec49574dc6d6ad4a95daa8ed6bcf8e4fbf4f52d

Download Submit