hive | 83ffbe63dd41a1a9d2d68fb1b72f6dffcf8e76ecefb8683ee47f6651f58b20a1

General

Target

windows_x64_encrypt.exe
Size

661KB
MD5

d2fab5d65d761b5efd229f0695e67011
SHA1

5480999819b359ed4f1ec284e74f8a33aa127915
SHA256

83ffbe63dd41a1a9d2d68fb1b72f6dffcf8e76ecefb8683ee47f6651f58b20a1
SHA512

dddd949221c9f1d5b425aaf4a026cec41205f78128e6b2a7aa94203c882903da87e4f5b052f36e5f9f4f91105554f86c0cf36d838c77948f438fbfda57934b3a

Score

10^/10

hive ransomware spyware stealer

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: test Password: test To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SendGroup.crw.LVxrXDxy_17zlmuHVYhp	windows_x64_encrypt.exe
File renamed	C:\Users\Admin\Pictures\AddConvertTo.tiff => C:\Users\Admin\Pictures\AddConvertTo.tiff.LVxrXDxy_1TutkBALR3e	windows_x64_encrypt.exe
File opened for modification	C:\Users\Admin\Pictures\AddConvertTo.tiff.LVxrXDxy_1TutkBALR3e	windows_x64_encrypt.exe
File renamed	C:\Users\Admin\Pictures\ResizeUse.crw => C:\Users\Admin\Pictures\ResizeUse.crw.LVxrXDxy_3bbvmRk1b15	windows_x64_encrypt.exe
File opened for modification	C:\Users\Admin\Pictures\ResizeUse.crw.LVxrXDxy_3bbvmRk1b15	windows_x64_encrypt.exe
File renamed	C:\Users\Admin\Pictures\SaveLimit.tif => C:\Users\Admin\Pictures\SaveLimit.tif.LVxrXDxy_0_7lmskzGue	windows_x64_encrypt.exe
File opened for modification	C:\Users\Admin\Pictures\SaveLimit.tif.LVxrXDxy_0_7lmskzGue	windows_x64_encrypt.exe
File renamed	C:\Users\Admin\Pictures\SendGroup.crw => C:\Users\Admin\Pictures\SendGroup.crw.LVxrXDxy_17zlmuHVYhp	windows_x64_encrypt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	windows_x64_encrypt.exe
File opened (read-only)	\??\Z:	windows_x64_encrypt.exe
File opened (read-only)	\??\H:	windows_x64_encrypt.exe
File opened (read-only)	\??\J:	windows_x64_encrypt.exe
File opened (read-only)	\??\M:	windows_x64_encrypt.exe
File opened (read-only)	\??\N:	windows_x64_encrypt.exe
File opened (read-only)	\??\R:	windows_x64_encrypt.exe
File opened (read-only)	\??\U:	windows_x64_encrypt.exe
File opened (read-only)	\??\E:	windows_x64_encrypt.exe
File opened (read-only)	\??\L:	windows_x64_encrypt.exe
File opened (read-only)	\??\O:	windows_x64_encrypt.exe
File opened (read-only)	\??\Q:	windows_x64_encrypt.exe
File opened (read-only)	\??\T:	windows_x64_encrypt.exe
File opened (read-only)	\??\V:	windows_x64_encrypt.exe
File opened (read-only)	\??\Y:	windows_x64_encrypt.exe
File opened (read-only)	\??\A:	windows_x64_encrypt.exe
File opened (read-only)	\??\B:	windows_x64_encrypt.exe
File opened (read-only)	\??\F:	windows_x64_encrypt.exe
File opened (read-only)	\??\G:	windows_x64_encrypt.exe
File opened (read-only)	\??\I:	windows_x64_encrypt.exe
File opened (read-only)	\??\K:	windows_x64_encrypt.exe
File opened (read-only)	\??\P:	windows_x64_encrypt.exe
File opened (read-only)	\??\S:	windows_x64_encrypt.exe
File opened (read-only)	\??\W:	windows_x64_encrypt.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8344	1732	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1732	windows_x64_encrypt.exe
1732	windows_x64_encrypt.exe
1732	windows_x64_encrypt.exe
1732	windows_x64_encrypt.exe
1732	windows_x64_encrypt.exe
1732	windows_x64_encrypt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	windows_x64_encrypt.exe

C:\Users\Admin\AppData\Local\Temp\windows_x64_encrypt.exe
C:\Users\Admin\AppData\Local\Temp\windows_x64_encrypt.exe -u test:test
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 744
  2⤵
  - Program crash
  PID:8344