hive | f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa

General

Target

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
Size

727KB
MD5

f293ec38bb674e4f56239c2942ae9f01
SHA1

78d708e2d1586cc229d1c277173eb00c0fe27c96
SHA256

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa
SHA512

09773fcf5a5c97d8494078ae9c443859bbafeb9e8fc92a2211525e59a5cd439cf6b4babaaf958e613e7c9fe2bd7347574bc538b5ef5e8d55c6e7ab9c26d1d035
SSDEEP

12288:XoUopVzNYSwOEWtA2OrSxcXB3Q4abIom+2+3NrMv/xjGj9YNCC+NQoEf6Y7kSCd6:XoUopV8ABbhEf4GSwi88yxtK34Y

Score

10^/10

hive evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EuWBdGraQgag Password: sRajKy5i2Zbt6piiSpNc To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2204 bcdedit.exe
2256 bcdedit.exe
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

9196 wbadmin.exe
8552 wbadmin.exe

pid	process
2204	bcdedit.exe
2256	bcdedit.exe

pid	process
9196	wbadmin.exe
8552	wbadmin.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConvertRedo.tif => C:\Users\Admin\Pictures\ConvertRedo.tif.gFhgvpgk_9OPhEPhhLD4	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File renamed	C:\Users\Admin\Pictures\WriteOut.tif => C:\Users\Admin\Pictures\WriteOut.tif.3Ng5Abtc_6YYGJFSnyBc	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened for modification	C:\Users\Admin\Pictures\WriteOut.tif.3Ng5Abtc_6YYGJFSnyBc	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File renamed	C:\Users\Admin\Pictures\ReadSkip.crw => C:\Users\Admin\Pictures\ReadSkip.crw.3Ng5Abtc_wAEVWu8Lrk9	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened for modification	C:\Users\Admin\Pictures\ReadSkip.crw.3Ng5Abtc_wAEVWu8Lrk9	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertRedo.tif.gFhgvpgk_9OPhEPhhLD4	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File renamed	C:\Users\Admin\Pictures\LimitGrant.raw => C:\Users\Admin\Pictures\LimitGrant.raw.gFhgvpgk_174PhVIimKK	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened for modification	C:\Users\Admin\Pictures\LimitGrant.raw.gFhgvpgk_174PhVIimKK	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

description	ioc	process
File opened (read-only)	\??\M:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\N:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\E:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\J:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\H:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\I:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\O:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\Q:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\R:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\S:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\B:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\G:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\X:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\Y:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\Z:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\U:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\W:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\L:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\T:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\V:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\A:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\K:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\F:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
File opened (read-only)	\??\P:	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

8752 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

8696 notepad.exe

pid	process
8752	vssadmin.exe

pid	process
8696	notepad.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

pid	process
3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
Token: SeIncreaseQuotaPrivilege	8808	WMIC.exe
Token: SeSecurityPrivilege	8808	WMIC.exe
Token: SeTakeOwnershipPrivilege	8808	WMIC.exe
Token: SeLoadDriverPrivilege	8808	WMIC.exe
Token: SeSystemProfilePrivilege	8808	WMIC.exe
Token: SeSystemtimePrivilege	8808	WMIC.exe
Token: SeProfSingleProcessPrivilege	8808	WMIC.exe
Token: SeIncBasePriorityPrivilege	8808	WMIC.exe
Token: SeCreatePagefilePrivilege	8808	WMIC.exe
Token: SeBackupPrivilege	8808	WMIC.exe
Token: SeRestorePrivilege	8808	WMIC.exe
Token: SeShutdownPrivilege	8808	WMIC.exe
Token: SeDebugPrivilege	8808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	8808	WMIC.exe
Token: SeRemoteShutdownPrivilege	8808	WMIC.exe
Token: SeUndockPrivilege	8808	WMIC.exe
Token: SeManageVolumePrivilege	8808	WMIC.exe
Token: 33	8808	WMIC.exe
Token: 34	8808	WMIC.exe
Token: 35	8808	WMIC.exe
Token: 36	8808	WMIC.exe
Token: SeIncreaseQuotaPrivilege	8808	WMIC.exe
Token: SeSecurityPrivilege	8808	WMIC.exe
Token: SeTakeOwnershipPrivilege	8808	WMIC.exe
Token: SeLoadDriverPrivilege	8808	WMIC.exe
Token: SeSystemProfilePrivilege	8808	WMIC.exe
Token: SeSystemtimePrivilege	8808	WMIC.exe
Token: SeProfSingleProcessPrivilege	8808	WMIC.exe
Token: SeIncBasePriorityPrivilege	8808	WMIC.exe
Token: SeCreatePagefilePrivilege	8808	WMIC.exe
Token: SeBackupPrivilege	8808	WMIC.exe
Token: SeRestorePrivilege	8808	WMIC.exe
Token: SeShutdownPrivilege	8808	WMIC.exe
Token: SeDebugPrivilege	8808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	8808	WMIC.exe
Token: SeRemoteShutdownPrivilege	8808	WMIC.exe
Token: SeUndockPrivilege	8808	WMIC.exe
Token: SeManageVolumePrivilege	8808	WMIC.exe
Token: 33	8808	WMIC.exe
Token: 34	8808	WMIC.exe
Token: 35	8808	WMIC.exe
Token: 36	8808	WMIC.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe

description	pid	process	target process
PID 3532 wrote to memory of 8696	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	notepad.exe
PID 3532 wrote to memory of 8696	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	notepad.exe
PID 3532 wrote to memory of 8752	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	vssadmin.exe
PID 3532 wrote to memory of 8752	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	vssadmin.exe
PID 3532 wrote to memory of 8808	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	WMIC.exe
PID 3532 wrote to memory of 8808	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	WMIC.exe
PID 3532 wrote to memory of 9196	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	wbadmin.exe
PID 3532 wrote to memory of 9196	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	wbadmin.exe
PID 3532 wrote to memory of 4368	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	wbadmin.exe
PID 3532 wrote to memory of 4368	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	wbadmin.exe
PID 3532 wrote to memory of 2204	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	bcdedit.exe
PID 3532 wrote to memory of 2204	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	bcdedit.exe
PID 3532 wrote to memory of 2256	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	bcdedit.exe
PID 3532 wrote to memory of 2256	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	bcdedit.exe
PID 3532 wrote to memory of 8552	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	wbadmin.exe
PID 3532 wrote to memory of 8552	3532	f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe	wbadmin.exe

C:\Users\Admin\AppData\Local\Temp\f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
C:\Users\Admin\AppData\Local\Temp\f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe -u EuWBdGraQgag:sRajKy5i2Zbt6piiSpNc
1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\HOW_TO_DECRYPT.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:8696
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:8752
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:8808
- C:\Windows\System32\wbadmin.exe
  "C:\Windows\System32\wbadmin.exe" delete systemstatebackup
  2⤵
  - Deletes System State backups
  PID:9196
- C:\Windows\System32\wbadmin.exe
  "C:\Windows\System32\wbadmin.exe" delete catalog-quiet
  2⤵
  PID:4368
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2204
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2256
- C:\Windows\System32\wbadmin.exe
  "C:\Windows\System32\wbadmin.exe" delete systemstatebackup -keepVersions:3
  2⤵
  - Deletes System State backups
  PID:8552