hive | 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

Analysis

max time kernel
129s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-12-2022 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hive.exe
Size

764KB
MD5

2f9fc82898d718f2abe99c4a6fa79e69
SHA1

9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA256

88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA512

19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
SSDEEP

12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score

10^/10

hive ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

Detects Go variant of Hive Ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1372-54-0x0000000000A20000-0x0000000000C83000-memory.dmp	hive_go
behavioral1/memory/1372-62-0x0000000000A20000-0x0000000000C83000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops file in Drivers directory 28 IoCs

Processes:

hive.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

hive.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\CompareCopy.tiff	hive.exe
File opened for modification	C:\Users\Admin\Pictures\OpenAssert.tiff	hive.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1372-54-0x0000000000A20000-0x0000000000C83000-memory.dmp	upx
behavioral1/memory/1372-62-0x0000000000A20000-0x0000000000C83000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

hive.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 64 IoCs

Processes:

hive.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RUC7JGOV\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\INLM2B61\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QAI10AFD\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	hive.exe
File opened for modification	C:\Program Files\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NWV1K27G\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	hive.exe

Drops file in System32 directory 64 IoCs

Processes:

hive.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\prnle002.inf_amd64_neutral_c7564163ba063094\Amd64\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-RasApi\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdsata.inf_amd64_neutral_67db50590108ebd9\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_neutral_99bb33c9a5bedaea\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Enterprise\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Ultimate\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr005.inf_amd64_neutral_d140721f97061bba\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\fr\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\slmgr\040C\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmatm2k.inf_amd64_neutral_64a8fb018ead55a7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc303.inf_amd64_ja-jp_b0dcc6693f67451a\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-shmig-DL\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\winrm\0410\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\UltimateE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_neutral_10ce25bbc5a9cc43\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0009\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_neutral_269d7150439b3372\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\Ultimate\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rawsilo.inf_amd64_neutral_8eb7e6403ddbb7a8\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\LogFiles\Firewall\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\data\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremium\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\angel64.inf_amd64_neutral_6bed16c93db1ccf3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\winrm\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx009.inf_amd64_neutral_d4b76afd08f308fb\Amd64\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_neutral_c4fe81ea47c6df87\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_neutral_8b26ad5d0cc037a9\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMETC10\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2hbh826d_noaverir_x64.inf_amd64_neutral_da2ba9e8a30dad14\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmelsa.inf_amd64_neutral_374f9d31af832d6b\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\FxsTmp\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhandy.inf_amd64_neutral_386661b46df6da3f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_neutral_14cb440c800fe9fe\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_neutral_439e7d1dcac00aca\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\XPSViewer\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnok302.inf_amd64_ja-jp_708c81a8b0ad8846\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\DriverStore\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_neutral_7e4d690d07ee94c1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_neutral_8887242a56ee027e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnfx002.inf_amd64_neutral_b6dd354531184f64\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremium\HOW_TO_DECRYPT.txt	hive.exe

Drops file in Program Files directory 64 IoCs

Processes:

hive.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICTPH.POC	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF.nVPzYTyMWJeN16yBoXZa5Z0cKyqzMfM3anKhk_00Tjg.hive	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107482.WMF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0336075.WMF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OARTCONV.DLL	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCINFO.XML	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR31F.GIF.nVPzYTyMWJeN16yBoXZa5a9APnZssrVcZhk-1i2zqGc.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg.nVPzYTyMWJeN16yBoXZa5XRBec9axeNV3otuCCjRdHw.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msdaremr.dll.mui	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14581_.GIF	hive.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.nVPzYTyMWJeN16yBoXZa5ULIqFEeD15AokpyMlyz1zI.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar	hive.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBWZINT.DLL	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOCS.ICO	hive.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\PROCDB.XLAM	hive.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll.nVPzYTyMWJeN16yBoXZa5TtD939eqXwiXnX1dATRKEk.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR.HXS.nVPzYTyMWJeN16yBoXZa5UKdpzs2OJdjTJ5nFv1y3UQ.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.nVPzYTyMWJeN16yBoXZa5T9WrU5H9wUI7E8e3plyFzw.hive	hive.exe
File opened for modification	C:\Program Files\Java\jre7\bin\eula.dll.nVPzYTyMWJeN16yBoXZa5a-kKi2jINplQnJ8riTrFW0.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\BUTTON.GIF	hive.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.nVPzYTyMWJeN16yBoXZa5QnMQ0YKQD8zEjDWUZb7PXk.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Trek.eftx	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASK.CFG	hive.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jsound.dll.nVPzYTyMWJeN16yBoXZa5eAqxgZtk9oChcX7Ypb6Q3w.hive	hive.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml.nVPzYTyMWJeN16yBoXZa5eHkXWAJIvchsv3jFuk0BB4.hive	hive.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.dll	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.nVPzYTyMWJeN16yBoXZa5ZA1rNlXGAYfhjTHzzlvaFw.hive	hive.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Priority.accft	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft.nVPzYTyMWJeN16yBoXZa5Wu1htnPz7NYYbSZcEsR1xA.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.nVPzYTyMWJeN16yBoXZa5aVMV1AEGigJia_Pwp4l1hQ.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar.nVPzYTyMWJeN16yBoXZa5Y1u-XWjkq0K0vJUTtOM2lk.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECURS.ICO	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.nVPzYTyMWJeN16yBoXZa5WB9Tg_BrPMG4WPUuTqVDlw.hive	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.nVPzYTyMWJeN16yBoXZa5Z-VlMPSIH485hLfj3LRISM.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00095_.WMF.nVPzYTyMWJeN16yBoXZa5cOwsQ1SbvZEP2qicWNvUBE.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.nVPzYTyMWJeN16yBoXZa5aSweMdp2Nl5767Qi53elis.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.XML	hive.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.nVPzYTyMWJeN16yBoXZa5fzs84Ij2WUeoDUMixeRGUE.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10264_.GIF.nVPzYTyMWJeN16yBoXZa5ZjSz_L1Mtta4KwqTIuxa1A.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.XML.nVPzYTyMWJeN16yBoXZa5TE59gZ0ZuwBL_u31MN7GSQ.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll	hive.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.nVPzYTyMWJeN16yBoXZa5QY1gTkqceUD_AMHh5jFVUo.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01154_.WMF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXSEC32.DLL.nVPzYTyMWJeN16yBoXZa5a-OjY3rDcA0mEUHuMAw6HE.hive	hive.exe

Drops file in Windows directory 64 IoCs

Processes:

hive.exe

description	ioc	process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml.Linq\164d9beb2bf9b6160593f915a2d9aa6d\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data86569bbf#\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_fr_b77a5c561934e089\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Printing\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design.resources\3.5.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Speech\Common\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0407\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000C\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Media\Savanna\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Drawing.resources\2.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.resources\3.0.0.0_de_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\v4.0_4.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio84a6349c#\9a939c85c518e958f158f5d5d75af50e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\cb8c46fb93cee393acd4db95f6d8bfa2\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\system.management.resources\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\diagnostics\system\HomeGroup\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Core\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationClientsideProviders.resources\3.0.0.0_es_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Transacti#\a04be0cabc675da23c6cdd970b50e3c5\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Encoding.Extensions\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\system.runtime.serialization.resources\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Workca489553#\361ef62867b1804328cf3616dc8a7f7b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Globalization\MCT\MCT-GB\RSSFeed\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Speech\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\inf\ASP.NET_4.0.30319\0001\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\PLA\Reports\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\ehiActivScp\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\ehome\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Boot\PCAT\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\inf\wsearchidxpi\0407\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Con#\8d64f031cf429f4ce79642e8be267d2d\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\140714964f3afbcea38cb33d548c5d3c\HOW_TO_DECRYPT.txt	hive.exe

Delays execution with timeout.exe 58 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
544	timeout.exe
1444	timeout.exe
860	timeout.exe
1568	timeout.exe
2040	timeout.exe
740	timeout.exe
1876	timeout.exe
1084	timeout.exe
1380	timeout.exe
1900	timeout.exe
1792	timeout.exe
1296	timeout.exe
680	timeout.exe
2008	timeout.exe
1956	timeout.exe
696	timeout.exe
1916	timeout.exe
1264	timeout.exe
1908	timeout.exe
856	timeout.exe
1688	timeout.exe
460	timeout.exe
1540	timeout.exe
1604	timeout.exe
1168	timeout.exe
1872	timeout.exe
664	timeout.exe
1460	timeout.exe
1064	timeout.exe
1104	timeout.exe
884	timeout.exe
1700	timeout.exe
1916	timeout.exe
1264	timeout.exe
268	timeout.exe
576	timeout.exe
1448	timeout.exe
1444	timeout.exe
1524	timeout.exe
1588	timeout.exe
2008	timeout.exe
1192	timeout.exe
1672	timeout.exe
624	timeout.exe
268	timeout.exe
776	timeout.exe
1792	timeout.exe
1192	timeout.exe
1920	timeout.exe
1824	timeout.exe
1876	timeout.exe
1452	timeout.exe
1084	timeout.exe
1104	timeout.exe
2040	timeout.exe
1824	timeout.exe
1440	timeout.exe
1544	timeout.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1972 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1440 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

hive.exe

pid process

1372 hive.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1940 vssvc.exe
Token: SeRestorePrivilege 1940 vssvc.exe
Token: SeAuditPrivilege 1940 vssvc.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NOTEPAD.EXE

pid process

1440 NOTEPAD.EXE

pid	process
1972	vssadmin.exe

pid	process
1440	NOTEPAD.EXE

pid	process
1372	hive.exe

description	pid	process
Token: SeBackupPrivilege	1940	vssvc.exe
Token: SeRestorePrivilege	1940	vssvc.exe
Token: SeAuditPrivilege	1940	vssvc.exe

pid	process
1440	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

hive.execmd.execmd.exe

description	pid	process	target process
PID 1372 wrote to memory of 900	1372	hive.exe	cmd.exe
PID 1372 wrote to memory of 900	1372	hive.exe	cmd.exe
PID 1372 wrote to memory of 900	1372	hive.exe	cmd.exe
PID 1372 wrote to memory of 900	1372	hive.exe	cmd.exe
PID 1372 wrote to memory of 2004	1372	hive.exe	cmd.exe
PID 1372 wrote to memory of 2004	1372	hive.exe	cmd.exe
PID 1372 wrote to memory of 2004	1372	hive.exe	cmd.exe
PID 1372 wrote to memory of 2004	1372	hive.exe	cmd.exe
PID 900 wrote to memory of 1956	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1956	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1956	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1956	900	cmd.exe	timeout.exe
PID 2004 wrote to memory of 1972	2004	cmd.exe	vssadmin.exe
PID 2004 wrote to memory of 1972	2004	cmd.exe	vssadmin.exe
PID 2004 wrote to memory of 1972	2004	cmd.exe	vssadmin.exe
PID 2004 wrote to memory of 1972	2004	cmd.exe	vssadmin.exe
PID 900 wrote to memory of 1440	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1440	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1440	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1440	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 696	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 696	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 696	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 696	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 776	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 776	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 776	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 776	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 856	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 856	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 856	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 856	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 544	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 544	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 544	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 544	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1792	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1792	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1792	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1792	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1192	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1192	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1192	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1192	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 268	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 268	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 268	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 268	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1920	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1920	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1920	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1920	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1688	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1688	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1688	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1688	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1168	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1168	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1168	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 1168	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 460	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 460	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 460	900	cmd.exe	timeout.exe
PID 900 wrote to memory of 460	900	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\hive.exe
"C:\Users\Admin\AppData\Local\Temp\hive.exe"
1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c hive.bat >NUL 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1956
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1440
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:696
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:776
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:856
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1792
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1192
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:268
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1920
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1688
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1168
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:460
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1872
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1444
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1104
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1900
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1916
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1540
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:884
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1452
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:860
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:740
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1084
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1824
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1568
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1448
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1876
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:624
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1792
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1192
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:268
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1908
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1700
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1444
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1104
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1916
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1296
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:680
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1460
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1064
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1604
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1084
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1824
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1588
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1380
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1876
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c shadow.bat >NUL 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW_TO_DECRYPT.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\hive.bat

Filesize
162B

MD5
fca5799115172398c63263fad7e854b1

SHA1
2874a1c796f511f94bed6ae020f4b20c38c59cf1

SHA256
27323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663

SHA512
a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b

Download Submit
C:\Users\Admin\AppData\Local\Temp\shadow.bat

Filesize
57B

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
C:\Users\Admin\Desktop\HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
80207d0f8ea42bdfeaf9f5c586230aca

SHA1
747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

SHA256
25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

SHA512
73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

Download Submit
memory/268-100-0x0000000000000000-mapping.dmp

Download
memory/268-70-0x0000000000000000-mapping.dmp

Download
memory/460-74-0x0000000000000000-mapping.dmp

Download
memory/544-67-0x0000000000000000-mapping.dmp

Download
memory/576-83-0x0000000000000000-mapping.dmp

Download
memory/624-95-0x0000000000000000-mapping.dmp

Download
memory/664-121-0x0000000000000000-mapping.dmp

Download
memory/680-109-0x0000000000000000-mapping.dmp

Download
memory/696-63-0x0000000000000000-mapping.dmp

Download
memory/740-86-0x0000000000000000-mapping.dmp

Download
memory/776-64-0x0000000000000000-mapping.dmp

Download
memory/856-66-0x0000000000000000-mapping.dmp

Download
memory/860-85-0x0000000000000000-mapping.dmp

Download
memory/884-82-0x0000000000000000-mapping.dmp

Download
memory/900-55-0x0000000000000000-mapping.dmp

Download
memory/1064-111-0x0000000000000000-mapping.dmp

Download
memory/1084-87-0x0000000000000000-mapping.dmp

Download
memory/1084-113-0x0000000000000000-mapping.dmp

Download
memory/1104-78-0x0000000000000000-mapping.dmp

Download
memory/1104-105-0x0000000000000000-mapping.dmp

Download
memory/1168-73-0x0000000000000000-mapping.dmp

Download
memory/1192-99-0x0000000000000000-mapping.dmp

Download
memory/1192-69-0x0000000000000000-mapping.dmp

Download
memory/1264-92-0x0000000000000000-mapping.dmp

Download
memory/1264-118-0x0000000000000000-mapping.dmp

Download
memory/1296-108-0x0000000000000000-mapping.dmp

Download
memory/1372-54-0x0000000000A20000-0x0000000000C83000-memory.dmp

Filesize
2.4MB

Download
memory/1372-62-0x0000000000A20000-0x0000000000C83000-memory.dmp

Filesize
2.4MB

Download
memory/1380-116-0x0000000000000000-mapping.dmp

Download
memory/1440-61-0x0000000000000000-mapping.dmp

Download
memory/1440-96-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download
memory/1444-103-0x0000000000000000-mapping.dmp

Download
memory/1444-76-0x0000000000000000-mapping.dmp

Download
memory/1448-91-0x0000000000000000-mapping.dmp

Download
memory/1452-84-0x0000000000000000-mapping.dmp

Download
memory/1460-110-0x0000000000000000-mapping.dmp

Download
memory/1524-107-0x0000000000000000-mapping.dmp

Download
memory/1540-81-0x0000000000000000-mapping.dmp

Download
memory/1544-117-0x0000000000000000-mapping.dmp

Download
memory/1568-89-0x0000000000000000-mapping.dmp

Download
memory/1588-115-0x0000000000000000-mapping.dmp

Download
memory/1604-112-0x0000000000000000-mapping.dmp

Download
memory/1672-90-0x0000000000000000-mapping.dmp

Download
memory/1688-72-0x0000000000000000-mapping.dmp

Download
memory/1700-102-0x0000000000000000-mapping.dmp

Download
memory/1792-68-0x0000000000000000-mapping.dmp

Download
memory/1792-98-0x0000000000000000-mapping.dmp

Download
memory/1824-114-0x0000000000000000-mapping.dmp

Download
memory/1824-88-0x0000000000000000-mapping.dmp

Download
memory/1872-75-0x0000000000000000-mapping.dmp

Download
memory/1876-120-0x0000000000000000-mapping.dmp

Download
memory/1876-94-0x0000000000000000-mapping.dmp

Download
memory/1900-79-0x0000000000000000-mapping.dmp

Download
memory/1908-101-0x0000000000000000-mapping.dmp

Download
memory/1916-80-0x0000000000000000-mapping.dmp

Download
memory/1916-106-0x0000000000000000-mapping.dmp

Download
memory/1920-71-0x0000000000000000-mapping.dmp

Download
memory/1956-59-0x0000000000000000-mapping.dmp

Download
memory/1972-60-0x0000000000000000-mapping.dmp

Download
memory/2004-56-0x0000000000000000-mapping.dmp

Download
memory/2008-93-0x0000000000000000-mapping.dmp

Download
memory/2008-119-0x0000000000000000-mapping.dmp

Download
memory/2040-77-0x0000000000000000-mapping.dmp

Download
memory/2040-104-0x0000000000000000-mapping.dmp

Download