Overview

overview

10

Static

static

8

hive.exe

windows7-x64

10

hive.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2022 14:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hive.exe

  • Size

    764KB

  • MD5

    2f9fc82898d718f2abe99c4a6fa79e69

  • SHA1

    9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

  • SHA256

    88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

  • SHA512

    19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

  • SSDEEP

    12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score
10/10
hivepersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Detects Go variant of Hive Ransomware 2 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Drops file in Drivers directory 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 2 IoCs
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hive.exe
    "C:\Users\Admin\AppData\Local\Temp\hive.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:3748
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
          PID:4496
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
            PID:1860
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
              PID:1400
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
                PID:1512
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2832
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                  PID:2684
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                    PID:2872
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                      PID:2260
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2700
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                        PID:3888
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                          PID:5004
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                            PID:4936
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                              PID:3696
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                                PID:740
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                  PID:4312
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:1488
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:1072
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:548
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:4664
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                        PID:3912
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                          PID:4348
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:3948
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:2312
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:3172
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                            PID:4280
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:5096
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:896
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                              PID:4588
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:4192
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:2460
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                                PID:3404
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:2868
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:2176
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                  PID:4848
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                    PID:5068
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:4224
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:3176
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:4444
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                      PID:4080
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:4292
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:3076
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                        PID:1780
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3464
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:1084
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3772
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                          PID:1588
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:1628
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:4104
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:4472
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                            PID:2524
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:1472
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:1748
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:1968
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                              PID:3748
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:4496
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:4204
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                                PID:1100
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                  PID:1168
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                    PID:2700
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                      PID:3224
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:3696
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:1684
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:3804
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                        PID:1436
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:3872
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                          PID:1624
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                            PID:4056
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:4532
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:624
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:2532
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:480
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                              PID:3432
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                                PID:3760
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:3268
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                  PID:1440
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:3008
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:3144
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                    PID:2816
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                      PID:2672
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:3404
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:432
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:4036
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                        PID:3000
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:4928
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                          PID:4108
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                            PID:4016
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:4224
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                              PID:4020
                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                                PID:3528
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                  PID:2948
                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                  timeout 1
                                                                                                  3⤵
                                                                                                    PID:2332
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 1
                                                                                                    3⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:620
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 1
                                                                                                    3⤵
                                                                                                      PID:1336
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 1
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:2608
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 1
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:2188
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 1
                                                                                                      3⤵
                                                                                                        PID:3976
                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:4420
                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:4636
                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                          PID:1648
                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:3680
                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                            PID:3928
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout 1
                                                                                                            3⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:1588
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout 1
                                                                                                            3⤵
                                                                                                              PID:4852
                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                              timeout 1
                                                                                                              3⤵
                                                                                                                PID:4456
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:4688
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:4696
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                  PID:2224
                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                  timeout 1
                                                                                                                  3⤵
                                                                                                                    PID:4208
                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:4484
                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:1392
                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:4284
                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                      PID:1624
                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:4056
                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:4796
                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                        PID:4384
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout 1
                                                                                                                        3⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:3924
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout 1
                                                                                                                        3⤵
                                                                                                                          PID:4672
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 1
                                                                                                                          3⤵
                                                                                                                            PID:2244
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                              PID:3728
                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                              timeout 1
                                                                                                                              3⤵
                                                                                                                                PID:1644
                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                timeout 1
                                                                                                                                3⤵
                                                                                                                                  PID:1388
                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                  timeout 1
                                                                                                                                  3⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:4776
                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                  timeout 1
                                                                                                                                  3⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:1764
                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                  timeout 1
                                                                                                                                  3⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:960
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
                                                                                                                                2⤵
                                                                                                                                  PID:3380
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 404 -p 2440 -ip 2440
                                                                                                                                1⤵
                                                                                                                                  PID:4808
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 2440 -s 5832
                                                                                                                                  1⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:2768
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                  • Modifies Installed Components in the registry
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                  PID:1464
                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 1464 -s 2316
                                                                                                                                    2⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:4660
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 532 -p 1464 -ip 1464
                                                                                                                                  1⤵
                                                                                                                                    PID:1576

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini
                                                                                                                                    Filesize

                                                                                                                                    129B

                                                                                                                                    MD5

                                                                                                                                    a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                    SHA1

                                                                                                                                    2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                    SHA256

                                                                                                                                    e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                    SHA512

                                                                                                                                    d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                    Download Submit

                                                                                                                                  • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.3jD7JMBxjbc7AsOUtpq499xZd7hh-P8cFVncY8vUclY.hive
                                                                                                                                    Filesize

                                                                                                                                    622KB

                                                                                                                                    MD5

                                                                                                                                    54ac69fa48c4818ceccbc2e57e9fed8b

                                                                                                                                    SHA1

                                                                                                                                    0d628cd634c74320cdb939b01641682ee7db9af2

                                                                                                                                    SHA256

                                                                                                                                    49be9453491b3b3551d8cde235010f5f36b29843cb4fcef357d5fa00424f50e2

                                                                                                                                    SHA512

                                                                                                                                    f42106446575f702919d6cc42336f18070503f224d8dc1ff9c21e792968a2b9a685e6ae1a23628aceeb759b1a68efb11be6222ebf5a6be2be8f5851874e74857

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hive.bat
                                                                                                                                    Filesize

                                                                                                                                    162B

                                                                                                                                    MD5

                                                                                                                                    fca5799115172398c63263fad7e854b1

                                                                                                                                    SHA1

                                                                                                                                    2874a1c796f511f94bed6ae020f4b20c38c59cf1

                                                                                                                                    SHA256

                                                                                                                                    27323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663

                                                                                                                                    SHA512

                                                                                                                                    a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\shadow.bat
                                                                                                                                    Filesize

                                                                                                                                    57B

                                                                                                                                    MD5

                                                                                                                                    df5552357692e0cba5e69f8fbf06abb6

                                                                                                                                    SHA1

                                                                                                                                    4714f1e6bb75a80a8faf69434726d176b70d7bd8

                                                                                                                                    SHA256

                                                                                                                                    d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                                                                                                                                    SHA512

                                                                                                                                    a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                                                                                                                                    Download Submit

                                                                                                                                  • memory/548-157-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/740-153-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/896-166-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1072-156-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1084-183-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1100-196-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1168-197-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1400-142-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1472-190-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1488-155-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1512-143-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1588-185-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1628-186-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1748-191-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1780-181-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1860-141-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/1968-192-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2176-172-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2236-132-0x0000000000540000-0x00000000007A3000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.4MB

                                                                                                                                    Download

                                                                                                                                  • memory/2236-133-0x0000000000540000-0x00000000007A3000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.4MB

                                                                                                                                    Download

                                                                                                                                  • memory/2260-147-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2312-162-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2460-169-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2524-189-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2684-145-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2700-148-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2700-198-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2832-144-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2868-171-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/2872-146-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3076-180-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3172-163-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3176-176-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3224-199-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3380-135-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3404-170-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3464-182-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3696-200-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3696-152-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3748-138-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3748-193-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3772-184-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3888-149-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3912-159-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/3948-161-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4080-178-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4104-187-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4192-168-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4204-195-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4224-175-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4280-164-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4292-179-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4312-154-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4348-160-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4444-177-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4472-188-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4496-140-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4496-194-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4588-167-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4664-158-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4680-134-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4848-173-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/4936-151-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/5004-150-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/5068-174-0x0000000000000000-mapping.dmp

                                                                                                                                    Download

                                                                                                                                  • memory/5096-165-0x0000000000000000-mapping.dmp

                                                                                                                                    Download