Overview
overview
10Static
static
8211xahcou.exe
windows7-x64
10211xahcou.exe
windows10-2004-x64
10hive.exe
windows7-x64
10hive.exe
windows10-2004-x64
10sjl8j6ap3.exe
windows7-x64
1sjl8j6ap3.exe
windows10-2004-x64
1windows_25...c5.exe
windows7-x64
10windows_25...c5.exe
windows10-2004-x64
10zi1ysv64h.exe
windows7-x64
10zi1ysv64h.exe
windows10-2004-x64
10Resubmissions
23-12-2022 20:19
221223-y39gvahb28 1023-12-2022 19:54
221223-ymz88scc8w 1023-12-2022 19:42
221223-yerbcsha78 10Analysis
-
max time kernel
139s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-12-2022 19:42
Behavioral task
behavioral1
Sample
211xahcou.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
211xahcou.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
hive.exe
Resource
win7-20221111-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
hive.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral5
Sample
sjl8j6ap3.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
sjl8j6ap3.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe
Resource
win7-20221111-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral8
Sample
windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
zi1ysv64h.exe
Resource
win7-20221111-en
windows7-x64
14 signatures
150 seconds
General
-
Target
hive.exe
-
Size
764KB
-
MD5
2f9fc82898d718f2abe99c4a6fa79e69
-
SHA1
9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
-
SHA256
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
-
SHA512
19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
-
SSDEEP
12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH
Score
10/10
Malware Config
Extracted
Path
C:\HOW_TO_DECRYPT.txt
Family
hive
Ransom Note
Your network has been breached and all data is encrypted.
To decrypt all the data you will need to purchase our decryption software.
Please contact our sales department at:
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Login: EQA9oydTxwXS
Password: vNtgAgb3kMFmCooANNQr
Follow the guidelines below to avoid losing your data:
- Do not shutdown or reboot your computers, unmount external storages.
- Do not try to decrypt data using third party software. It may cause irreversible damage.
- Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key.
- Do not modify, rename or delete *.key.hive files. Your data will be undecryptable.
- Do not modify or rename encrypted files. You will lose them.
- Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased.
- Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Signatures
-
Detects Go variant of Hive Ransomware 2 IoCs
Processes:
resource yara_rule behavioral3/memory/2000-54-0x00000000002E0000-0x0000000000543000-memory.dmp hive_go behavioral3/memory/2000-63-0x00000000002E0000-0x0000000000543000-memory.dmp hive_go -
Hive
A ransomware written in Golang first seen in June 2021.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Drivers directory 28 IoCs
Processes:
hive.exedescription ioc Process File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt hive.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
hive.exedescription ioc Process File opened for modification C:\Users\Admin\Pictures\DebugUnregister.tiff.Yvq_MQ0rJV9yAJJ5pBPPJEUl6JIljzcaah7TUjWlhUw.hive hive.exe File opened for modification C:\Users\Admin\Pictures\LimitConvertFrom.png.Yvq_MQ0rJV9yAJJ5pBPPJB8JhzqysmAUY8rDV89dfk4.hive hive.exe File renamed C:\Users\Admin\Pictures\OpenSplit.raw => C:\Users\Admin\Pictures\OpenSplit.raw.Yvq_MQ0rJV9yAJJ5pBPPJHQSEknvHtErEsCevJlfnEY.hive hive.exe File opened for modification C:\Users\Admin\Pictures\OpenSplit.raw.Yvq_MQ0rJV9yAJJ5pBPPJHQSEknvHtErEsCevJlfnEY.hive hive.exe File renamed C:\Users\Admin\Pictures\AddRestore.raw => C:\Users\Admin\Pictures\AddRestore.raw.Yvq_MQ0rJV9yAJJ5pBPPJHxS0xIEC_YM0UWDZ4QjOVs.hive hive.exe File renamed C:\Users\Admin\Pictures\DebugUnregister.tiff => C:\Users\Admin\Pictures\DebugUnregister.tiff.Yvq_MQ0rJV9yAJJ5pBPPJEUl6JIljzcaah7TUjWlhUw.hive hive.exe File opened for modification C:\Users\Admin\Pictures\AddRestore.raw.Yvq_MQ0rJV9yAJJ5pBPPJHxS0xIEC_YM0UWDZ4QjOVs.hive hive.exe File renamed C:\Users\Admin\Pictures\CloseComplete.raw => C:\Users\Admin\Pictures\CloseComplete.raw.Yvq_MQ0rJV9yAJJ5pBPPJIQgRbnHBVgq643KnAaY3DU.hive hive.exe File opened for modification C:\Users\Admin\Pictures\CloseComplete.raw.Yvq_MQ0rJV9yAJJ5pBPPJIQgRbnHBVgq643KnAaY3DU.hive hive.exe File renamed C:\Users\Admin\Pictures\LimitConvertFrom.png => C:\Users\Admin\Pictures\LimitConvertFrom.png.Yvq_MQ0rJV9yAJJ5pBPPJB8JhzqysmAUY8rDV89dfk4.hive hive.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromSearch.tiff hive.exe File opened for modification C:\Users\Admin\Pictures\DebugUnregister.tiff hive.exe -
Processes:
resource yara_rule behavioral3/memory/2000-54-0x00000000002E0000-0x0000000000543000-memory.dmp upx behavioral3/memory/2000-63-0x00000000002E0000-0x0000000000543000-memory.dmp upx -
Drops startup file 3 IoCs
Processes:
hive.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.Yvq_MQ0rJV9yAJJ5pBPPJB2_BQ8n7TE_qBvVlfA5fDQ.hive hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini hive.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
hive.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MR9GAVBQ\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini hive.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FPMCGPEN\desktop.ini hive.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini hive.exe File opened for modification C:\Users\Public\desktop.ini hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini hive.exe File opened for modification C:\Users\Public\Pictures\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini hive.exe File opened for modification C:\Program Files\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2WZE2OQ2\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini hive.exe File opened for modification C:\Users\Public\Downloads\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini hive.exe File opened for modification C:\Users\Public\Libraries\desktop.ini hive.exe File opened for modification C:\Users\Public\Videos\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini hive.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\desktop.ini hive.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Music\desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YB33FE3E\desktop.ini hive.exe File opened for modification C:\Users\Public\Documents\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\60C94KT8\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini hive.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini hive.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini hive.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini hive.exe File opened for modification C:\Program Files (x86)\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PB7XGXUS\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Documents\desktop.ini hive.exe File opened for modification C:\Users\Public\Music\desktop.ini hive.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini hive.exe -
Drops file in System32 directory 64 IoCs
Processes:
hive.exedescription ioc Process File created C:\Windows\System32\DriverStore\FileRepository\prnrc00c.inf_amd64_neutral_53a58f4fd7d88575\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomePremiumN\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\LogFiles\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_neutral_ab710894455d7b9a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\ricoh.inf_amd64_neutral_66b4504d1fb1c857\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaep002.inf_amd64_neutral_0a982dec66379cb0\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\sysprep\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_neutral_f77725472d91b1d1\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\Dism\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\0410\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_neutral_46f466c9e68abb4a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_neutral_b9280780a8000d4b\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0019\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\StarterE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_neutral_30b367f92ca46598\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\net1kx64.inf_amd64_neutral_1f62482fbb9e52a5\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\MUI\0410\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\StarterE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_neutral_4c78da9e48068043\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-activedirectory-webservices\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\WindowsSearchEngine\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\LogFiles\Windows Portable Devices\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\UltimateE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-WMI-Core\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-international-core\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_neutral_f5caca1789a3c28b\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\wdi\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\pt-BR\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\IME\imekr8\applets\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_neutral_9fdc5d710dd63e80\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_neutral_cb8fa151a7b7cb80\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\zh-HK\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\MUI\040C\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremiumE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\com\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseN\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc2.inf_amd64_neutral_7621f5d62d77f42e\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mpio.inf_amd64_neutral_0c74c0f95001b61c\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\001f\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\001a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\HOW_TO_DECRYPT.txt hive.exe -
Drops file in Program Files directory 64 IoCs
Processes:
hive.exedescription ioc Process File opened for modification C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx hive.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.Yvq_MQ0rJV9yAJJ5pBPPJCAPNxva-EtqQY8Vj7IZPBA.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\ROGERS.COM.XML.Yvq_MQ0rJV9yAJJ5pBPPJG0lk0WCzK09gadJKRU6glQ.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML.Yvq_MQ0rJV9yAJJ5pBPPJLhFRol8ebYTlkM2EBN1DwA.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpg.Yvq_MQ0rJV9yAJJ5pBPPJEzz1PAfBl5PnyW7aJhpyhE.hive hive.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar hive.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF hive.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png hive.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT.Yvq_MQ0rJV9yAJJ5pBPPJGBa4JnI0u5HXTH31U-CZE8.hive hive.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp.Yvq_MQ0rJV9yAJJ5pBPPJBsqHoZ9Br4KTjZMw1CEXEQ.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02067_.WMF.Yvq_MQ0rJV9yAJJ5pBPPJA8opkDvMIVCbFU7-VYK8nw.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21480_.GIF.Yvq_MQ0rJV9yAJJ5pBPPJBPuCmd4pakDrVg9_4sK0Qk.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195342.WMF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif hive.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.Yvq_MQ0rJV9yAJJ5pBPPJL3ytC-TjlAixCd3i_-usUs.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg.Yvq_MQ0rJV9yAJJ5pBPPJPJPfSU12RJE9Wanr8parm0.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Issues.accdt.Yvq_MQ0rJV9yAJJ5pBPPJAm6B8rH7e4uAY8x2dAgnyk.hive hive.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115835.GIF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLWVW.DLL.IDX_DLL hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\FAXEXT.ECF hive.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.Yvq_MQ0rJV9yAJJ5pBPPJLXoJ8aUFYZ6unQukwbH_lk.hive hive.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll.Yvq_MQ0rJV9yAJJ5pBPPJF1_s1t4Ekc7f7poplx2tzU.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00458_.WMF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.Yvq_MQ0rJV9yAJJ5pBPPJDhrP9YjVx5LkQdAdja9zio.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.DPV hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT hive.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00042_.WMF hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.Yvq_MQ0rJV9yAJJ5pBPPJGT6RO6mOGpp_2Rj7TTvm0A.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx hive.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_th.dll.Yvq_MQ0rJV9yAJJ5pBPPJM2w_CN7P8goyxNs0Hun1x4.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.Yvq_MQ0rJV9yAJJ5pBPPJFdDjeefZs16dNT4hzEih1s.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM.Yvq_MQ0rJV9yAJJ5pBPPJLvB_bzFpuVBfHH3uAtn-2g.hive hive.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai hive.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\it-IT\msdaprsr.dll.mui hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21327_.GIF hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.Yvq_MQ0rJV9yAJJ5pBPPJNCVGyeAFZRjn_SC8xBP5Hc.hive hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.Yvq_MQ0rJV9yAJJ5pBPPJCYghPlQeFl_LoeNaoAztmA.hive hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.Yvq_MQ0rJV9yAJJ5pBPPJIq2knjBbaN0eI0ejs_RLXU.hive hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml hive.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js hive.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM hive.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\HOW_TO_DECRYPT.txt hive.exe File created C:\Program Files\Windows Sidebar\ja-JP\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF hive.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF hive.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.Yvq_MQ0rJV9yAJJ5pBPPJMdQ6pfpb8ZiXAhKr8vfK10.hive hive.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js hive.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\JOURNAL.ELM.Yvq_MQ0rJV9yAJJ5pBPPJIKjxVIWFB0dIU6lOmYOn1I.hive hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA hive.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02009_.WMF.Yvq_MQ0rJV9yAJJ5pBPPJIwnIs8eLhY5rAN6Xe0F2FA.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233070.WMF.Yvq_MQ0rJV9yAJJ5pBPPJCUezfTJj_cH_V_FSCg8ZEE.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyMergeLetter.dotx.Yvq_MQ0rJV9yAJJ5pBPPJD75jd2CImJCSC7A4h8-MA0.hive hive.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll hive.exe -
Drops file in Windows directory 64 IoCs
Processes:
hive.exedescription ioc Process File created C:\Windows\Microsoft.NET\Framework64\v3.0\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\system.workflow.componentmodel.resources\3.0.0.0_ja_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Baa2ca56b#\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Device\43e3de47523dcf438cf61c645db9521c\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_ja_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.Workflow.Runtime\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\7c8f75f367134a030cba4a127dc62a2f\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Routing\186e30076507f42b977c54ccddcbb09d\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\it-IT\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\smdiagnostics.resources\3.0.0.0_ja_b77a5c561934e089\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0C0A\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\inf\aspnet_state\0008\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\es-ES\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\AuditPolicyGPManage#\ce8c100b866ac8facc1902286aede990\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\d56e83822b7799e202533e1b84b3c134\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Globalization\MCT\MCT-ZA\Theme\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Encoding\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Net\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiWUapi\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\diagnostics\system\AERO\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\PLA\Templates\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.resources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\ehome\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\it\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\napsnap\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\inf\wsearchidxpi\040C\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\IME\IMETC10\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\system.workflow.activities.resources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Workfffcbcd8#\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.WebRequest\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Speech\160c2dad0a0b481f8ed2c4462dd95618\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.EventBasedAsync\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources\3.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\inf\ASP.NET_4.0.30319\000B\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\inf\es-ES\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management\c44929bde355680c886f8a52f5e22b81\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\security\ApplicationId\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.Net\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\XsdBuildTask\90ef7c8e607fe9d71e83d747b02b64c0\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MUI\0407\HOW_TO_DECRYPT.txt hive.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1076 1288 WerFault.exe 13 -
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid Process 1536 timeout.exe 1964 timeout.exe 584 timeout.exe 1676 timeout.exe 1736 timeout.exe 784 timeout.exe 284 timeout.exe 1764 timeout.exe 1116 timeout.exe 856 timeout.exe 1668 timeout.exe 1092 timeout.exe 1600 timeout.exe 1648 timeout.exe 524 timeout.exe 700 timeout.exe 1564 timeout.exe 1056 timeout.exe 588 timeout.exe 1156 timeout.exe 1672 timeout.exe 1076 timeout.exe 1744 timeout.exe 1912 timeout.exe 1128 timeout.exe 1180 timeout.exe 1316 timeout.exe 524 timeout.exe 1796 timeout.exe 1176 timeout.exe 576 timeout.exe 836 timeout.exe 856 timeout.exe 2020 timeout.exe 632 timeout.exe 1956 timeout.exe 432 timeout.exe 584 timeout.exe 1224 timeout.exe 700 timeout.exe 1384 timeout.exe 2032 timeout.exe 1576 timeout.exe 1248 timeout.exe 1764 timeout.exe 1704 timeout.exe 560 timeout.exe 1116 timeout.exe 1384 timeout.exe 2024 timeout.exe 640 timeout.exe 1688 timeout.exe 1176 timeout.exe 1564 timeout.exe 764 timeout.exe 588 timeout.exe 1704 timeout.exe 784 timeout.exe 1264 timeout.exe 1924 timeout.exe 1184 timeout.exe 1368 timeout.exe 1576 timeout.exe 1852 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid Process 524 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
hive.exepid Process 2000 hive.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid Process Token: SeBackupPrivilege 780 vssvc.exe Token: SeRestorePrivilege 780 vssvc.exe Token: SeAuditPrivilege 780 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
hive.execmd.execmd.exedescription pid Process procid_target PID 2000 wrote to memory of 1148 2000 hive.exe 28 PID 2000 wrote to memory of 1148 2000 hive.exe 28 PID 2000 wrote to memory of 1148 2000 hive.exe 28 PID 2000 wrote to memory of 1148 2000 hive.exe 28 PID 2000 wrote to memory of 596 2000 hive.exe 30 PID 2000 wrote to memory of 596 2000 hive.exe 30 PID 2000 wrote to memory of 596 2000 hive.exe 30 PID 2000 wrote to memory of 596 2000 hive.exe 30 PID 596 wrote to memory of 524 596 cmd.exe 32 PID 596 wrote to memory of 524 596 cmd.exe 32 PID 596 wrote to memory of 524 596 cmd.exe 32 PID 596 wrote to memory of 524 596 cmd.exe 32 PID 1148 wrote to memory of 1180 1148 cmd.exe 33 PID 1148 wrote to memory of 1180 1148 cmd.exe 33 PID 1148 wrote to memory of 1180 1148 cmd.exe 33 PID 1148 wrote to memory of 1180 1148 cmd.exe 33 PID 1148 wrote to memory of 700 1148 cmd.exe 35 PID 1148 wrote to memory of 700 1148 cmd.exe 35 PID 1148 wrote to memory of 700 1148 cmd.exe 35 PID 1148 wrote to memory of 700 1148 cmd.exe 35 PID 1148 wrote to memory of 1564 1148 cmd.exe 36 PID 1148 wrote to memory of 1564 1148 cmd.exe 36 PID 1148 wrote to memory of 1564 1148 cmd.exe 36 PID 1148 wrote to memory of 1564 1148 cmd.exe 36 PID 1148 wrote to memory of 764 1148 cmd.exe 37 PID 1148 wrote to memory of 764 1148 cmd.exe 37 PID 1148 wrote to memory of 764 1148 cmd.exe 37 PID 1148 wrote to memory of 764 1148 cmd.exe 37 PID 1148 wrote to memory of 784 1148 cmd.exe 38 PID 1148 wrote to memory of 784 1148 cmd.exe 38 PID 1148 wrote to memory of 784 1148 cmd.exe 38 PID 1148 wrote to memory of 784 1148 cmd.exe 38 PID 1148 wrote to memory of 1764 1148 cmd.exe 39 PID 1148 wrote to memory of 1764 1148 cmd.exe 39 PID 1148 wrote to memory of 1764 1148 cmd.exe 39 PID 1148 wrote to memory of 1764 1148 cmd.exe 39 PID 1148 wrote to memory of 1648 1148 cmd.exe 40 PID 1148 wrote to memory of 1648 1148 cmd.exe 40 PID 1148 wrote to memory of 1648 1148 cmd.exe 40 PID 1148 wrote to memory of 1648 1148 cmd.exe 40 PID 1148 wrote to memory of 1384 1148 cmd.exe 41 PID 1148 wrote to memory of 1384 1148 cmd.exe 41 PID 1148 wrote to memory of 1384 1148 cmd.exe 41 PID 1148 wrote to memory of 1384 1148 cmd.exe 41 PID 1148 wrote to memory of 2020 1148 cmd.exe 42 PID 1148 wrote to memory of 2020 1148 cmd.exe 42 PID 1148 wrote to memory of 2020 1148 cmd.exe 42 PID 1148 wrote to memory of 2020 1148 cmd.exe 42 PID 1148 wrote to memory of 1156 1148 cmd.exe 43 PID 1148 wrote to memory of 1156 1148 cmd.exe 43 PID 1148 wrote to memory of 1156 1148 cmd.exe 43 PID 1148 wrote to memory of 1156 1148 cmd.exe 43 PID 1148 wrote to memory of 284 1148 cmd.exe 44 PID 1148 wrote to memory of 284 1148 cmd.exe 44 PID 1148 wrote to memory of 284 1148 cmd.exe 44 PID 1148 wrote to memory of 284 1148 cmd.exe 44 PID 1148 wrote to memory of 1536 1148 cmd.exe 45 PID 1148 wrote to memory of 1536 1148 cmd.exe 45 PID 1148 wrote to memory of 1536 1148 cmd.exe 45 PID 1148 wrote to memory of 1536 1148 cmd.exe 45 PID 1148 wrote to memory of 1672 1148 cmd.exe 46 PID 1148 wrote to memory of 1672 1148 cmd.exe 46 PID 1148 wrote to memory of 1672 1148 cmd.exe 46 PID 1148 wrote to memory of 1672 1148 cmd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\hive.exe"C:\Users\Admin\AppData\Local\Temp\hive.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.execmd /c hive.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1180
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:700
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1564
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:764
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:784
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1764
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1648
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1384
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2020
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1156
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:284
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1536
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1672
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1796
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1964
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1184
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1368
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2032
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1176
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1116
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:588
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1576
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:856
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:524
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1076
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:824
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1676
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:700
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1564
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1744
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1852
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:576
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1704
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1668
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1056
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:560
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1092
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:632
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1956
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:432
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2024
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:640
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1736
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1104
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1800
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1688
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1600
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1176
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1116
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:588
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:836
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1316
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1624
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1576
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:856
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:524
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:700
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1248
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1912
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1744
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:784
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1764
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1264
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1224
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1704
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1384
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1128
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1056
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1156
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shadow.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:524
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1288 -s 5841⤵
- Program crash
PID:1076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD51d40db555b17b398378b4803dac50317
SHA1dc34d581358066418c13cabde291396d402ec1f7
SHA256f02a1b80fe7d7cf399da51d136f5caa568dcfd52143a2c00be256c378841d599
SHA5128b3b434824cdb965790784207f6e1ab95b082fd8106d97afe5183dc29af5852b901eaf6755f15d3799fffddb111b93ff031cc24d28266761305e79eef430c233
-
Filesize
162B
MD5fca5799115172398c63263fad7e854b1
SHA12874a1c796f511f94bed6ae020f4b20c38c59cf1
SHA25627323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663
SHA512a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b
-
Filesize
57B
MD5df5552357692e0cba5e69f8fbf06abb6
SHA14714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d