hive | af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

Resubmissions

23-12-2022 20:19

221223-y39gvahb28 10

23-12-2022 19:54

221223-ymz88scc8w 10

23-12-2022 19:42

221223-yerbcsha78 10

Analysis

max time kernel
135s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2022 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hive.exe
Size

764KB
MD5

2f9fc82898d718f2abe99c4a6fa79e69
SHA1

9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA256

88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA512

19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
SSDEEP

12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score

10^/10

hive persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

Detects Go variant of Hive Ransomware 1 IoCs

resource	yara_rule
behavioral4/memory/1300-133-0x0000000000370000-0x00000000005D3000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Drops file in Drivers directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SyncSuspend.tiff.hHlI6y9vowc7fKn78NaEMOaTyvThILguRdSn22uJCFE.hive	hive.exe
File renamed	C:\Users\Admin\Pictures\StartRestore.png => C:\Users\Admin\Pictures\StartRestore.png.hHlI6y9vowc7fKn78NaEMKPCv5njkGwPTecokXlMpis.hive	hive.exe
File opened for modification	C:\Users\Admin\Pictures\StartRestore.png.hHlI6y9vowc7fKn78NaEMKPCv5njkGwPTecokXlMpis.hive	hive.exe
File renamed	C:\Users\Admin\Pictures\SyncSuspend.tiff => C:\Users\Admin\Pictures\SyncSuspend.tiff.hHlI6y9vowc7fKn78NaEMOaTyvThILguRdSn22uJCFE.hive	hive.exe
File renamed	C:\Users\Admin\Pictures\SwitchConfirm.png => C:\Users\Admin\Pictures\SwitchConfirm.png.hHlI6y9vowc7fKn78NaEMALHxdK8_b41XUBtY1Z7Y30.hive	hive.exe
File opened for modification	C:\Users\Admin\Pictures\SwitchConfirm.png.hHlI6y9vowc7fKn78NaEMALHxdK8_b41XUBtY1Z7Y30.hive	hive.exe
File opened for modification	C:\Users\Admin\Pictures\SyncSuspend.tiff	hive.exe
File renamed	C:\Users\Admin\Pictures\PushWait.png => C:\Users\Admin\Pictures\PushWait.png.hHlI6y9vowc7fKn78NaEMGSTtta9zE1XclS9t1JDLBs.hive	hive.exe
File opened for modification	C:\Users\Admin\Pictures\PushWait.png.hHlI6y9vowc7fKn78NaEMGSTtta9zE1XclS9t1JDLBs.hive	hive.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/1300-132-0x0000000000370000-0x00000000005D3000-memory.dmp	upx
behavioral4/memory/1300-133-0x0000000000370000-0x00000000005D3000-memory.dmp	upx

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.hHlI6y9vowc7fKn78NaEMP_njmoDVIxjKLOvdgEG0z0.hive	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt	hive.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	hive.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\desktop.ini	hive.exe
File opened for modification	C:\Program Files\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\TaskScheduler\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Com\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\zh-CN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_4e80c2bb5314f071\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\networklist\icons\StockIcons\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_avc.inf_amd64_8ee511eb19322856\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\ar-SA\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\wbem\AutoRecover\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_42b97498c7087292\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InputMethod\CHS\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0012\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_86cdf3e1f512cca1\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\Licenses\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\DiagSvcs\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_wpdmtp.inf_amd64_e0577000b188c16b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\ar-SA\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\wbem\en\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun2.inf_amd64_de323a35134348a2\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_volsnap.inf_amd64_47e3741bbf4d6b06\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_scmvolume.inf_amd64_de693592afe8a496\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msgpiowin32.inf_amd64_46634fa071d1db0d\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_4ab67656039b026b\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001d\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\EventTracingManagement\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_camera.inf_amd64_7b52a9607d24ece6\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_a9b96d6c7813082a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\Volume\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_bxt_p.inf_amd64_8be317e01b44bf5a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migration\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_977aa23dfab87f15\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migration\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_8a98af5011ee4dc6\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\DiagSvcs\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\it\HOW_TO_DECRYPT.txt	hive.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlOuterCircleHover.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-150.png	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js.hHlI6y9vowc7fKn78NaEMPBWJcp2qC0e0tM9vCBiVXU.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.hHlI6y9vowc7fKn78NaEMP9B7WOCWmY6kcY-Y3mnmDc.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppValueProp.svg	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Campfire.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js	hive.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\dismiss.contrast-black.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf.hHlI6y9vowc7fKn78NaEMM_vtk4Bhd1X2fg5dMfNTDc.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.DLL	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOIDCLIL.DLL	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\STSUCRES.DLL	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-200_contrast-white.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-80.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-60_altform-fullcolor.png	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Advertising.hHlI6y9vowc7fKn78NaEMBrusWKZ4_VcaW_r4Cwh6Xs.hive	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\telclient.dll	hive.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll.hHlI6y9vowc7fKn78NaEMLwRpMmW8y0XWucpBZGHY3Y.hive	hive.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.hHlI6y9vowc7fKn78NaEMIDRorpeXDtebPBrwng8mCc.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-unplated.png	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar.hHlI6y9vowc7fKn78NaEMP1Odx3xZoctr11LdiH4LT0.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEOLEDB.DLL.hHlI6y9vowc7fKn78NaEMIsVFPEUjUAHXh01QFmJyFw.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\THMBNAIL.PNG.hHlI6y9vowc7fKn78NaEMIV5eFSDVrwWWTzh3Fqqokc.hive	hive.exe
File opened for modification	C:\Program Files\BlockRemove.tif.hHlI6y9vowc7fKn78NaEMIeVJvupD3EHVRkxU3P9fEs.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll.hHlI6y9vowc7fKn78NaEMEnAqTovBABFz4f4LcYwxF8.hive	hive.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml	hive.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_pt_BR.properties.hHlI6y9vowc7fKn78NaEME-6FvKZPt9bx72oTDfZymw.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\nexturl.ort	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB.hHlI6y9vowc7fKn78NaEMBw42_f9IHEhsTxz6LV5gyQ.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp.hHlI6y9vowc7fKn78NaEMP0lkrtxmbQDSfljnILNRWg.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.hHlI6y9vowc7fKn78NaEMEV5vU4FHitovQ5TnFCtA2I.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-300.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text.gif	hive.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldExist.snippets.ps1xml	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\LargeTile.scale-100.png	hive.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.strings.psd1	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\move.svg.hHlI6y9vowc7fKn78NaEMG14VTd6kP0SU3pncSwyk1c.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\profile.jfc	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-logo-40.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_scale-100.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-200.png	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.hHlI6y9vowc7fKn78NaEMPkT26udjaAfUxv18S0FMFA.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ru.jar	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-150_contrast-white.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-72_altform-unplated.png	hive.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\MiguiControls.Resources\v4.0_1.0.0.0_ja_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\surfaceHubDeviceUser\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\0411\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices.resources\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Tpm.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.EnterpriseServices.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\pris\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Boot\PCAT\qps-ploc\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\INF\rdyboost\0409\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.ConfigCI.Commands.Resources\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\system.dynamic.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\INF\LSM\040C\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.Internal\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.DeveloperLicense.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Speech\Engines\Lexicon\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Encoding\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Cursors\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\INF\.NET CLR Networking\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client.resources\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\caspol.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Microsoft.WinJS-reduced\js\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Help\mui\040C\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Overlapped\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\speech\0804\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Pages\CheckPri\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Boot\PCAT\sl-SI\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\napinit.resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\INF\UGTHRSVC\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\microsoft.isam.esent.interop\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI.resources\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\network\common\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.AppV.AppVClientWmi.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities.Resources\v4.0_3.0.0.0_ja_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\IME\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework64\1041\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\de\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\speech\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\L2Schemas\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\HOW_TO_DECRYPT.txt	hive.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3152	2804	WerFault.exe	35
3076	2736	WerFault.exe	194

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
4244	timeout.exe
4196	timeout.exe
4388	timeout.exe
4792	timeout.exe
1304	timeout.exe
1052	timeout.exe
5024	timeout.exe
516	timeout.exe
1236	timeout.exe
2296	timeout.exe
4628	timeout.exe
2936	timeout.exe
972	timeout.exe
1428	timeout.exe
2140	timeout.exe
2732	timeout.exe
4256	timeout.exe
4596	timeout.exe
1656	timeout.exe
1620	timeout.exe
4900	timeout.exe
4200	timeout.exe
404	timeout.exe
3128	timeout.exe
3136	timeout.exe
4284	timeout.exe
1700	timeout.exe
4224	timeout.exe
4164	timeout.exe
4788	timeout.exe
4032	timeout.exe
1372	timeout.exe
1388	timeout.exe
4104	timeout.exe
620	timeout.exe
4996	timeout.exe
924	timeout.exe
3972	timeout.exe
2484	timeout.exe
3008	timeout.exe
3720	timeout.exe
4756	timeout.exe
4272	timeout.exe
3668	timeout.exe
2120	timeout.exe
3896	timeout.exe
4244	timeout.exe
1864	timeout.exe
1868	timeout.exe
732	timeout.exe
4280	timeout.exe
4344	timeout.exe
1352	timeout.exe
1804	timeout.exe
1808	timeout.exe
3672	timeout.exe
1352	timeout.exe
3804	timeout.exe
4060	timeout.exe
2340	timeout.exe
2880	timeout.exe
4100	timeout.exe
2784	timeout.exe
1016	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{FF1C35F1-F605-4289-9F90-43B4D9E8E35F}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1300	hive.exe
1300	hive.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2736	explorer.exe
Token: SeCreatePagefilePrivilege	2736	explorer.exe
Token: SeShutdownPrivilege	2736	explorer.exe
Token: SeCreatePagefilePrivilege	2736	explorer.exe
Token: SeShutdownPrivilege	2736	explorer.exe
Token: SeCreatePagefilePrivilege	2736	explorer.exe
Token: SeShutdownPrivilege	2736	explorer.exe
Token: SeCreatePagefilePrivilege	2736	explorer.exe
Token: SeShutdownPrivilege	2736	explorer.exe
Token: SeCreatePagefilePrivilege	2736	explorer.exe
Token: SeShutdownPrivilege	2736	explorer.exe
Token: SeCreatePagefilePrivilege	2736	explorer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe
2736	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2864	1300	hive.exe	86
PID 1300 wrote to memory of 2864	1300	hive.exe	86
PID 1300 wrote to memory of 2864	1300	hive.exe	86
PID 1300 wrote to memory of 4660	1300	hive.exe	87
PID 1300 wrote to memory of 4660	1300	hive.exe	87
PID 1300 wrote to memory of 4660	1300	hive.exe	87
PID 2864 wrote to memory of 3128	2864	cmd.exe	90
PID 2864 wrote to memory of 3128	2864	cmd.exe	90
PID 2864 wrote to memory of 3128	2864	cmd.exe	90
PID 2864 wrote to memory of 4284	2864	cmd.exe	91
PID 2864 wrote to memory of 4284	2864	cmd.exe	91
PID 2864 wrote to memory of 4284	2864	cmd.exe	91
PID 2864 wrote to memory of 3972	2864	cmd.exe	92
PID 2864 wrote to memory of 3972	2864	cmd.exe	92
PID 2864 wrote to memory of 3972	2864	cmd.exe	92
PID 2864 wrote to memory of 3652	2864	cmd.exe	93
PID 2864 wrote to memory of 3652	2864	cmd.exe	93
PID 2864 wrote to memory of 3652	2864	cmd.exe	93
PID 2864 wrote to memory of 3688	2864	cmd.exe	94
PID 2864 wrote to memory of 3688	2864	cmd.exe	94
PID 2864 wrote to memory of 3688	2864	cmd.exe	94
PID 2864 wrote to memory of 3672	2864	cmd.exe	95
PID 2864 wrote to memory of 3672	2864	cmd.exe	95
PID 2864 wrote to memory of 3672	2864	cmd.exe	95
PID 2864 wrote to memory of 4256	2864	cmd.exe	96
PID 2864 wrote to memory of 4256	2864	cmd.exe	96
PID 2864 wrote to memory of 4256	2864	cmd.exe	96
PID 2864 wrote to memory of 2784	2864	cmd.exe	97
PID 2864 wrote to memory of 2784	2864	cmd.exe	97
PID 2864 wrote to memory of 2784	2864	cmd.exe	97
PID 2864 wrote to memory of 4012	2864	cmd.exe	98
PID 2864 wrote to memory of 4012	2864	cmd.exe	98
PID 2864 wrote to memory of 4012	2864	cmd.exe	98
PID 2864 wrote to memory of 2340	2864	cmd.exe	99
PID 2864 wrote to memory of 2340	2864	cmd.exe	99
PID 2864 wrote to memory of 2340	2864	cmd.exe	99
PID 2864 wrote to memory of 4788	2864	cmd.exe	101
PID 2864 wrote to memory of 4788	2864	cmd.exe	101
PID 2864 wrote to memory of 4788	2864	cmd.exe	101
PID 2864 wrote to memory of 804	2864	cmd.exe	102
PID 2864 wrote to memory of 804	2864	cmd.exe	102
PID 2864 wrote to memory of 804	2864	cmd.exe	102
PID 2864 wrote to memory of 1352	2864	cmd.exe	103
PID 2864 wrote to memory of 1352	2864	cmd.exe	103
PID 2864 wrote to memory of 1352	2864	cmd.exe	103
PID 2864 wrote to memory of 1372	2864	cmd.exe	104
PID 2864 wrote to memory of 1372	2864	cmd.exe	104
PID 2864 wrote to memory of 1372	2864	cmd.exe	104
PID 2864 wrote to memory of 3704	2864	cmd.exe	105
PID 2864 wrote to memory of 3704	2864	cmd.exe	105
PID 2864 wrote to memory of 3704	2864	cmd.exe	105
PID 2864 wrote to memory of 3656	2864	cmd.exe	106
PID 2864 wrote to memory of 3656	2864	cmd.exe	106
PID 2864 wrote to memory of 3656	2864	cmd.exe	106
PID 2864 wrote to memory of 2936	2864	cmd.exe	107
PID 2864 wrote to memory of 2936	2864	cmd.exe	107
PID 2864 wrote to memory of 2936	2864	cmd.exe	107
PID 2864 wrote to memory of 4280	2864	cmd.exe	108
PID 2864 wrote to memory of 4280	2864	cmd.exe	108
PID 2864 wrote to memory of 4280	2864	cmd.exe	108
PID 2864 wrote to memory of 1804	2864	cmd.exe	109
PID 2864 wrote to memory of 1804	2864	cmd.exe	109
PID 2864 wrote to memory of 1804	2864	cmd.exe	109
PID 2864 wrote to memory of 1360	2864	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\hive.exe
"C:\Users\Admin\AppData\Local\Temp\hive.exe"
1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3128
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4284
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3972
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4256
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2784
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2340
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4788
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:804
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1352
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1372
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2936
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1804
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1808
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:972
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1388
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1236
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4032
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4344
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2880
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1868
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4200
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3952
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4104
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4244
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1428
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4348
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2296
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4060
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:732
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:516
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4628
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1304
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3720
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4996
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4596
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2484
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2120
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1352
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1700
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1864
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4224
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4280
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1016
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:924
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:404
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1052
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1656
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2140
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3136
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3896
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2732
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4900
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4244
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4196
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:520
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4388
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4756
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4272
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3804
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5024
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3668
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4164
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
  2⤵
  PID:4660

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 2804 -ip 2804
1⤵
PID:3256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2804 -s 3304
1⤵
- Program crash
PID:3152

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 2208
  2⤵
  - Program crash
  PID:3076

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 2736 -ip 2736
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini

Filesize
129B

MD5
4f84c0e8e1385743d1ef8de07b9dc3ff

SHA1
82558286d3ab9dcb79b5ab103b87ba4694cc6d03

SHA256
3152a4b21ee826fd33fbb1eadb417a192c8c568e46acd2eb03e1474bbf28cad1

SHA512
b1d45efb14a5f49776d900e91de3174a1761ddf1a2f6506abfa61c8446841fca62008888f01029a7012ba3bfbbd21996f06f45bc94e0514f42a651971fdfee6e

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.hHlI6y9vowc7fKn78NaEMHRCQ7osj9dF7bviWRj6ySk.hive

Filesize
622KB

MD5
2a7dfdb4555bee706a820dd8b0ebda96

SHA1
96f8ba8913dbe0c0048901212fb52dab0c25a068

SHA256
fd4c28c82dd74821e046f9c699e91d13a09d081023125ee7a1ad430290e9af32

SHA512
1fd512166861a627cd12d3b805aad82e99b81673246f3871541633381c5ac27d820e76c78df53a466862b628d9a823bd2d3c9d2f54be629a0771cf72d56c4bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hive.bat

Filesize
162B

MD5
fca5799115172398c63263fad7e854b1

SHA1
2874a1c796f511f94bed6ae020f4b20c38c59cf1

SHA256
27323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663

SHA512
a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b

Download Submit
C:\Users\Admin\AppData\Local\Temp\shadow.bat

Filesize
57B

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
memory/1300-132-0x0000000000370000-0x00000000005D3000-memory.dmp

Filesize
2.4MB

Download
memory/1300-133-0x0000000000370000-0x00000000005D3000-memory.dmp

Filesize
2.4MB

Download