hive | 01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538 | Triage

Resubmissions

28-03-2023 10:26

230328-mgvk1scb51 10

Analysis

max time kernel
102s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 10:26

Sharing

Report Analysis Logs

General

Target

hive.exe
Size

592KB
MD5

e0dc86b7daa917d9ecf8d3d7511ad909
SHA1

92b1f64a5071c7df0fe484e520ca5e3d38636fc2
SHA256

01ea06db82a72d8eaa3209311b20f3da34aebda948204f615c63e5cb62057538
SHA512

20700119b07d9a632b15baefbe91eafe4d4388d3fdcca43ac3ce097d372b5d817b54de9807024c8de1c4acd03df43585f4ff7050922655a716f35e2429a687b8
SSDEEP

12288:BzMOFIgp5Xr04Sfc3EUDYrWLrq3j+xNfeujr6n:BMk5Lr02DYrWL+3j+

Score

10^/10

hive ransomware

Malware Config

Signatures

Detects Rust x64 variant of Hive Ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1520-133-0x0000000000420000-0x00000000004BC000-memory.dmp	hive_rust_x64

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2736 3560 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\hive.exe
"C:\Users\Admin\AppData\Local\Temp\hive.exe"
1⤵
PID:1520

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 3560 -ip 3560
1⤵
PID:2904

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3560 -s 1748
1⤵
- Program crash
PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-133-0x0000000000420000-0x00000000004BC000-memory.dmp

Filesize
624KB

Download