Overview

overview

10

Static

static

7

Ransomware.Hive.zip

windows7-x64

1

Ransomware.Hive.zip

windows10-1703-x64

1

211xahcou.exe

windows7-x64

10

211xahcou.exe

windows10-1703-x64

10

Hive.elf

windows7-x64

3

Hive.elf

windows10-1703-x64

3

hive.exe

windows7-x64

10

hive.exe

windows10-1703-x64

10

hive_linux_elf

windows7-x64

1

hive_linux_elf

windows10-1703-x64

1

linux_hive.elf

windows7-x64

3

linux_hive.elf

windows10-1703-x64

3

sjl8j6ap3.exe

windows7-x64

1

sjl8j6ap3.exe

windows10-1703-x64

1

windows_25...c5.exe

windows7-x64

10

windows_25...c5.exe

windows10-1703-x64

10

zi1ysv64h.exe

windows7-x64

10

zi1ysv64h.exe

windows10-1703-x64

10

Resubmissions

12-02-2024 06:38

240212-hd166sgg25 10

12-02-2024 06:21

240212-g4tdksgd86 7

Analysis

  • max time kernel
    82s
  • max time network
    195s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-02-2024 06:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hive.exe

  • Size

    764KB

  • MD5

    2f9fc82898d718f2abe99c4a6fa79e69

  • SHA1

    9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

  • SHA256

    88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

  • SHA512

    19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

  • SSDEEP

    12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score
10/10
hivepersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-655921741-723621465-1580683668-1000\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Detects Go variant of Hive Ransomware 10 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Drops file in Drivers directory 18 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\hive.exe
    "C:\Users\Admin\AppData\Local\Temp\hive.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:928
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:2180
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1752
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:4660
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:2132
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:4696
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
          PID:2392
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1156
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
            PID:3364
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:4560
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
              PID:2184
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4344
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2188
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2644
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4800
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4472
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4384
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:1092
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:768
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4144
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4636
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:1740
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:3552
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:1932
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2960
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2132
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:1404
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2356
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
                PID:4044
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2164
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:4860
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2964
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2304
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2644
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:344
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:4392
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2156
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2280
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:824
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                  PID:3320
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:2748
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:828
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                    PID:1840
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4448
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:1868
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3088
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:1792
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:2956
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:1980
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4964
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:584
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3748
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3064
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3376
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4248
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4448
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:2644
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3640
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:692
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3184
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:964
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3836
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3644
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:520
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3116
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3632
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:1412
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:292
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4228
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4024
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:168
                  • C:\Windows\SysWOW64\vssadmin.exe
                    vssadmin.exe delete shadows /all /quiet
                    3⤵
                    • Interacts with shadow copies
                    PID:2464
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2336
              • C:\Windows\system32\OpenWith.exe
                C:\Windows\system32\OpenWith.exe -Embedding
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4428
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1060

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Indicator Removal

              2
              T1070

              File Deletion

              2
              T1070.004

              Modify Registry

              1
              T1112

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Exfiltration

              Command and Control

              Impact

              Inhibit System Recovery

              2
              T1490

              Resource Development

              Reconnaissance

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\$Recycle.Bin\S-1-5-21-655921741-723621465-1580683668-1000\desktop.ini
                Filesize

                129B

                MD5

                a526b9e7c716b3489d8cc062fbce4005

                SHA1

                2df502a944ff721241be20a9e449d2acd07e0312

                SHA256

                e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                SHA512

                d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                Download Submit
              • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.x6unTWrSUhAEsCdtUvu6JhoEb13PG9AIHlqq24qs3j4.hive
                Filesize

                580KB

                MD5

                11bde8ba1d96eddb3d6a362d7a9e70bb

                SHA1

                374e4a9ef719b828ccfff41a564c78aa12b317eb

                SHA256

                b0e94ca6bf70e4db42b814e54a69e73a5555477989ba62cf0954985b3331619f

                SHA512

                a297afa1199a7aa023bdc735957cbec988cd9128b3ff10d5480ae6148d5435d8c05035482a16413924791d30ef345b3b65e962c9c73f0f476b0c08fa5b5a7e6b

                Download Submit
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.x6unTWrSUhAEsCdtUvu6Jtp1vLdYMpl9WiQ8P4dAsDo.hive
                Filesize

                412KB

                MD5

                b92d5fcd6e5ff24df568303d6ce17a19

                SHA1

                0df7b21eaec91b486005d3cafd3847819c4833b2

                SHA256

                7d02fa3d2d9a176552f130376e43b3c6d01c9ae7bba706531b7671459cb57149

                SHA512

                4735de1c1d2078e0edb64dbf0a092e91871ce28b76a2ceee29f81f2e7cea1e800a877c4aa8fa648562c7bd3bd1505f101a2d4e02e8ff572833a921ae38a80e39

                Download Submit
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.x6unTWrSUhAEsCdtUvu6JqJzaZqj7YI_YzY1fTQWEHA.hive
                Filesize

                14KB

                MD5

                6c859786df6ad1f3a7d8089009a02d2f

                SHA1

                eaa2fb3ad71fed46d7226b658d49ccf2b79f13f5

                SHA256

                0cb422f5616cc5a868aeb43b5ec3ecbce8f50d0202f23ce0f982199ebd58bdba

                SHA512

                468d36602e012baba1a9897f4345236c486e15f1a11622324a06dac42da9db8fb40ac9c9c78ee972ecc895513a656b6c387ca9a45244bfb1b7412b12b4f24687

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\hive.bat
                Filesize

                162B

                MD5

                fca5799115172398c63263fad7e854b1

                SHA1

                2874a1c796f511f94bed6ae020f4b20c38c59cf1

                SHA256

                27323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663

                SHA512

                a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\shadow.bat
                Filesize

                57B

                MD5

                df5552357692e0cba5e69f8fbf06abb6

                SHA1

                4714f1e6bb75a80a8faf69434726d176b70d7bd8

                SHA256

                d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                SHA512

                a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                Download Submit
              • F:\$RECYCLE.BIN\S-1-5-21-655921741-723621465-1580683668-1000\HOW_TO_DECRYPT.txt
                Filesize

                1KB

                MD5

                80207d0f8ea42bdfeaf9f5c586230aca

                SHA1

                747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

                SHA256

                25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

                SHA512

                73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

                Download Submit
              • memory/2132-6011-0x0000000002820000-0x00000000028CE000-memory.dmp
                Filesize

                696KB

                Download
              • memory/3948-4525-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-0-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-6146-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-8419-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-12246-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-1964-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-2-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-1-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-15346-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download
              • memory/3948-19821-0x0000000000DD0000-0x0000000001033000-memory.dmp
                Filesize

                2.4MB

                Download