Overview

overview

10

Static

static

7

211xahcou.exe

windows7-x64

10

211xahcou.exe

windows10-1703-x64

10

Hive.elf

windows7-x64

3

Hive.elf

windows10-1703-x64

3

hive.exe

windows7-x64

10

hive.exe

windows10-1703-x64

10

hive_linux_elf

windows7-x64

1

hive_linux_elf

windows10-1703-x64

1

linux_hive.elf

windows7-x64

3

linux_hive.elf

windows10-1703-x64

3

sjl8j6ap3.exe

windows7-x64

1

sjl8j6ap3.exe

windows10-1703-x64

1

windows_25...c5.exe

windows7-x64

10

windows_25...c5.exe

windows10-1703-x64

10

zi1ysv64h.exe

windows7-x64

10

zi1ysv64h.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    130s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-02-2024 07:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hive.exe

  • Size

    764KB

  • MD5

    2f9fc82898d718f2abe99c4a6fa79e69

  • SHA1

    9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

  • SHA256

    88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

  • SHA512

    19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

  • SSDEEP

    12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score
10/10
hivepersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Detects Go variant of Hive Ransomware 15 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Drops file in Drivers directory 18 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\hive.exe
    "C:\Users\Admin\AppData\Local\Temp\hive.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
          PID:780
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
            PID:820
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:4692
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
              PID:4232
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4976
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2332
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:3424
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:3232
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4232
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
                PID:2084
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:3988
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2472
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                  PID:2244
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1112
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                    PID:2384
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:628
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3024
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:516
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                      PID:816
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                        PID:1052
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • Delays execution with timeout.exe
                        PID:360
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • Delays execution with timeout.exe
                        PID:2828
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • Delays execution with timeout.exe
                        PID:2180
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                          PID:4288
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                            PID:4432
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                            • Delays execution with timeout.exe
                            PID:3548
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                              PID:4804
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                                PID:1604
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:1720
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:360
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                  PID:2552
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:4224
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:1396
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:528
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:444
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                        PID:2852
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                          PID:2748
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                            PID:2388
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                              PID:4124
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:3248
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:240
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                                PID:444
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:4540
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                  PID:1604
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:3548
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                    PID:704
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                      PID:4272
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:4168
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                        PID:1988
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:2836
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3752
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                          PID:3764
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:5000
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                            PID:3964
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:3908
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                              PID:2396
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                                PID:3512
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:208
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:3552
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                  PID:4768
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:2068
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                    PID:3884
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                      PID:4428
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:1928
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:1720
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                        PID:1532
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                          PID:4568
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                            PID:2984
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:3168
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                              PID:4324
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:5088
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:1080
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:4404
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                                PID:3612
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:2732
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:368
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                  PID:3464
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                    PID:236
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                      PID:3352
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:4048
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:3688
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                        PID:4040
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                          PID:4076
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:1936
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                            PID:3480
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                              PID:4556
                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                                PID:4156
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:3836
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                  PID:2280
                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                  timeout 1
                                                                                                  3⤵
                                                                                                    PID:2420
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 1
                                                                                                    3⤵
                                                                                                      PID:1884
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 1
                                                                                                      3⤵
                                                                                                        PID:4500
                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                          PID:1668
                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:2980
                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                            PID:4824
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout 1
                                                                                                            3⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:2244
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout 1
                                                                                                            3⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:3828
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout 1
                                                                                                            3⤵
                                                                                                              PID:3584
                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                              timeout 1
                                                                                                              3⤵
                                                                                                                PID:3216
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:204
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:4124
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:3760
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:3424
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:4564
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                  PID:4592
                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                  timeout 1
                                                                                                                  3⤵
                                                                                                                    PID:2944
                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                      PID:3812
                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                        PID:4400
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout 1
                                                                                                                        3⤵
                                                                                                                          PID:4464
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 1
                                                                                                                          3⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:1896
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 1
                                                                                                                          3⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:4144
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 1
                                                                                                                          3⤵
                                                                                                                            PID:2068
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:396
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:2384
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:428
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:4004
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:2468
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:4436
                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                              PID:4376
                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                              timeout 1
                                                                                                                              3⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:516
                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                              timeout 1
                                                                                                                              3⤵
                                                                                                                                PID:5040
                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                timeout 1
                                                                                                                                3⤵
                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                PID:520
                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                timeout 1
                                                                                                                                3⤵
                                                                                                                                  PID:4768
                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                  timeout 1
                                                                                                                                  3⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:3964
                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                  timeout 1
                                                                                                                                  3⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:1848
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
                                                                                                                                2⤵
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2892
                                                                                                                                • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                                                  vssadmin.exe delete shadows /all /quiet
                                                                                                                                  3⤵
                                                                                                                                  • Interacts with shadow copies
                                                                                                                                  PID:1052
                                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2644
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                              • Modifies registry class
                                                                                                                              PID:4700
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                                                                                                              1⤵
                                                                                                                              • Enumerates system info in registry
                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:2988

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                            Initial Access

                                                                                                                            Execution

                                                                                                                            Persistence

                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                            1
                                                                                                                            T1547

                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                            1
                                                                                                                            T1547.001

                                                                                                                            Privilege Escalation

                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                            1
                                                                                                                            T1547

                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                            1
                                                                                                                            T1547.001

                                                                                                                            Defense Evasion

                                                                                                                            Indicator Removal

                                                                                                                            2
                                                                                                                            T1070

                                                                                                                            File Deletion

                                                                                                                            2
                                                                                                                            T1070.004

                                                                                                                            Modify Registry

                                                                                                                            2
                                                                                                                            T1112

                                                                                                                            Credential Access

                                                                                                                            Unsecured Credentials

                                                                                                                            1
                                                                                                                            T1552

                                                                                                                            Credentials In Files

                                                                                                                            1
                                                                                                                            T1552.001

                                                                                                                            Discovery

                                                                                                                            Query Registry

                                                                                                                            3
                                                                                                                            T1012

                                                                                                                            Peripheral Device Discovery

                                                                                                                            1
                                                                                                                            T1120

                                                                                                                            System Information Discovery

                                                                                                                            2
                                                                                                                            T1082

                                                                                                                            Lateral Movement

                                                                                                                            Collection

                                                                                                                            Data from Local System

                                                                                                                            1
                                                                                                                            T1005

                                                                                                                            Exfiltration

                                                                                                                            Command and Control

                                                                                                                            Impact

                                                                                                                            Inhibit System Recovery

                                                                                                                            2
                                                                                                                            T1490

                                                                                                                            Resource Development

                                                                                                                            Reconnaissance

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\$Recycle.Bin\HOW_TO_DECRYPT.txt
                                                                                                                              Filesize

                                                                                                                              1KB

                                                                                                                              MD5

                                                                                                                              80207d0f8ea42bdfeaf9f5c586230aca

                                                                                                                              SHA1

                                                                                                                              747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

                                                                                                                              SHA256

                                                                                                                              25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

                                                                                                                              SHA512

                                                                                                                              73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

                                                                                                                              Download Submit
                                                                                                                            • C:\$Recycle.Bin\S-1-5-21-3934047325-4097474570-3437169968-1000\desktop.ini
                                                                                                                              Filesize

                                                                                                                              129B

                                                                                                                              MD5

                                                                                                                              35167ab7882cfa0e57e29cb8201de1ed

                                                                                                                              SHA1

                                                                                                                              bb817bf693d4a3039e8a8ddd241b72b3d9fd0be2

                                                                                                                              SHA256

                                                                                                                              16f85f183000004a26e46fdf09808ce127778cf0879f0e1b51f41a105ee327ae

                                                                                                                              SHA512

                                                                                                                              ca43e4d56171769eae429a910b70686f959d7c53c8a269a1b5b1e3413ff2dbdded267db2f2e91d90e8f19b7f20a70dd1d085ce19a23814883b6948fa7fadb7c1

                                                                                                                              Download Submit
                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SQWB85W4\microsoft.windows[1].xml
                                                                                                                              Filesize

                                                                                                                              97B

                                                                                                                              MD5

                                                                                                                              ffc33ad51339acd282862b996a5c30ce

                                                                                                                              SHA1

                                                                                                                              9ad8953d49c5005e239792c73c93879dd392a548

                                                                                                                              SHA256

                                                                                                                              253b640f28d7547188f664dc786145a539e41bf3e299621f90910ba358ff9634

                                                                                                                              SHA512

                                                                                                                              4f90205bebb6afbf8656b88e1adcea65ffcf894ba4aa5af0ac89b7fdcbb6fb089a851a88fa099e42f247402fe88c8db5645956c364939c4d1f0ea845762b5385

                                                                                                                              Download Submit
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hive.bat
                                                                                                                              Filesize

                                                                                                                              162B

                                                                                                                              MD5

                                                                                                                              fca5799115172398c63263fad7e854b1

                                                                                                                              SHA1

                                                                                                                              2874a1c796f511f94bed6ae020f4b20c38c59cf1

                                                                                                                              SHA256

                                                                                                                              27323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663

                                                                                                                              SHA512

                                                                                                                              a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b

                                                                                                                              Download Submit
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\shadow.bat
                                                                                                                              Filesize

                                                                                                                              57B

                                                                                                                              MD5

                                                                                                                              df5552357692e0cba5e69f8fbf06abb6

                                                                                                                              SHA1

                                                                                                                              4714f1e6bb75a80a8faf69434726d176b70d7bd8

                                                                                                                              SHA256

                                                                                                                              d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                                                                                                                              SHA512

                                                                                                                              a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                                                                                                                              Download Submit
                                                                                                                            • memory/2196-21367-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-16201-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-3005-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-5109-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-7663-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-13495-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-21396-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-21393-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-1-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-2-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-21383-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-19930-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-21363-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-0-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-21371-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2196-21376-0x0000000000160000-0x00000000003C3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              2.4MB

                                                                                                                              Download
                                                                                                                            • memory/2988-14105-0x000001E9AA540000-0x000001E9AA560000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download
                                                                                                                            • memory/2988-14100-0x000001E9AA3C0000-0x000001E9AA3E0000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download
                                                                                                                            • memory/4700-16824-0x00007FF8849C0000-0x00007FF8849F3000-memory.dmp
                                                                                                                              Filesize

                                                                                                                              204KB

                                                                                                                              Download