Analysis
-
max time kernel
123s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-03-2024 10:02
Behavioral task
behavioral1
Sample
211xahcou.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hive.elf
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
hive.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
hive_linux_elf
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
linux_hive.elf
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
sjl8j6ap3.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
General
-
Target
hive.exe
-
Size
764KB
-
MD5
2f9fc82898d718f2abe99c4a6fa79e69
-
SHA1
9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
-
SHA256
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
-
SHA512
19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
-
SSDEEP
12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH
Score
10/10
Malware Config
Extracted
Path
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\HOW_TO_DECRYPT.txt
Family
hive
Ransom Note
Your network has been breached and all data is encrypted.
To decrypt all the data you will need to purchase our decryption software.
Please contact our sales department at:
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Login: EQA9oydTxwXS
Password: vNtgAgb3kMFmCooANNQr
Follow the guidelines below to avoid losing your data:
- Do not shutdown or reboot your computers, unmount external storages.
- Do not try to decrypt data using third party software. It may cause irreversible damage.
- Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key.
- Do not modify, rename or delete *.key.hive files. Your data will be undecryptable.
- Do not modify or rename encrypted files. You will lose them.
- Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased.
- Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Signatures
-
Detects Go variant of Hive Ransomware 13 IoCs
resource yara_rule behavioral3/memory/2020-1-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-2-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-3-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-748-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-1794-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-3019-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-4395-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-5150-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-6297-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-7844-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-8476-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-9601-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go behavioral3/memory/2020-12499-0x0000000001240000-0x00000000014A3000-memory.dmp hive_go -
Hive
A ransomware written in Golang first seen in June 2021.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Drivers directory 28 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt hive.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini hive.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral3/memory/2020-0-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-1-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-2-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-3-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-748-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-1794-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-3019-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-4395-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-5150-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-6297-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-7844-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-8476-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-9601-0x0000000001240000-0x00000000014A3000-memory.dmp upx behavioral3/memory/2020-12499-0x0000000001240000-0x00000000014A3000-memory.dmp upx -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AS4I30IR\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini hive.exe File opened for modification C:\Users\Public\Downloads\desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini hive.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini hive.exe File opened for modification C:\Users\Admin\Videos\desktop.ini hive.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Music\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2Y0HPGOE\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JP38OXIN\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini hive.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZPJ6IGS\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini hive.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini hive.exe File opened for modification C:\Users\Public\Libraries\desktop.ini hive.exe File opened for modification C:\Users\Public\Pictures\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini hive.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini hive.exe File opened for modification C:\Users\Public\Videos\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini hive.exe File opened for modification C:\Users\Admin\Searches\desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini hive.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\266EQP1S\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BB0Z8TKM\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini hive.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini hive.exe File opened for modification C:\Users\Public\Desktop\desktop.ini hive.exe File opened for modification C:\Users\Public\Documents\desktop.ini hive.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini hive.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini hive.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini hive.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini hive.exe File opened for modification C:\Users\Public\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini hive.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1OEGTYQG\desktop.ini hive.exe File opened for modification C:\Program Files\desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini hive.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini hive.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\prnlx00b.inf_amd64_neutral_89b555703683b583\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumN\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\slmgr\0411\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_neutral_061c61abd3904560\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_neutral_8b26ad5d0cc037a9\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\Temp\{522f6bf6-ae20-0f66-d982-a746d010852a}\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\NetworkList\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\WCN\es-ES\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_neutral_46f466c9e68abb4a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0008\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-DTC-Setup-DL\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseE\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\001b\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseN\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasic\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\config\Journal\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Ultimate\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_neutral_213e93b5ced8b0fe\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_neutral_54f2470c084714e1\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-msmq-messagingcoreservice\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\Setup\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\com\dmp\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc005.inf_amd64_neutral_31e08a1c2f933124\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmcom.inf_amd64_neutral_716a306ec3899e04\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0009\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\config\RegBack\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\Professional\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00y.inf_amd64_neutral_64560c72e81f6ad7\Amd64\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-activedirectory-webservices\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\UltimateE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\hcw85b64.inf_amd64_neutral_22b436d5d06ab017\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_neutral_4443b423d18c3ffc\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0006\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\uk-UA\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0013\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpn1.inf_amd64_neutral_e44cc033b67e7d04\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\ProfessionalE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsonyu.inf_amd64_neutral_45152a8a9362fb82\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-international-core\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\Ultimate\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\mf.inf_amd64_neutral_b263d46928b97a9b\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc11.inf_amd64_neutral_bb18e5f134c40c68\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremiumN\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremium\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_neutral_1a5c861fdb3aab0e\HOW_TO_DECRYPT.txt hive.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152698.WMF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187883.WMF hive.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21325_.GIF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.E3_KdgLOrUBefL0O28FKFLM8U1wcFikTirYW-SL1Txc.hive hive.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt hive.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png hive.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5B.BDR hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF.E3_KdgLOrUBefL0O28FKFLSb5FUYXzMhuKb-kQfsjkM.hive hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.E3_KdgLOrUBefL0O28FKFN5CiC3J_xQIS8C9nl7oUHE.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00828_.WMF hive.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\library.js hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID.E3_KdgLOrUBefL0O28FKFMaOusqmlnNYBVophEsPLSM.hive hive.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg hive.exe File opened for modification C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jni.h hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar hive.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00411_.WMF.E3_KdgLOrUBefL0O28FKFEJi1uAo6AYxjCxr6w4T9nQ.hive hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.E3_KdgLOrUBefL0O28FKFHWpSOn9IiwQlaIrB0U0jVc.hive hive.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199307.WMF.E3_KdgLOrUBefL0O28FKFMcv5U8Ylbp1lkwdUmxT41o.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01636_.WMF.E3_KdgLOrUBefL0O28FKFONPvXeBSSNpqMlfMPr_SHc.hive hive.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg hive.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.E3_KdgLOrUBefL0O28FKFJAd65y2QORhvKPZA4qNY10.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239057.WMF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.VN.XML hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BS4BOXES.POC hive.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\10.png hive.exe File opened for modification C:\Program Files\Java\jre7\lib\security\trusted.libraries hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.E3_KdgLOrUBefL0O28FKFP2GG1yjQVMqJr34cAN7ey8.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR23F.GIF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232803.WMF.E3_KdgLOrUBefL0O28FKFKYcpXyw3Co3LIPaz7Z86Cw.hive hive.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS hive.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.E3_KdgLOrUBefL0O28FKFHmiT0zExRMZ1XZ4G-IHVxg.hive hive.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.E3_KdgLOrUBefL0O28FKFBQHZEcCAMMxZvGPXySDuTI.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107728.WMF.E3_KdgLOrUBefL0O28FKFFv0xJJt3t4ElbKREpG0dhY.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02448_.WMF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21334_.GIF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif hive.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.E3_KdgLOrUBefL0O28FKFHofIoZR8QkF04CbPnUpxVw.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341499.JPG.E3_KdgLOrUBefL0O28FKFN_17ZNCAGljppzhXw4MUkM.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02058U.BMP.E3_KdgLOrUBefL0O28FKFL_AcDFDs9kxBhqkbGrTvE8.hive hive.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.E3_KdgLOrUBefL0O28FKFC4m3RbaZUUj8OSkTlpZ7HY.hive hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.E3_KdgLOrUBefL0O28FKFLNKF1N9mIR66nI_tS8z3hQ.hive hive.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.E3_KdgLOrUBefL0O28FKFDNorX2ZwC0uCgoQzVFk0lo.hive hive.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll hive.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.E3_KdgLOrUBefL0O28FKFFkvvrZOHjho5Bgxn_V2AQI.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG.E3_KdgLOrUBefL0O28FKFNdXBNz6nJdWVxjont0KwyI.hive hive.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif hive.exe File created C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\HOW_TO_DECRYPT.txt hive.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.E3_KdgLOrUBefL0O28FKFPD80Y6GcRxaTwDCHvBVSgQ.hive hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF hive.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE hive.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\es-ES\sbdrop.dll.mui hive.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif.E3_KdgLOrUBefL0O28FKFCWQqGAc1DtXd3yB56S8Y14.hive hive.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_es_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\system.servicemodel.resources\3.0.0.0_de_b77a5c561934e089\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MOF\de\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.NetworkInformation\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiiTv\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\b34cda03a984c515b31faf410e5b7e39\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Boot\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Branding\Basebrd\fr-FR\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\it\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Acti2661942e#\84846480d6281bf831a97d07f712d09e\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\napinit.resources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\e2642bff810609f64343e53dddb6b59c\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Help\mui\0407\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.resources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\mcstore\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Help\Windows\en-US\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_fr_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad18f93fc713db2c4b29b25116c13bd8\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Globalization\ELS\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_fr_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Primitives\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.resources\3.5.0.0_it_b77a5c561934e089\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9a3ab1594cf5cd52f0794b0a93a14b57\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data.Entity\84467aa24019da88d4aece177e51a223\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\es\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_ja_b77a5c561934e089\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.resources\2.0.0.0_de_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_de_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ehRecObj\dd75e74b3a7686f661129df07fdeadf1\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Principal\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data.Entity\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\UIAutomationClient\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\assembly\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\PolicyDefinitions\de-DE\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\fr\HOW_TO_DECRYPT.txt hive.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_de_31bf3856ad364e35\HOW_TO_DECRYPT.txt hive.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 2556 timeout.exe 1588 timeout.exe 2436 timeout.exe 2600 timeout.exe 2276 timeout.exe 1120 timeout.exe 2736 timeout.exe 2468 timeout.exe 1036 timeout.exe 2220 timeout.exe 3020 timeout.exe 1076 timeout.exe 340 timeout.exe 656 timeout.exe 2004 timeout.exe 596 timeout.exe 2528 timeout.exe 2104 timeout.exe 1584 timeout.exe 2256 timeout.exe 2916 timeout.exe 1916 timeout.exe 964 timeout.exe 964 timeout.exe 436 timeout.exe 2460 timeout.exe 1384 timeout.exe 2504 timeout.exe 1936 timeout.exe 2044 timeout.exe 1852 timeout.exe 1248 timeout.exe 2484 timeout.exe 2716 timeout.exe 620 timeout.exe 744 timeout.exe 2212 timeout.exe 1780 timeout.exe 1120 timeout.exe 2036 timeout.exe 2676 timeout.exe 1644 timeout.exe 1280 timeout.exe 2916 timeout.exe 2712 timeout.exe 1652 timeout.exe 1784 timeout.exe 1724 timeout.exe 2072 timeout.exe 1488 timeout.exe 2088 timeout.exe 2732 timeout.exe 1708 timeout.exe 1952 timeout.exe 2824 timeout.exe 2844 timeout.exe 1604 timeout.exe 1304 timeout.exe 2120 timeout.exe 564 timeout.exe 2028 timeout.exe 3008 timeout.exe 2212 timeout.exe 2076 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1916 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2020 hive.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2444 vssvc.exe Token: SeRestorePrivilege 2444 vssvc.exe Token: SeAuditPrivilege 2444 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2544 2020 hive.exe 28 PID 2020 wrote to memory of 2544 2020 hive.exe 28 PID 2020 wrote to memory of 2544 2020 hive.exe 28 PID 2020 wrote to memory of 2544 2020 hive.exe 28 PID 2020 wrote to memory of 2808 2020 hive.exe 30 PID 2020 wrote to memory of 2808 2020 hive.exe 30 PID 2020 wrote to memory of 2808 2020 hive.exe 30 PID 2020 wrote to memory of 2808 2020 hive.exe 30 PID 2808 wrote to memory of 1916 2808 cmd.exe 33 PID 2808 wrote to memory of 1916 2808 cmd.exe 33 PID 2808 wrote to memory of 1916 2808 cmd.exe 33 PID 2808 wrote to memory of 1916 2808 cmd.exe 33 PID 2544 wrote to memory of 2436 2544 cmd.exe 32 PID 2544 wrote to memory of 2436 2544 cmd.exe 32 PID 2544 wrote to memory of 2436 2544 cmd.exe 32 PID 2544 wrote to memory of 2436 2544 cmd.exe 32 PID 2544 wrote to memory of 2088 2544 cmd.exe 35 PID 2544 wrote to memory of 2088 2544 cmd.exe 35 PID 2544 wrote to memory of 2088 2544 cmd.exe 35 PID 2544 wrote to memory of 2088 2544 cmd.exe 35 PID 2544 wrote to memory of 564 2544 cmd.exe 36 PID 2544 wrote to memory of 564 2544 cmd.exe 36 PID 2544 wrote to memory of 564 2544 cmd.exe 36 PID 2544 wrote to memory of 564 2544 cmd.exe 36 PID 2544 wrote to memory of 1036 2544 cmd.exe 37 PID 2544 wrote to memory of 1036 2544 cmd.exe 37 PID 2544 wrote to memory of 1036 2544 cmd.exe 37 PID 2544 wrote to memory of 1036 2544 cmd.exe 37 PID 2544 wrote to memory of 884 2544 cmd.exe 38 PID 2544 wrote to memory of 884 2544 cmd.exe 38 PID 2544 wrote to memory of 884 2544 cmd.exe 38 PID 2544 wrote to memory of 884 2544 cmd.exe 38 PID 2544 wrote to memory of 2724 2544 cmd.exe 39 PID 2544 wrote to memory of 2724 2544 cmd.exe 39 PID 2544 wrote to memory of 2724 2544 cmd.exe 39 PID 2544 wrote to memory of 2724 2544 cmd.exe 39 PID 2544 wrote to memory of 1968 2544 cmd.exe 42 PID 2544 wrote to memory of 1968 2544 cmd.exe 42 PID 2544 wrote to memory of 1968 2544 cmd.exe 42 PID 2544 wrote to memory of 1968 2544 cmd.exe 42 PID 2544 wrote to memory of 2256 2544 cmd.exe 43 PID 2544 wrote to memory of 2256 2544 cmd.exe 43 PID 2544 wrote to memory of 2256 2544 cmd.exe 43 PID 2544 wrote to memory of 2256 2544 cmd.exe 43 PID 2544 wrote to memory of 2220 2544 cmd.exe 44 PID 2544 wrote to memory of 2220 2544 cmd.exe 44 PID 2544 wrote to memory of 2220 2544 cmd.exe 44 PID 2544 wrote to memory of 2220 2544 cmd.exe 44 PID 2544 wrote to memory of 2044 2544 cmd.exe 45 PID 2544 wrote to memory of 2044 2544 cmd.exe 45 PID 2544 wrote to memory of 2044 2544 cmd.exe 45 PID 2544 wrote to memory of 2044 2544 cmd.exe 45 PID 2544 wrote to memory of 2028 2544 cmd.exe 46 PID 2544 wrote to memory of 2028 2544 cmd.exe 46 PID 2544 wrote to memory of 2028 2544 cmd.exe 46 PID 2544 wrote to memory of 2028 2544 cmd.exe 46 PID 2544 wrote to memory of 3008 2544 cmd.exe 47 PID 2544 wrote to memory of 3008 2544 cmd.exe 47 PID 2544 wrote to memory of 3008 2544 cmd.exe 47 PID 2544 wrote to memory of 3008 2544 cmd.exe 47 PID 2544 wrote to memory of 2636 2544 cmd.exe 48 PID 2544 wrote to memory of 2636 2544 cmd.exe 48 PID 2544 wrote to memory of 2636 2544 cmd.exe 48 PID 2544 wrote to memory of 2636 2544 cmd.exe 48 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\hive.exe"C:\Users\Admin\AppData\Local\Temp\hive.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.execmd /c hive.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2436
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2088
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:564
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1036
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:884
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2724
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1968
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2256
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2220
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2044
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2028
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3008
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2636
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2676
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2212
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2716
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1724
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2916
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1852
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3020
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1604
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1304
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2600
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2072
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1780
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:596
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1620
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:620
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2916
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:744
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2828
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1724
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1076
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1248
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1644
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:964
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2712
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2460
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1952
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1280
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1496
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1900
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1916
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1384
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1292
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2472
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1956
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2076
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2120
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2236
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2916
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2076
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2824
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2504
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2152
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2280
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2732
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1120
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1808
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2880
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:3048
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:656
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1616
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1740
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2276
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2628
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2556
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1588
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2220
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:964
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1652
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:528
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1936
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2296
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:824
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2732
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:748
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2996
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1120
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2036
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2104
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2736
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:2556
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1784
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1708
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:480
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2468
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2844
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2528
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵PID:1684
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1488
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2484
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2004
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2212
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:340
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1936
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:436
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shadow.bat >NUL 2>NUL2⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1916
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD581325d230e265adcf8ee9b909f1cf244
SHA1ff250f79af0d0fcd86513cb5f7021988f4938f4a
SHA25630990f0098bc9c403bf9bce5532b3b5bcfacab44cecf7beced808f4d4796cc71
SHA512234d1fce652032d0f11efc2b50a75bd0c5ce4670415d3556ede0bf76ef996b23e965e172588af6246392da3f1c2741b6e67b9a2a4923aad03cd5fd1026c2787c
-
Filesize
162B
MD5fca5799115172398c63263fad7e854b1
SHA12874a1c796f511f94bed6ae020f4b20c38c59cf1
SHA25627323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663
SHA512a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b
-
Filesize
57B
MD5df5552357692e0cba5e69f8fbf06abb6
SHA14714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d
-
Filesize
1KB
MD580207d0f8ea42bdfeaf9f5c586230aca
SHA1747481fe2b0b6d81c3b19ba62d1e49eab6a5461f
SHA25625edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131
SHA51273f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304