Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

7

Resubmissions

28-07-2024 16:38

240728-t5tryssgmm 10

07-07-2024 14:07

240707-rfgd8atekm 10

07-07-2024 14:07

240707-re689awdpe 10

13-09-2022 17:54

220913-wg1lpsgbg7 10

Analysis

  • max time kernel
    837s
  • max time network
    840s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    07-07-2024 14:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/Hive_17_07_2021_808KB.exe

  • Size

    808KB

  • MD5

    504bd1695de326bc533fde29b8a69319

  • SHA1

    67f0c8d81aefcfc5943b31d695972194ac15e9f2

  • SHA256

    a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749

  • SHA512

    18c5b28bafb13edf47f6a2b803d9d9a914945f037b266a765f2a324842c5ef04ebda27eba31851d2d63e00779a42900e0edfe4ad5bd817eb4f43fa4d4e3a4767

  • SSDEEP

    24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z

Score
10/10
hivedefense_evasionexecutionimpactpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were downloaded and encrypted. To decrypt all the data or to prevent it from leakage at our website and in mass media you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: YHPvB2jr2wVr Password: XCa9f3xkQEGvXRegAz6o Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.` + config.Extension + ` files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Detects Go variant of Hive Ransomware 14 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops file in Drivers directory 29 IoCs
  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 7 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe"
    1⤵
    • Drops file in Drivers directory
    • Boot or Logon Autostart Execution: Print Processors
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\system32\cmd.exe
      cmd /c hive.bat >NUL 2>NUL
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:2720
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1772
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1708
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1912
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
          PID:764
        • C:\Windows\system32\timeout.exe
          timeout 1
          3⤵
            PID:2884
          • C:\Windows\system32\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:204
          • C:\Windows\system32\timeout.exe
            timeout 1
            3⤵
              PID:1888
            • C:\Windows\system32\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2236
            • C:\Windows\system32\timeout.exe
              timeout 1
              3⤵
                PID:568
              • C:\Windows\system32\timeout.exe
                timeout 1
                3⤵
                  PID:2768
                • C:\Windows\system32\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1088
                • C:\Windows\system32\timeout.exe
                  timeout 1
                  3⤵
                    PID:2220
                  • C:\Windows\system32\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:2588
                  • C:\Windows\system32\timeout.exe
                    timeout 1
                    3⤵
                      PID:1608
                    • C:\Windows\system32\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2748
                    • C:\Windows\system32\timeout.exe
                      timeout 1
                      3⤵
                        PID:2696
                      • C:\Windows\system32\timeout.exe
                        timeout 1
                        3⤵
                          PID:1204
                        • C:\Windows\system32\timeout.exe
                          timeout 1
                          3⤵
                            PID:748
                          • C:\Windows\system32\timeout.exe
                            timeout 1
                            3⤵
                            • Delays execution with timeout.exe
                            PID:224
                          • C:\Windows\system32\timeout.exe
                            timeout 1
                            3⤵
                            • Delays execution with timeout.exe
                            PID:1516
                          • C:\Windows\system32\timeout.exe
                            timeout 1
                            3⤵
                              PID:1748
                            • C:\Windows\system32\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:1528
                            • C:\Windows\system32\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:1204
                            • C:\Windows\system32\timeout.exe
                              timeout 1
                              3⤵
                                PID:568
                              • C:\Windows\system32\timeout.exe
                                timeout 1
                                3⤵
                                  PID:2032
                                • C:\Windows\system32\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:2892
                                  • C:\Windows\system32\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:1916
                                    • C:\Windows\system32\timeout.exe
                                      timeout 1
                                      3⤵
                                        PID:1952
                                      • C:\Windows\system32\timeout.exe
                                        timeout 1
                                        3⤵
                                        • Delays execution with timeout.exe
                                        PID:2524
                                      • C:\Windows\system32\timeout.exe
                                        timeout 1
                                        3⤵
                                          PID:2740
                                        • C:\Windows\system32\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:1036
                                        • C:\Windows\system32\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:2952
                                        • C:\Windows\system32\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:2080
                                        • C:\Windows\system32\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:2672
                                        • C:\Windows\system32\timeout.exe
                                          timeout 1
                                          3⤵
                                            PID:1676
                                          • C:\Windows\system32\timeout.exe
                                            timeout 1
                                            3⤵
                                              PID:2508
                                            • C:\Windows\system32\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:816
                                            • C:\Windows\system32\timeout.exe
                                              timeout 1
                                              3⤵
                                                PID:1452
                                              • C:\Windows\system32\timeout.exe
                                                timeout 1
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:1552
                                              • C:\Windows\system32\timeout.exe
                                                timeout 1
                                                3⤵
                                                  PID:208
                                                • C:\Windows\system32\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                    PID:2164
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:832
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                      PID:2776
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:1616
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:932
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:3064
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:2408
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:752
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:3036
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                        PID:1516
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                          PID:1896
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:1108
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:1460
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:204
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:2392
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:2596
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:3060
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                            PID:1600
                                                          • C:\Windows\system32\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:2548
                                                          • C:\Windows\system32\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                              PID:2436
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:108
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                                PID:1904
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                  PID:1992
                                                                • C:\Windows\system32\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                    PID:3044
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                      PID:2900
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                        PID:216
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:2732
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                          PID:1384
                                                                        • C:\Windows\system32\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • Delays execution with timeout.exe
                                                                          PID:232
                                                                        • C:\Windows\system32\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                            PID:2332
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:1172
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:1768
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                              PID:284
                                                                            • C:\Windows\system32\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                                PID:1792
                                                                              • C:\Windows\system32\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:2616
                                                                              • C:\Windows\system32\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                  PID:2560
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:1208
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:344
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                    PID:1284
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:2696
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                      PID:1276
                                                                                    • C:\Windows\system32\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:328
                                                                                    • C:\Windows\system32\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                        PID:1776
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                          PID:300
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:984
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:1736
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2300
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                            PID:676
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:2852
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:2832
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:2876
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                              PID:1868
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:2864
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                                PID:1396
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                  PID:1948
                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                  timeout 1
                                                                                                  3⤵
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:560
                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                  timeout 1
                                                                                                  3⤵
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:1512
                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                  timeout 1
                                                                                                  3⤵
                                                                                                    PID:1112
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    timeout 1
                                                                                                    3⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:2712
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    timeout 1
                                                                                                    3⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:980
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    timeout 1
                                                                                                    3⤵
                                                                                                      PID:2996
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      timeout 1
                                                                                                      3⤵
                                                                                                        PID:2032
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:2892
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                          PID:2948
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:1036
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:2952
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                            PID:2660
                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                            timeout 1
                                                                                                            3⤵
                                                                                                              PID:2820
                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                              timeout 1
                                                                                                              3⤵
                                                                                                                PID:1612
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:2488
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                  PID:1548
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  timeout 1
                                                                                                                  3⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:1728
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  timeout 1
                                                                                                                  3⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:2520
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  timeout 1
                                                                                                                  3⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:1884
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  timeout 1
                                                                                                                  3⤵
                                                                                                                    PID:1576
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                      PID:1528
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:2028
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                        PID:2532
                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                        timeout 1
                                                                                                                        3⤵
                                                                                                                          PID:1632
                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                          timeout 1
                                                                                                                          3⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:2136
                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                          timeout 1
                                                                                                                          3⤵
                                                                                                                            PID:2160
                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                              PID:112
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              timeout 1
                                                                                                                              3⤵
                                                                                                                                PID:1864
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd /c shadow.bat >NUL 2>NUL
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:2536
                                                                                                                              • C:\Windows\system32\vssadmin.exe
                                                                                                                                vssadmin.exe delete shadows /all /quiet
                                                                                                                                3⤵
                                                                                                                                • Interacts with shadow copies
                                                                                                                                PID:2576
                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2700

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini
                                                                                                                            Filesize

                                                                                                                            129B

                                                                                                                            MD5

                                                                                                                            97b111e7fe1dc60cfb9ca50fef009497

                                                                                                                            SHA1

                                                                                                                            d6584eade45dd13e7fe77663ef6106d2e63cf2c8

                                                                                                                            SHA256

                                                                                                                            e589e64dd9caddf5ec6d3179b57bde79116a4a5e9137872fe062fbf4be7458d6

                                                                                                                            SHA512

                                                                                                                            c20340a89fc3a4ec493a58724b46005967009d25c883cd3f3c1fead1ea5a54aa93ae5e89a767b94941310b6fad05fe3c094cf42a6f69f3d210833149044438ca

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\hive.bat
                                                                                                                            Filesize

                                                                                                                            232B

                                                                                                                            MD5

                                                                                                                            6358d970c3edccb57eae7dbf9f42d58f

                                                                                                                            SHA1

                                                                                                                            25b994c3b5604f4f67e1ac6250bc2f14ce690380

                                                                                                                            SHA256

                                                                                                                            9e36401051e677f69a82ab8fbdebd6b16210ee40612c8c7fa45ceb5d7757fe50

                                                                                                                            SHA512

                                                                                                                            44819fec7e90b903eece750d0a2de531520ed9e637e17e4a57786f9a61c6d4b95ff6072fc3530a9d35d8dc756bcfe20f80a6a07a72d35cf24b305053ae389131

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\shadow.bat
                                                                                                                            Filesize

                                                                                                                            57B

                                                                                                                            MD5

                                                                                                                            df5552357692e0cba5e69f8fbf06abb6

                                                                                                                            SHA1

                                                                                                                            4714f1e6bb75a80a8faf69434726d176b70d7bd8

                                                                                                                            SHA256

                                                                                                                            d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                                                                                                                            SHA512

                                                                                                                            a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                                                                                                                            Download Submit

                                                                                                                          • F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\HOW_TO_DECRYPT.txt
                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            ee4ad142674725d6d9b58c9c3bb836dc

                                                                                                                            SHA1

                                                                                                                            ac9bac37131c72a549d2bf3fbd233061906d5fab

                                                                                                                            SHA256

                                                                                                                            fc1f1ed6a6692d18788de47420ead7e8a1b534b015db69a39052a0a2fc30c776

                                                                                                                            SHA512

                                                                                                                            a34c547d13880b578703f52b7d3d61b1893536966204d80a9e0f60aee8851bd9f70e3d0ceb1601aa11901c6315f57128c49f2000cc4fcbc67ed92e4628e45da3

                                                                                                                            Download Submit

                                                                                                                          • memory/1856-560-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11910-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-3491-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-4375-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-0-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-8367-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11905-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-954-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11917-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11926-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11933-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11941-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11947-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-11973-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download

                                                                                                                          • memory/1856-12001-0x0000000000CB0000-0x0000000000F89000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            2.8MB

                                                                                                                            Download