Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

7

Resubmissions

28-07-2024 16:38

240728-t5tryssgmm 10

07-07-2024 14:07

240707-rfgd8atekm 10

07-07-2024 14:07

240707-re689awdpe 10

13-09-2022 17:54

220913-wg1lpsgbg7 10

Analysis

  • max time kernel
    143s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    28-07-2024 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/Hive_17_07_2021_808KB.exe

  • Size

    808KB

  • MD5

    504bd1695de326bc533fde29b8a69319

  • SHA1

    67f0c8d81aefcfc5943b31d695972194ac15e9f2

  • SHA256

    a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749

  • SHA512

    18c5b28bafb13edf47f6a2b803d9d9a914945f037b266a765f2a324842c5ef04ebda27eba31851d2d63e00779a42900e0edfe4ad5bd817eb4f43fa4d4e3a4767

  • SSDEEP

    24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z

Score
10/10
hivecredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were downloaded and encrypted. To decrypt all the data or to prevent it from leakage at our website and in mass media you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: YHPvB2jr2wVr Password: XCa9f3xkQEGvXRegAz6o Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.` + config.Extension + ` files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Detects Go variant of Hive Ransomware 15 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops file in Drivers directory 29 IoCs
  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 7 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe"
    1⤵
    • Drops file in Drivers directory
    • Boot or Logon Autostart Execution: Print Processors
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Windows\system32\cmd.exe
      cmd /c hive.bat >NUL 2>NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:2752
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
          PID:2968
        • C:\Windows\system32\timeout.exe
          timeout 1
          3⤵
            PID:2144
          • C:\Windows\system32\timeout.exe
            timeout 1
            3⤵
              PID:2088
            • C:\Windows\system32\timeout.exe
              timeout 1
              3⤵
                PID:2156
              • C:\Windows\system32\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:2024
              • C:\Windows\system32\timeout.exe
                timeout 1
                3⤵
                  PID:1692
                • C:\Windows\system32\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:2572
                • C:\Windows\system32\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1052
                • C:\Windows\system32\timeout.exe
                  timeout 1
                  3⤵
                    PID:2180
                  • C:\Windows\system32\timeout.exe
                    timeout 1
                    3⤵
                      PID:324
                    • C:\Windows\system32\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2288
                    • C:\Windows\system32\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2888
                    • C:\Windows\system32\timeout.exe
                      timeout 1
                      3⤵
                        PID:2552
                      • C:\Windows\system32\timeout.exe
                        timeout 1
                        3⤵
                          PID:2988
                        • C:\Windows\system32\timeout.exe
                          timeout 1
                          3⤵
                            PID:1296
                          • C:\Windows\system32\timeout.exe
                            timeout 1
                            3⤵
                              PID:212
                            • C:\Windows\system32\timeout.exe
                              timeout 1
                              3⤵
                                PID:1452
                              • C:\Windows\system32\timeout.exe
                                timeout 1
                                3⤵
                                  PID:2972
                                • C:\Windows\system32\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:2288
                                  • C:\Windows\system32\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:1036
                                  • C:\Windows\system32\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:2440
                                  • C:\Windows\system32\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:3032
                                  • C:\Windows\system32\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:2288
                                    • C:\Windows\system32\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:2012
                                    • C:\Windows\system32\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:940
                                    • C:\Windows\system32\timeout.exe
                                      timeout 1
                                      3⤵
                                        PID:840
                                      • C:\Windows\system32\timeout.exe
                                        timeout 1
                                        3⤵
                                        • Delays execution with timeout.exe
                                        PID:2828
                                      • C:\Windows\system32\timeout.exe
                                        timeout 1
                                        3⤵
                                          PID:1036
                                        • C:\Windows\system32\timeout.exe
                                          timeout 1
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:2652
                                        • C:\Windows\system32\timeout.exe
                                          timeout 1
                                          3⤵
                                            PID:1620
                                          • C:\Windows\system32\timeout.exe
                                            timeout 1
                                            3⤵
                                              PID:2896
                                            • C:\Windows\system32\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:1544
                                            • C:\Windows\system32\timeout.exe
                                              timeout 1
                                              3⤵
                                                PID:1760
                                              • C:\Windows\system32\timeout.exe
                                                timeout 1
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:856
                                              • C:\Windows\system32\timeout.exe
                                                timeout 1
                                                3⤵
                                                  PID:2912
                                                • C:\Windows\system32\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:1352
                                                • C:\Windows\system32\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                    PID:2668
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:1696
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                      PID:2500
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                        PID:2828
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:2868
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:924
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:2272
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                          PID:2608
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:1232
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                            PID:1616
                                                          • C:\Windows\system32\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                              PID:920
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:2688
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:2972
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                                PID:1724
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                  PID:3056
                                                                • C:\Windows\system32\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:1452
                                                                • C:\Windows\system32\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                    PID:1816
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                      PID:1288
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:1720
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:804
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:3036
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                        PID:1920
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:2612
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                          PID:1708
                                                                        • C:\Windows\system32\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • Delays execution with timeout.exe
                                                                          PID:880
                                                                        • C:\Windows\system32\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                            PID:2712
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:2704
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:2184
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:2924
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                              PID:552
                                                                            • C:\Windows\system32\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:2860
                                                                            • C:\Windows\system32\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:1988
                                                                            • C:\Windows\system32\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                                PID:2084
                                                                              • C:\Windows\system32\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                  PID:1288
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                    PID:1336
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:856
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                      PID:2900
                                                                                    • C:\Windows\system32\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:1720
                                                                                    • C:\Windows\system32\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:1916
                                                                                    • C:\Windows\system32\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                        PID:2352
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:1092
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                          PID:2472
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2132
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2124
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2364
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                            PID:3020
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:2916
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                              PID:2508
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:2608
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:2336
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:2112
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                                PID:2056
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                  PID:204
                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                  timeout 1
                                                                                                  3⤵
                                                                                                    PID:224
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    timeout 1
                                                                                                    3⤵
                                                                                                      PID:2692
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      timeout 1
                                                                                                      3⤵
                                                                                                        PID:992
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:2428
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        timeout 1
                                                                                                        3⤵
                                                                                                          PID:2520
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:2632
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          timeout 1
                                                                                                          3⤵
                                                                                                            PID:1784
                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                            timeout 1
                                                                                                            3⤵
                                                                                                              PID:2140
                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                              timeout 1
                                                                                                              3⤵
                                                                                                                PID:1676
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                timeout 1
                                                                                                                3⤵
                                                                                                                  PID:2772
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  timeout 1
                                                                                                                  3⤵
                                                                                                                    PID:604
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:108
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:1372
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout 1
                                                                                                                    3⤵
                                                                                                                      PID:1652
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:1284
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      timeout 1
                                                                                                                      3⤵
                                                                                                                        PID:1232
                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                        timeout 1
                                                                                                                        3⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:2436
                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                        timeout 1
                                                                                                                        3⤵
                                                                                                                          PID:1584
                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                          timeout 1
                                                                                                                          3⤵
                                                                                                                            PID:3036
                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                            timeout 1
                                                                                                                            3⤵
                                                                                                                              PID:2868
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              timeout 1
                                                                                                                              3⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:2096
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              timeout 1
                                                                                                                              3⤵
                                                                                                                                PID:108
                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                timeout 1
                                                                                                                                3⤵
                                                                                                                                  PID:552
                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                  timeout 1
                                                                                                                                  3⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:1712
                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                  timeout 1
                                                                                                                                  3⤵
                                                                                                                                    PID:2964
                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                    timeout 1
                                                                                                                                    3⤵
                                                                                                                                      PID:2552
                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                      timeout 1
                                                                                                                                      3⤵
                                                                                                                                        PID:940
                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                        timeout 1
                                                                                                                                        3⤵
                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                        PID:1420
                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                        timeout 1
                                                                                                                                        3⤵
                                                                                                                                          PID:1284
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout 1
                                                                                                                                          3⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:2264
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout 1
                                                                                                                                          3⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:2908
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout 1
                                                                                                                                          3⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:636
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout 1
                                                                                                                                          3⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:556
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout 1
                                                                                                                                          3⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:1664
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout 1
                                                                                                                                          3⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:3056
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout 1
                                                                                                                                          3⤵
                                                                                                                                            PID:2168
                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                            timeout 1
                                                                                                                                            3⤵
                                                                                                                                              PID:1972
                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                              timeout 1
                                                                                                                                              3⤵
                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                              PID:768
                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                              timeout 1
                                                                                                                                              3⤵
                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                              PID:1696
                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                              timeout 1
                                                                                                                                              3⤵
                                                                                                                                                PID:2924
                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                timeout 1
                                                                                                                                                3⤵
                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                PID:2156
                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                timeout 1
                                                                                                                                                3⤵
                                                                                                                                                  PID:1544
                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                  timeout 1
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2576
                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                    timeout 1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2184
                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                      timeout 1
                                                                                                                                                      3⤵
                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                      PID:2960
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    cmd /c shadow.bat >NUL 2>NUL
                                                                                                                                                    2⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:2736
                                                                                                                                                    • C:\Windows\system32\vssadmin.exe
                                                                                                                                                      vssadmin.exe delete shadows /all /quiet
                                                                                                                                                      3⤵
                                                                                                                                                      • Interacts with shadow copies
                                                                                                                                                      PID:2768
                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:2800

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\$Recycle.Bin\HOW_TO_DECRYPT.txt
                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  ee4ad142674725d6d9b58c9c3bb836dc

                                                                                                                                                  SHA1

                                                                                                                                                  ac9bac37131c72a549d2bf3fbd233061906d5fab

                                                                                                                                                  SHA256

                                                                                                                                                  fc1f1ed6a6692d18788de47420ead7e8a1b534b015db69a39052a0a2fc30c776

                                                                                                                                                  SHA512

                                                                                                                                                  a34c547d13880b578703f52b7d3d61b1893536966204d80a9e0f60aee8851bd9f70e3d0ceb1601aa11901c6315f57128c49f2000cc4fcbc67ed92e4628e45da3

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini
                                                                                                                                                  Filesize

                                                                                                                                                  129B

                                                                                                                                                  MD5

                                                                                                                                                  2adc92efc54016e58eabc4fa55f131b1

                                                                                                                                                  SHA1

                                                                                                                                                  ffd5c3a7904ae370886a98330cc5675b99ee2c3f

                                                                                                                                                  SHA256

                                                                                                                                                  9bda481b38e6f4f1063bceda964fd68f1ffd7683c192de8d0755965791d8e27f

                                                                                                                                                  SHA512

                                                                                                                                                  7f0de144ea93cfae002ed5adb4efb3b7e57f6526cffd055b676130c832e44b27c1889df9c928ab8029cd14876dfdec884e417f8ffab8e1ac6d1e091a55aa9bbc

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\hive.bat
                                                                                                                                                  Filesize

                                                                                                                                                  232B

                                                                                                                                                  MD5

                                                                                                                                                  6358d970c3edccb57eae7dbf9f42d58f

                                                                                                                                                  SHA1

                                                                                                                                                  25b994c3b5604f4f67e1ac6250bc2f14ce690380

                                                                                                                                                  SHA256

                                                                                                                                                  9e36401051e677f69a82ab8fbdebd6b16210ee40612c8c7fa45ceb5d7757fe50

                                                                                                                                                  SHA512

                                                                                                                                                  44819fec7e90b903eece750d0a2de531520ed9e637e17e4a57786f9a61c6d4b95ff6072fc3530a9d35d8dc756bcfe20f80a6a07a72d35cf24b305053ae389131

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\shadow.bat
                                                                                                                                                  Filesize

                                                                                                                                                  57B

                                                                                                                                                  MD5

                                                                                                                                                  df5552357692e0cba5e69f8fbf06abb6

                                                                                                                                                  SHA1

                                                                                                                                                  4714f1e6bb75a80a8faf69434726d176b70d7bd8

                                                                                                                                                  SHA256

                                                                                                                                                  d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                                                                                                                                                  SHA512

                                                                                                                                                  a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                                                                                                                                                  Download Submit

                                                                                                                                                • memory/760-3547-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-3931-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-272-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-944-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-1876-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-2807-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-0-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-42-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-4303-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-4304-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-4305-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-4306-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-1-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-4873-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-8793-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download

                                                                                                                                                • memory/760-10792-0x00000000001F0000-0x00000000004C9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.8MB

                                                                                                                                                  Download