Overview

overview

10

Static

static

10

2024-08-12...ch.exe

windows7-x64

10

2024-08-12...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    12-08-2024 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe

  • Size

    2.2MB

  • MD5

    61a8fc763aa8bfdb1e43001566bcfce7

  • SHA1

    b65880c2c590b3d2f736bf2818be923214a6efe5

  • SHA256

    8d797c2e404f3162c836020500b99c524deedabfc4770ee54fd9e0ea8bfd2ef4

  • SHA512

    5c39fb96e97dd7291b55b3d16ca0b0521e391369aa639801054e1011b11b3680ec2374dac8b2447677a23bf480c4b2014bb90442f0e8afe1b298c08650d14823

  • SSDEEP

    24576:lm8bqgR8VT8P5ZmUbFJnDoaY3azzKSP/OFvIxJH92ZK86EqDh8YCJjiraf4oAV/j:v73h3P/4K81TjasiXCUVnjU1HO1

Score
10/10
hivecredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops file in Drivers directory 28 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c hive.bat >NUL 2>NUL
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:2584
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:532
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:2556
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:3040
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
          PID:2548
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
            PID:1528
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:960
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:2688
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:2344
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:2956
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2076
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:604
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:2300
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2936
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2104
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:1276
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
              PID:1264
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:2392
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:2676
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:3020
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2420
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:744
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1920
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              PID:976
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1900
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
                PID:1320
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:352
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:976
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2068
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:848
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2604
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:1928
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1984
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:1556
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2184
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:1496
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                  PID:2236
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2588
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:2564
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:2472
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:832
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                    PID:1924
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:2540
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:344
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                      PID:2712
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:332
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2944
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:2100
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:1360
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:3060
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:900
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2496
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:2356
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2180
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                        PID:2416
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:3032
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2620
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:3016
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                          PID:2916
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                            PID:1608
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Delays execution with timeout.exe
                            PID:1592
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Delays execution with timeout.exe
                            PID:2180
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                              PID:1920
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2632
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                                PID:940
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                  PID:1608
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:2320
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:928
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:988
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1528
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2652
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:1876
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                        PID:2724
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                          PID:1496
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Delays execution with timeout.exe
                                          PID:448
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                            PID:2220
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Delays execution with timeout.exe
                                            PID:2976
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Delays execution with timeout.exe
                                            PID:2152
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:2428
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:2520
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                              PID:2192
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:2644
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:156
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • Delays execution with timeout.exe
                                              PID:1444
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:2600
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                                PID:2856
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:604
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:1568
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2968
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                • Delays execution with timeout.exe
                                                PID:1420
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                  PID:2828
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2168
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:2304
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2932
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:1484
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                    PID:2720
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                      PID:1268
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2312
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                        PID:2084
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                          PID:2320
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:2552
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                            PID:448
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:2632
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                              PID:2364
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:1844
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:752
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                                PID:992
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:1944
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Delays execution with timeout.exe
                                                                PID:1272
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:2324
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:1560
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                  PID:2628
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:332
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                    PID:2468
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                      PID:540
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                        PID:1828
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                          PID:2208
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                            PID:2372
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Delays execution with timeout.exe
                                                                            PID:2424
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                              PID:1668
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                                PID:2996
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                  PID:2296
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:2184
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                    PID:2708
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                      PID:2220
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:352
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:2556
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2484
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:3040
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2444
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:1728
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:2896
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1528
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                        PID:2356
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                          PID:1756
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                            PID:2100
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2780
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                              PID:1644
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd /c shadow.bat >NUL 2>NUL
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2116
                                                                                            • C:\Windows\SysWOW64\vssadmin.exe
                                                                                              vssadmin.exe delete shadows /all /quiet
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Interacts with shadow copies
                                                                                              PID:2540
                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                          C:\Windows\system32\vssvc.exe
                                                                                          1⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1236
                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                          1⤵
                                                                                          • Loads dropped DLL
                                                                                          • Enumerates connected drives
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2060
                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding C147172E2949E98174A424C0F4B15399
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1708
                                                                                          • C:\Windows\system32\MsiExec.exe
                                                                                            C:\Windows\system32\MsiExec.exe -Embedding AD5138FC272727C4D91722C91B2C46C7
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            PID:2260

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini
                                                                                          Filesize

                                                                                          129B

                                                                                          MD5

                                                                                          31f6efda8e23000ab794ed8c1d754d2d

                                                                                          SHA1

                                                                                          f286c00b78be2f024f9f0533d20b396f7a64f98f

                                                                                          SHA256

                                                                                          5f002c254f4f74cc398af003512145108f9be2dab1a0e786588a89c7abf9c352

                                                                                          SHA512

                                                                                          ac73ff3a417d355b0b54613cb5e4fbad55a43a67175dbb39924feb440792c1beaa5afc57c5901711d697325ab149242564f3bf16fcbd070671e48049c3418074

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\hive.bat
                                                                                          Filesize

                                                                                          254B

                                                                                          MD5

                                                                                          084fc00cf61779cd2302fd4f25c6a01a

                                                                                          SHA1

                                                                                          c8f3f7e5d2c36aa21f154dce508803cdafc7feae

                                                                                          SHA256

                                                                                          6092fcdce0693ec89ba708c582a321e799dd24a5e7bc7cae65ee006f647fff70

                                                                                          SHA512

                                                                                          58128583a4825035f3add3262be08d688cc024a49006533b9d0bb810c543fb2bcd884b1bdbf8581beb347a4ff22593bc7e08284c8399d95b3e48df08e74f117c

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Temp\shadow.bat
                                                                                          Filesize

                                                                                          57B

                                                                                          MD5

                                                                                          df5552357692e0cba5e69f8fbf06abb6

                                                                                          SHA1

                                                                                          4714f1e6bb75a80a8faf69434726d176b70d7bd8

                                                                                          SHA256

                                                                                          d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                                                                                          SHA512

                                                                                          a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                                                                                          Download Submit

                                                                                        • C:\Windows\Installer\MSIA832.tmp
                                                                                          Filesize

                                                                                          363KB

                                                                                          MD5

                                                                                          4a843a97ae51c310b573a02ffd2a0e8e

                                                                                          SHA1

                                                                                          063fa914ccb07249123c0d5f4595935487635b20

                                                                                          SHA256

                                                                                          727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

                                                                                          SHA512

                                                                                          905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

                                                                                          Download Submit

                                                                                        • C:\Windows\Installer\MSIAB41.tmp
                                                                                          Filesize

                                                                                          28KB

                                                                                          MD5

                                                                                          85221b3bcba8dbe4b4a46581aa49f760

                                                                                          SHA1

                                                                                          746645c92594bfc739f77812d67cfd85f4b92474

                                                                                          SHA256

                                                                                          f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

                                                                                          SHA512

                                                                                          060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

                                                                                          Download Submit

                                                                                        • C:\Windows\Installer\MSIAC1D.tmp
                                                                                          Filesize

                                                                                          148KB

                                                                                          MD5

                                                                                          33908aa43ac0aaabc06a58d51b1c2cca

                                                                                          SHA1

                                                                                          0a0d1ce3435abe2eed635481bac69e1999031291

                                                                                          SHA256

                                                                                          4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

                                                                                          SHA512

                                                                                          d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

                                                                                          Download Submit

                                                                                        • C:\Windows\Installer\MSIAE41.tmp
                                                                                          Filesize

                                                                                          86KB

                                                                                          MD5

                                                                                          ff58cd07bf4913ef899efd2dfb112553

                                                                                          SHA1

                                                                                          f14c1681de808543071602f17a6299f8b4ba2ae8

                                                                                          SHA256

                                                                                          1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

                                                                                          SHA512

                                                                                          23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

                                                                                          Download Submit

                                                                                        • F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\HOW_TO_DECRYPT.txt
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          80207d0f8ea42bdfeaf9f5c586230aca

                                                                                          SHA1

                                                                                          747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

                                                                                          SHA256

                                                                                          25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

                                                                                          SHA512

                                                                                          73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

                                                                                          Download Submit

                                                                                        • \Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
                                                                                          Filesize

                                                                                          47KB

                                                                                          MD5

                                                                                          81e7e920312d372cf57a817049ac7c76

                                                                                          SHA1

                                                                                          0a2e953f2d8ecdf984532f2d8e3c0264fc079498

                                                                                          SHA256

                                                                                          ff9a2e7fe46937b34f8e61f58df1f6108742cce58505f212e8666cb4ab7b74f9

                                                                                          SHA512

                                                                                          76530f002a84a791f1b440c1ab57138b8813dc395027e5c02002d67e9c7a72d6e448bbc2f844fd2cfb61259c37d916a6835035bdb442b45814c1d1aab4743a52

                                                                                          Download Submit

                                                                                        • \Program Files\Microsoft Office\Office14\VISSHE.DLL
                                                                                          Filesize

                                                                                          953KB

                                                                                          MD5

                                                                                          2f4759c23abcd639ac3ca7f8fa9480ac

                                                                                          SHA1

                                                                                          9a3fece585fa01b7b941e124ead0c39c8ce9bc7c

                                                                                          SHA256

                                                                                          6d66fa59407862e0fddfcb36472fe810eb308653321ca0e374ac870f9aa8cec6

                                                                                          SHA512

                                                                                          6ab14d6a8d3e9a751d68133e734cc804de2b50a7ef223d484d0f727cdfbd00d48f6e0666c3b86a0daf9ca42c0b726f6c2a088e5bb32c993748abfea7b5904ec6

                                                                                          Download Submit

                                                                                        • \Windows\Installer\MSIA6AB.tmp
                                                                                          Filesize

                                                                                          257KB

                                                                                          MD5

                                                                                          d1f5ce6b23351677e54a245f46a9f8d2

                                                                                          SHA1

                                                                                          0d5c6749401248284767f16df92b726e727718ca

                                                                                          SHA256

                                                                                          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                                                                                          SHA512

                                                                                          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                                                                                          Download Submit